SellSpace
Privacy Policy
What we collect, why, who we share it with, and your rights under the GDPR.
1. Who is responsible
The controller for the data described here is SellSpace. Contact for privacy questions: [email protected]. We have not appointed a data protection officer.
Two roles. We are the controller for account data, billing data, platform security and analytics. For the personal data of a store's own customers (Buyers) the Seller is the controller and SellSpace acts as processor; see the Data Processing Terms.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: name, e-mail address, hashed password, role, plan | Create and secure your account, log you in, communicate service messages | Contract (6(1)(b)) |
| Optional sign-in with Google or Discord: your provider user ID, your name and the verified e-mail address that provider sends us (we do not receive your provider password and we do not keep the provider's access tokens) | Let you log in and link the login to your account | Contract (6(1)(b)); you choose to use it |
| Seller store data: shop name, subdomain, settings, products, domains, team members | Provide the store | Contract |
| Orders: buyer e-mail address, products, amounts, status, delivered keys or files, custom field answers | Process orders, deliver, support, refunds, accounting | Contract, legal obligation |
| Payment data: handled by Stripe. We receive status, amount and limited details (such as card brand and last digits). We do not store full card numbers. | Payments, payouts, billing | Contract |
| Support tickets and messages | Handle requests | Contract, legitimate interest |
| Analytics: page views, referrer hostname, device and browser type, country (best effort), random visitor and session ID. No IP address is stored and no cookies are used. Do Not Track and Global Privacy Control are respected. | Show sellers how their store performs and improve the product | Legitimate interest (6(1)(f)) |
| SellSpace website visitor statistics: one anonymous counter per day, country and area of about 50 km. The approximate location comes from our network provider (Cloudflare) or, if that is missing, from an offline IP location database (IP Geolocation by DB-IP). No IP address, cookie or visitor ID is stored. Do Not Track and Global Privacy Control are respected. | See where interest in SellSpace comes from | Legitimate interest (6(1)(f)) |
TikTok Pixel on our own website pages (homepage, sign-up, log-in, privacy policy), only if you accept marketing cookies: TikTok's code sets cookies (such as _ttp) and sends TikTok the page you visit, technical device and browser data, your IP address (received by TikTok, not stored by us), a TikTok click ID if you came from a TikTok ad, and whether you created a SellSpace account ("CompleteRegistration"). We do not give TikTok your name, e-mail address or phone number. Never used in shops, the dashboard or the admin area. | Measure and improve our TikTok advertising campaigns (which ads lead to visits and sign-ups) | Consent (6(1)(a)); withdraw any time via "Cookie settings" |
| Security and technical logs; abuse reports and moderation records | Secure the service, prevent fraud, enforce our rules, meet DSA duties | Legitimate interest, legal obligation |
| Media Helpers, optional TikTok connection: your TikTok display name and avatar link, a TikTok account identifier, and (read-only) the caption, upload date and view count of your own TikTok videos. The access tokens are stored encrypted. We never post anything, never read messages, followers or private videos, and you can disconnect at any time in Media Helpers; disconnecting revokes the token at TikTok and deletes the stored tokens. | Prove that a submitted video is yours and count its views toward your template discount | Consent (6(1)(a)): you choose to connect, and can withdraw by disconnecting |
| Media Helpers, YouTube: for each video link you submit we read its public title, description, publish date and view count from the YouTube Data API (no sign-in, no access to your Google account) | Check the hashtag and count the views | Contract |
| Program data (partners, Media Helpers): referral data, Twitch channel, links to videos and review results | Run the programs, calculate shares and discounts | Contract |
| Referral program: which account referred you, what referred users bought (amounts, no card data) and the credit ledger. At sign-up through a referral link we also keep a salted one-way hash of IP address and browser for 90 days, only to detect people referring themselves | Run the program, calculate account credit, prevent abuse | Contract, legitimate interest |
| Consent records at sign-up: that you accepted the Terms and Privacy Policy, version and time | Prove acceptance | Legitimate interest, contract |
We do not sell personal data, we do not build advertising profiles ourselves (TikTok may use pixel data for its own purposes if you consent, see below) and we do not use automated decision-making that has legal effects on you without human review. The keyword filter and the three-reports rule are automated safeguards that are followed by human review (see the Acceptable Use Policy).
3. Who receives data
- Stripe (payments, Stripe Connect, subscriptions, identity verification of Sellers). Stripe acts as an independent controller for its own purposes (see Stripe's privacy policy) and as our processor for some services.
- Google and Discord, only if you choose "Continue with Google" or "Continue with Discord" (sign-in providers). They tell us your name, your verified e-mail address and your provider user ID; they act as independent controllers for their own processing (see their privacy policies). You can unlink the provider in Settings.
- TikTok and Google / YouTube, only if you use Media Helpers: we call the TikTok Display API (with your consent, only for your own connected account) and the public YouTube Data API to read video details and view counts. They act as independent controllers for their own processing (see their privacy policies).
- TikTok (TikTok Technology Limited, Ireland, and its group companies), only if you accept marketing cookies on our website: data collected by the TikTok Pixel (see section 2). For collecting and sending this data we and TikTok are joint controllers; TikTok's further processing is under its own responsibility (see TikTok's privacy policy).
- Resend (sending transactional e-mails such as verification, password reset, order delivery and invitations): processor.
- Our hosting provider (hosting and infrastructure): processor.
- The Seller of the store where a Buyer purchases receives the order data needed to fulfil it.
- Tax authorities and other authorities, where we are legally required or where a lawful request is made.
- Professional advisers (accountants, lawyers) under confidentiality.
The list of sub-processors is in the Data Processing Terms. We keep it up to date.
4. International transfers
Some processors (for example Stripe, Resend) and TikTok (if you accept marketing cookies) may process personal data outside the European Economic Area, including in the United States. We rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the EU Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the safeguards.
5. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account exists; deleted or anonymised within 30 days after you close it, except what we must keep. |
| Invoices, order and payment records, tax data | 7 years, where the law requires us to keep bookkeeping records. |
| Support tickets | 24 months after the ticket is closed. |
| Abuse reports and moderation records | 2 years, longer where needed for legal claims. |
| Analytics | Pseudonymous records without IP addresses, kept for 12 months. |
| Server logs | 90 days. |
| Your cookie choice (in your browser) | 12 months, then we ask again. TikTok Pixel cookies (only with consent): up to 13 months, set and controlled by TikTok; they are removed from our site when you withdraw consent. |
| Anti-Fraud logs (sellers' fraud rules) | 90 days. They hold no IP address, only a one-way fingerprint of the network and the country. |
6. Your rights
Under the GDPR you have the right to: access your data; correct it; have it erased; restrict processing; object to processing based on legitimate interest; receive your data in a portable format; and withdraw consent where we rely on it. To use a right e-mail [email protected]. We answer within one month. We may ask you to verify your identity.
If you are a Buyer in a store, contact the Seller first, since they are the controller of your purchase data; we help them where we are the processor.
You have the right to complain to the supervisory authority. In the Netherlands that is the Dutch Data Protection Authority. You can also complain in the EU country where you live or work.
7. Cookies and local storage notice
In the dashboard, the admin area and the shops SellSpace does not use tracking, advertising or analytics cookies (shops may use their own cookie banner for tools the Seller adds). We use a few strictly necessary, HttpOnly cookies for your login session (and, while you sign in with Google or Discord, a short-lived cookie that protects that sign-in), and we store a small amount of information in your browser's localStorage (and sessionStorage), only for things that are necessary for the service or that you chose:
- your login session: the session cookie (ends when you close the browser unless you choose "Remember me"), with "Remember me" a refresh cookie that keeps you logged in for up to 30 days of activity (staff: at most 7 days), and a marker that you are logged in. Your list of active sessions shows only a device type such as "Chrome on Windows", never an IP address;
- preferences such as the light or dark theme and the shop you last selected in the dashboard;
- a referral code if you arrived through a partner or referral link, until you sign up;
- your cookie choice for our website (see below).
This data stays in your browser, is not used to follow you across websites, and can be removed in your browser settings (you will then be logged out). Our analytics are cookie-free and do not store IP addresses. Third parties, such as Stripe on its payment pages, may set their own cookies; see their policies.
8. Security
Passwords are stored hashed. Traffic is encrypted (HTTPS). Delivered files are served through time-limited signed links. Access to data is limited to what is needed, and staff accounts are protected with two-factor authentication. If a personal data breach affects you, we notify the authority and you as the law requires.
9. Children
SellSpace is not meant for people under 16, and seller accounts require adulthood. If you think a child gave us data, contact us and we delete it.
10. Changes
We update this policy when our practices change. The version and date are at the top; for important changes we inform account holders.