LERETAGE Privacy Notice

English · Version 1.6 · 30 October 2026

Controller and contact

Data controller: SHAMIL MAMIN, self-employed individual (autónomo), Spain. Address: Calle de Don Ramon de la Cruz 46, 4-D, 28001 Madrid, Spain. For privacy requests contact hello@leretage.com, handled by the operator. No separate data protection officer is represented as appointed. Version privacy-2026-10-30-v6. Effective from 30 October 2026. This notice concerns the hosted iOS pilot and its on-device mode, separately from leretage.com.

Information we process

Account name, email, role, boutique name and password hash; boutique city, country and description when supplied; product details, prices and selected photographs; sourcing preferences, budgets and reference photos; proposals, conversation messages and read positions; blocks, reports and support text. The service also handles IP-based security counters, operational identifiers and selected audit events. Do not submit identification documents, card details or sensitive personal information through requests or chat.

Why we use it

Account and sourcing information necessary to deliver the requested pilot functions is processed to perform the user agreement, including boutique participation, requests and participant messaging. Proportionate security, abuse prevention and moderation use legitimate interests in protecting users and the service. Applicable legal obligations provide a basis where the particular processing is legally required. Optional birth-date storage and birthday permission use separate voluntary consent; the date can be removed and birthday permission withdrawn in Account settings. Greeting delivery is disabled. Acceptance of terms does not constitute blanket GDPR consent.

Who sees information

Approved boutiques can see open sourcing descriptions, budgets and selected reference photos, without the buyer’s email or account identifier in their request feed. Boutique profiles and approved available items are visible to signed-in pilot users. Offer-linked conversations are accessible to their participants and authorised operators who administer the service; they are not end-to-end encrypted. Reports are available through the app only to their author and are accessible to authorised administrative staff. Other users do not receive the report author’s details automatically. Reports can receive a written response from the operator, shown only to the report author in Help & Support after refresh. It is a manual review response, not live chat; no email or push notification is automatically sent. You may request reconsideration at hello@leretage.com using your report reference. Account deletion removes associated reports, written responses and operational audit entries referencing the deleted content.

Providers and location

Cloudflare provides the API and D1 database under its Self-Serve Subscription Agreement, whose section 6.1 incorporates the Data Processing Addendum for covered personal data. The published DPA is version 6.4, effective 3 April 2026. D1 was created with EU jurisdiction; this does not make all edge, security, support or backup processing EU-only. Google Workspace Business Standard provides the support mailbox and the isolated Apps Script password-recovery relay. Apps Script is a Workspace Core Service. The operator accepted the Google Cloud Data Processing Addendum on 14 October 2026, confirmed in Admin Console. Google receives recovery-recipient email, the one-time code and delivery metadata; the recipient mailbox retains delivered messages under its own rules. Provider processing and applicable international-transfer safeguards are described in their data-processing terms. Contact hello@leretage.com to request information about providers and safeguards.

Photos and AI

Camera access is requested only when you choose Take photo. The system picker shares selected images, not your full library. Images are resized and re-encoded. AI Hunter is optional: after separate permission, pressing Analyze sends your description, selected photo (if any) and response language through our server to OpenAI API to prepare a sourcing brief. Account email, name and birth date are not added to that API request. Avoid including personal or sensitive information in text or photos. This processing is based on your consent; you may stop future analyses by not granting permission. Manual requests remain available. OpenAI processing may occur outside the EEA; exclusively European processing and Zero Data Retention are not configured or promised. Requests use store=false; this does not disable provider abuse-monitoring retention, normally up to 30 days with legal and safety exceptions. See OpenAI data controls and its applicable processing terms. We retain the generated brief and an account-linked consent/attempt record to return the same result on retries and limit abuse, until account deletion. Raw analysis input and photos are not saved separately in the AI analysis table; content you submit as a sourcing request follows the request retention rules. Aggregate daily attempt counts contain no account identifiers and remain after deletion. AI may infer brands or models incorrectly; it does not authenticate items, search live inventory or make legally significant automated decisions.

Storage and deletion

Account-linked records are retained while the account is used to provide the pilot, until account deletion, without representing any additional automated inactivity deletion. Deletion removes active account-related records, including preferences, related conversations and reports, and may remove content from a counterpart’s history. Manual app database exports have the owner-approved maximum of 30 days; the operator runs the retention check and deletes expired eligible copies. D1 Time Travel has a separate 30-day recovery window on the current paid plan. A restoration must account for deletion requests and must not silently reactivate deleted accounts. The server removes expired sessions, recovery codes and security counters during subsequent authentication-related traffic. Expiry immediately prevents their use; database cleanup is event-driven, not a timed daily job. Other active account-linked records remain until account deletion or a separately documented necessary retention rule. There is no automatic inactivity deletion.

Your choices and rights

You may request access, correction, erasure, restriction and, where applicable, portability or object to legitimate-interest processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact hello@leretage.com; we must verify identity proportionately and avoid collecting unnecessary documents. GDPR requests are normally answered within one month, with a lawful extension explained when applicable. You may complain to the competent supervisory authority; for Spain, the AEPD at www.aepd.es. Using account deletion does not limit these rights.

On device and future changes

Language, role choice and saved items are kept on the iPhone; guest requests and drafts may stay in local app storage. Connected credentials use the iOS Keychain and server sessions are stored as hashes. Removing a server account does not promise to erase independent device backups or previously exported material. No advertising or tracking SDK is integrated in the inspected native source; future analytics, marketing, payments or shipping require an updated notice and any necessary permissions. The pilot is restricted to adults aged 18 or over. Adult eligibility is self-declared. Optional birth dates are checked for adult eligibility but do not verify identity.

Birth date and greetings

You may optionally provide your full birth date to help us check adult eligibility and, if you separately agree, receive birthday greetings by email. For a boutique this is the contact person’s birth date. You can remove the date and withdraw permission in Account settings. We do not display it publicly. Birthday sending is not active during this pilot. Account deletion removes these preferences from the operational database; backup copies follow the separately documented backup retention.

Manual backups

The operator has selected a maximum 30-day retention period for manual application database backups, managed through an operator retention check. Cloudflare D1 Time Travel has a separate 30-day recovery window on the current paid plan. Deleted data may remain in these recovery copies until expiry. A recovery must not reintroduce deleted accounts into active use. A daily external backup to Google Drive is configured through a separate Google Apps Script; the configured retention is 30 days. Backup execution can fail and requires monitoring.

Operator email alerts

New support requests or reports and boutique applications create a private notification for the LERETAGE operator at hello@leretage.com. Our Google Apps Script sender receives the operator destination, event type, reference identifier, timestamp and anti-replay nonce. Alerts do not contain the applicant name or email, report text, private messages, passwords or recovery codes. They help the operator review applications and respond to support; an alert does not approve a boutique or resolve a report. Queue metadata and sender deduplication identifiers are kept for up to 30 days. Deleting the source report or boutique removes its active queue record. Failed sends are retried for up to seven days; persistent failures require operator action. Delivered notifications remain in the operator mailbox under its mailbox rules.

Email confirmation

Email confirmation codes are sent to the signed-in account’s email address. Codes expire after 15 minutes and allow at most five attempts. Resends are limited. Confirming an email does not approve a boutique or authenticate a piece. We store a keyed digest of the temporary code, its expiry, limited-attempt and resend metadata and the confirmation timestamp. Codes are not stored in plaintext in the application database. Expired code digests are cleared by a five-minute scheduled cleanup; an unused or exhausted code cannot confirm the email after expiry. The confirmation record remains until account deletion and is removed from the active database with that account. Google processes the address and code to deliver this security email, separately from marketing. Existing provider backup and mailbox retention rules still apply.

Updated documents and confirmation history

When the published terms or privacy notice change, existing accounts are asked to review the current documents. Terms acceptance and privacy acknowledgement are separate, initially unselected controls. We store the document version identifiers, confirmation language and timestamp, including previous recorded versions, to evidence which documents were confirmed. This action does not grant marketing or AI-analysis permission. The records are account-linked, retained until account deletion and removed from the active database with the account; the existing backup retention rules apply. Support, sign-out and account deletion remain available without accepting an update.

Optional push notifications

You can enable service notifications in Profile → Notifications and the iPhone permission prompt. We use Apple Push Notification service (APNs) for generic notices about messages, boutique proposals, matching inventory categories and boutique application status. Service notices do not include message text, photographs, names, email addresses, prices or request descriptions. Apple receives the device token, delivery metadata, an opaque account identifier and an opaque in-app target reference. Cloudflare stores the account-linked token, random installation identifier, a digest of an installation secret, language, APNs environment and delivery state. A device subscription is separate from the 24-hour login session: notices can continue after login expiry, but opening protected content still requires a valid sign-in. Tokens are kept until device withdrawal, account deletion or an APNs invalid-token response. Normal online sign-out revokes the current device subscription. An offline sign-out or off action queues device withdrawal, retried when the app reconnects; iPhone Settings independently stops display. An installation secret can only revoke that installation and cannot sign in or read account content. Account deletion and password recovery revoke device subscriptions. Service event records are retained for at most 30 days; queued service delivery expires after 24 hours. Already transmitted notifications may still appear. Delivery is best-effort; in-app history remains the source of messages.

Special offers and new drops

Marketing push notifications from LERETAGE require the separate, optional Offers & new drops switch. It is off by default. Enabling service notifications, confirming email or acknowledging documents does not opt you into marketing. The legal basis for this optional channel is your consent; you can withdraw it in Profile → Notifications without disabling service messages, and the notification controls remain accessible from the document-update screen. We record the account identifier, choice, consent-text version and timestamps, including withdrawal history, until account deletion. Device/account identifiers and preference/delivery records are used for this first-party marketing only if you opt in; no advertising identifier, third-party ad SDK or cross-app tracking is used. Campaigns contain general LERETAGE announcements rather than messages tailored using your birth date, photos, request text or conversation content. Delivery checks current permission and device ownership again before sending. New consent does not replay old campaigns. The sender applies a one-campaign-per-device daily limit; campaigns expire within seven days. Marketing delivery references are removed within 30 days of campaign publication and on account deletion. General campaign text is not account data and may remain after recipient records are deleted. No promotional email channel or birthday delivery is activated by this switch. Existing provider backup retention rules apply.