Privacy
Translation for information only — only the French version is legally binding. French version
What data we process, why, for how long, and how to change your mind.
What the site keeps on your device: cookies and local data.
Who is responsible for this data
Data controllerE-Com Digitalbiz SRL, which operates VeriFlip — full contact details
Company numberBE 0772.519.183
Contactcontact@veriflip.app
HostingThe site is hosted by a provider named in the legal notice; the database and photos are hosted by a second, unnamed provider. The site’s data stays in the European Union, in Frankfurt; data from a call to the reception line is processed in the United States (see below). Your browser loads photos directly from this storage: its IP address is visible there, as on any site that displays images.
What we record, and when
This list is of the data actually recorded by the software, not a general statement. Each line corresponds to a field that exists.
✓Before opening — the address left on the entry pageThe address, the date, and the page that asked for it. Nothing else: no IP address, no browser fingerprint, no advertising source. Legal basis: your consent. Purpose: to tell you when we open, and nothing else — we do not sell it or pass it on. Retention: one year after opening, then deletion. Every message has a working unsubscribe link; you can also write to contact@veriflip.app.
✓When signing up — email address, username, countryNothing else is mandatory: the two optional fields are described below. No name, no postal address, no identity document. Legal basis: performance of the contract between us. Retention: for as long as the account exists, then deletion on request.
✓If you tell us your preferencesThe categories, sizes and brands you choose to tell us, in “Manage my account”. They are used only to order the “For you” row on the home page for you; we infer nothing from what you look at. Legal basis: your request. Retention: until you delete them, or with the account.
✓If you choose a languageThe code of the language chosen in the language selector (for example “nl”), kept on this device and, if you are signed in, with your account, so the site is shown in that language on your other devices. Nothing else is inferred from this choice. Legal basis: your request. Retention: until you change it, or with the account.
✓If you turn on notifications on a deviceThe address your browser gives us to reach it (it goes through the notification service of its publisher: Google, Mozilla or Apple), its two keys, and the types chosen. We only send it an empty signal: the text of the notification — who is writing to you and about which item, never the content of the message — is fetched from our server, and deleted after a week. Legal basis: your consent, given by tapping “Turn on notifications” and then allowing it in the browser. Retention: until you turn them off, the service tells us the address no longer exists, or the account is deleted.
✓When signing in from an unknown device — a code by emailOn a device your account has never used, we send a code to your address before signing you in. We then record the fingerprint of the device’s cookie (not the cookie itself), the country of the sign-in — inferred by our host from the IP address, which we do not keep —, and two dates. The code is only kept in encrypted form, 10 minutes at most; it is deleted as soon as it is entered. Legal basis: our legitimate interest in protecting your account and the money that passes through it, and our security obligation (GDPR, art. 32). Retention: as long as the device is used; a record unused for 400 days is deleted, and all of them go with the account, or with one tap in “Recognised devices”, on your account page.
✓If you declare your seller status — private individual or professionalYour choice, its date, and the exact text you read or ticked: this is the proof that we collected your declaration and, for a private individual, that we warned them before they listed. If you publish a first listing without having declared anything, we record in the same way, at that moment, the private individual status and the warning shown above the “Publish” button. If you declare that you sell as a professional: the business name, the company number, the VAT number if there is one and the registered office address.
This business information is shown to your buyers on your listings and on the payment screen: a buyer must know who they are buying from. A member of our team checks the number against the public business register; the decision, and the reason for any refusal, are kept with the declaration. Legal basis: legal obligation — informing buyers about the seller’s status.
Retention: for as long as the account exists. An account with no order is deleted together with its declarations; an anonymous record keeps track that a declaration was made, without the name, number or address.
This business information is shown to your buyers on your listings and on the payment screen: a buyer must know who they are buying from. A member of our team checks the number against the public business register; the decision, and the reason for any refusal, are kept with the declaration. Legal basis: legal obligation — informing buyers about the seller’s status.
Retention: for as long as the account exists. An account with no order is deleted together with its declarations; an anonymous record keeps track that a declaration was made, without the name, number or address.
✓While listing — the draft of your listingAs long as you have no account, what you fill in during the first steps stays on your device: nothing reaches us. Once you have an account, this draft — department, category, brand, model, condition, item details, title, description and price — is also saved with it, so you can find it on another device. It contains no photos. Legal basis: performance of the contract, at your request. Retention: it is deleted as soon as the listing is published, and at the latest 30 days after it was last changed.
✓If you turn on holiday mode — its datesThe day you turn it on, and the return date if you give one. They are used to hide your listings for sale while you are away, and to say so on your profile. Legal basis: performance of the contract, at your request. Retention: until you turn it off, and at most 90 days per period; past dates remain until your next holiday, and go with the account.
✓If you change your username — your previous usernamesEach username you leave, and the date of the change. They make your old profile and invitation links lead to your current name, stop someone else from taking them, and count the waiting time before the next change. Legal basis: performance of the contract, and our legitimate interest in preventing anyone from impersonating you. Retention: for as long as the account exists, then deleted with it.
✓If you change your email address — the requestThe new address, the date of the request, its expiry (24 hours) and that of the confirmation, with a fingerprint of the link sent — never the link itself. Legal basis: performance of the contract, at your request. Retention: for as long as the account exists, then deleted with it.
✓If you follow sellers — the listThe sellers you follow and since when. Nobody else sees it, neither the sellers nor other members; no email results from it. Legal basis: performance of the contract, at your request. Retention: until you stop following, and deleted with your account or the seller’s.
✓When buying — order, amount and delivery addressWe never see your card number: it goes directly to our payment provider. Orders are kept for ten years, the legal retention period for accounting records in Belgium.
Your delivery address is passed to the carrier so it can deliver the parcel, and to the seller of your paid order, so they can ship: it appears on the label they print, and nowhere else. You can choose a pick-up point instead of a personal address — that is the default. Legal basis: performance of the contract.
If you tick “Keep this address for my next purchases”, we keep it on your account (only one address), to fill in the next checkout screen and show the postage that applies to you. Unticking the box deletes it; so does deleting your account. Legal basis: your request, by ticking the box.
Your parcel’s label, as the carrier prints it to route the parcel, is kept in a private space so the seller can download it and stick it on the parcel. Only the seller of the order can open it, through a link valid for 60 seconds. It is deleted when the parcel is delivered, or when the order is refunded. Legal basis: performance of the contract.
The photo of the parcel, if the seller takes one at drop-off (optional): it shows the label, and therefore the buyer’s name and address. It is kept in the same private space, and only the buyer, the seller and the order’s arbitration team can open it. It is deleted 90 days after the order ends, or with the account of either party. Legal basis: our legitimate interest in establishing what was sent in the event of a dispute.
Your delivery address is passed to the carrier so it can deliver the parcel, and to the seller of your paid order, so they can ship: it appears on the label they print, and nowhere else. You can choose a pick-up point instead of a personal address — that is the default. Legal basis: performance of the contract.
If you tick “Keep this address for my next purchases”, we keep it on your account (only one address), to fill in the next checkout screen and show the postage that applies to you. Unticking the box deletes it; so does deleting your account. Legal basis: your request, by ticking the box.
Your parcel’s label, as the carrier prints it to route the parcel, is kept in a private space so the seller can download it and stick it on the parcel. Only the seller of the order can open it, through a link valid for 60 seconds. It is deleted when the parcel is delivered, or when the order is refunded. Legal basis: performance of the contract.
The photo of the parcel, if the seller takes one at drop-off (optional): it shows the label, and therefore the buyer’s name and address. It is kept in the same private space, and only the buyer, the seller and the order’s arbitration team can open it. It is deleted 90 days after the order ends, or with the account of either party. Legal basis: our legitimate interest in establishing what was sent in the event of a dispute.
✓In messages — your messages, your blocksThe text of your messages, your offers and the replies to them, with their date and when they were read, linked to the listing and to the two people in the conversation. Only these two people read them; moderation only sees messages reported to it. Legal basis: performance of the contract — asking a question, negotiating, concluding a sale. Retention: for as long as your account exists.
The photos you send in a conversation are stripped of their hidden data — location, device, date taken — before being stored in a private storage space: no public address, a link valid for a few minutes each time they are displayed, for the two people in the conversation and, in the event of a report or a dispute, for moderation. They are deleted with your account, or as soon as moderation removes them.
If you block a member: who, and since when, for as long as the block lasts; unblocking deletes the line. The blocked member does not see this list. Moderation reads it when you are in a dispute with them. Legal basis: our legitimate interest in protecting members from harassment and arbitrating disputes. Retention: for as long as both accounts exist.
If you report a message: the message concerned, the reason, your explanation, your declaration of good faith, then the decision taken and its facts. Legal basis: legal obligation — the EU Digital Services Act (art. 16 and 17). Retention: for as long as your account exists.
The photos you send in a conversation are stripped of their hidden data — location, device, date taken — before being stored in a private storage space: no public address, a link valid for a few minutes each time they are displayed, for the two people in the conversation and, in the event of a report or a dispute, for moderation. They are deleted with your account, or as soon as moderation removes them.
If you block a member: who, and since when, for as long as the block lasts; unblocking deletes the line. The blocked member does not see this list. Moderation reads it when you are in a dispute with them. Legal basis: our legitimate interest in protecting members from harassment and arbitrating disputes. Retention: for as long as both accounts exist.
If you report a message: the message concerned, the reason, your explanation, your declaration of good faith, then the decision taken and its facts. Legal basis: legal obligation — the EU Digital Services Act (art. 16 and 17). Retention: for as long as your account exists.
✓When ordering a service — photographs, brand, model, and your two consentsThe accompanying certificate and the pre-purchase checkconcern an item sold or bought elsewhere. We record what you declare — brand, model, category, listing price, listing address when you give it — and the photographs you upload, which are used only for this review. Legal basis: performance of the contract.
Your two consents are timestamped, and their exact wording is kept with them. These are not boxes on a form: they are the proof the law requires for a service performed immediately to end the right of withdrawal. We keep them with the file, along with the date the order confirmation was sent. Legal basis: legal obligation, and the defence of our rights as well as yours in the event of a complaint.
Files and their photographs are kept for ten years, the legal retention period for accounting records in Belgium. An issued certificate remains viewable at its address as long as it is not revoked: it bears neither your name, nor your username, nor anything that identifies you — it describes the object.
Your two consents are timestamped, and their exact wording is kept with them. These are not boxes on a form: they are the proof the law requires for a service performed immediately to end the right of withdrawal. We keep them with the file, along with the date the order confirmation was sent. Legal basis: legal obligation, and the defence of our rights as well as yours in the event of a complaint.
Files and their photographs are kept for ten years, the legal retention period for accounting records in Belgium. An issued certificate remains viewable at its address as long as it is not revoked: it bears neither your name, nor your username, nor anything that identifies you — it describes the object.
✓At payout — identity verificationRequested when money has to move, never at sign-up. The check is carried out by our payment provider: we keep neither the photo of the document nor its number — only the fact that the check succeeded, its date and its method. Legal basis: legal obligation to combat fraud.
!When listing and buying — fingerprint of your photos, timings, shortened addressEach image gets a digital fingerprint, so that a photo taken from another seller can be refused.
A purchase attempt keeps the time elapsed since the listing went live and the reason for any refusal — that is what tells a robot from a person. Neither your IP address nor a fingerprint of your device is included.
To limit abusive submissions — reports, sign-in attempts — we keep for a few hours a shortened code calculated from your IP address, from which the address cannot be recovered. Legal basis: our legitimate interest in preventing fraud, which you can contest.
A purchase attempt keeps the time elapsed since the listing went live and the reason for any refusal — that is what tells a robot from a person. Neither your IP address nor a fingerprint of your device is included.
To limit abusive submissions — reports, sign-in attempts — we keep for a few hours a shortened code calculated from your IP address, from which the address cannot be recovered. Legal basis: our legitimate interest in preventing fraud, which you can contest.
✓From 30 sales, or above €2,000 per year — tax numberEuropean directive 2021/514 (DAC7). We are required to report sellers who cross either of these two thresholds — it is an OR, not an AND. Being reported does not mean being taxed: reselling personal belongings remains, in most cases, not taxable. We only ask for this number once the threshold is crossed. Legal basis: legal obligation.
✓When reporting a listing — your email address, even without an accountThe EU Digital Services Act requires that ANYONE can report illegal content without creating an account. We then ask for an address, for one reason only: you must be able to find out what action was taken, including if we decide to do nothing. It is used for that and nothing else — no marketing message is ever sent to it. The report itself is kept: a moderation decision must remain open to challenge. Legal basis: legal obligation (DSA art. 16).
✓In a dispute — what each party writes and photographsYour account of events, your photos, the number of items provided. The arbitrator reads both versions and gives written reasons for the decision. These items stay attached to the order: without them, an arbitration could be neither explained nor challenged. Legal basis: performance of the contract.
✓If you call the reception lineThe call is routed and then handled by Twilio (call routing) and ElevenLabs (voice assistant), in the United States. This data is not in our software: it stays with these two providers. An automated voice assistant answers you; your voice is not recorded. ElevenLabs keeps the written transcript of the call, with your number if it is not withheld, for 30 days, then deletes it. Twilio, for its part, keeps the call log (calling number, date, duration), according to its own retention policy. The message you leave — name, email address, order, request — reaches us by email and stays in the contact inbox, like any message sent to customer service. Legal basis: answering your request (pre-contractual measures or performance of the contract) or, failing that, our legitimate interest in answering people who call us. Transfer to the United States: Twilio: EU–US Data Privacy Framework (decision 2023/1795). ElevenLabs: European Commission standard contractual clauses (decision 2021/914), and the same framework.
✓If you write to us on WhatsAppYour message goes through WhatsApp (WhatsApp Ireland Limited, Meta group), which processes your number and your messages under its own privacy rules. We reply from our business number, which is no longer published on the site; the conversation stays in WhatsApp. Legal basis: answering your request (pre-contractual measures or performance of the contract) or, failing that, our legitimate interest in answering people who write to us. For a sensitive matter, email is better.
·What we don’t doNo advertising tracker without your consent: the only exception is the measurement of our Google ads, offered only to people who arrive through one of them, and active only if you accept it (Google Ireland Limited, Dublin, then learns that a listing was published, nothing more — details and changing your mind on the page cookies). No third-party audience measurement, no data broker, no commercial profiling. Some of our technical providers (hosting, payment) belong to groups based outside the European Union: access from outside the Union remains possible. It is governed, depending on the provider, by the European Commission’s standard contractual clauses (decision 2021/914) or by the EU–US Data Privacy Framework (decision 2023/1795). The ranking of listings does not depend on any personal data about you: it is described in full on the transparency page. The only cookies set are those that make the site work — your session, and the fact that you have already entered. They do not follow anyone from one site to another, which is why this site shows no consent window.
How you heard about us, and who invited you
✓When signing up, if you answer — how you heard about VeriFlipAn optional answer, chosen from a list: LinkedIn, Instagram, a search engine, word of mouth… The link you followed may pre-fill it: its address then carries a source tag, which the page reads and copies into the form. You see it, you can change it or not answer. It is your answer that is recorded on your account, not the link.
Nothing is stored on or read from your device for this: no cookie, no browser storage.
Nothing is stored on or read from your device for this: no cookie, no browser storage.
✓If you arrive through a seller’s link — the account that invited youThe invitation link carries a seller’s username, shown in the “Invited by” field, which you can delete before creating your account. We only keep this link if that account exists and is not a sample account. If you keep it, that seller is told by email — without your name or address — that someone who came through their link has confirmed their account (address confirmed, or sign-in with Google or Apple), and they receive boosts (featured placements, with no monetary value). So that the same address only earns a reward once, we keep a fingerprint of your address (a hash, with no readable data), which survives the deletion of your account. If the seller deletes their account, the link disappears with it.
✓What we do with it — totals, never a profileThese answers are used to find out which channels bring in sellers, and to count the steps of listing: accounts opened, addresses confirmed, listings published, payouts set up, first sales. This count reads data the service already records in order to work, and creates no new data. It is reserved for VeriFlip’s moderation and administration, and shows only numbers: no email address, no username.
Legal basis: our legitimate interest in knowing what works, without tracking you. You can object by writing to contact@veriflip.app: we then delete these two fields. Retention: for as long as your account exists; they are deleted with it.
Legal basis: our legitimate interest in knowing what works, without tracking you. You can object by writing to contact@veriflip.app: we then delete these two fields. Retention: for as long as your account exists; they are deleted with it.
Listing statistics
✓If you sell — totals, never peopleOn your listings’ “Statistics” screen, and only for your own. Totals per day, never a person: not who looked at an item page, nor who saved it to favourites, nor who made an offer or wrote. The trend covers the last 30 days. Favourites, offers and messages are counted from what the site already records in order to work: counting them records nothing more. A favourite since removed no longer counts; your own replies and offers in a thread do not count.
✓When you open an item page — a counter, not a cookieEach view of an item page adds 1 to that listing's counter for that day. That is all that is stored: the listing, the date and a number — no IP address, browser, account, time or source. Nothing is placed on or read from the viewer's device: no cookie. To filter out bots, the server reads the browser name sent with each page at the moment it is displayed, and does not keep it. The same person coming back, or reloading the page, counts each time: with no cookie or identifier, nobody is recognised from one visit to the next.
Not counted: example listings, which have no statistics; bots: search engines, link previews from messaging apps and social networks, automated programs; pages preloaded by a browser that nobody opened; the person who published the listing, when they view it while signed in; the VeriFlip moderation team.
Legal basis: our legitimate interest in telling a seller whether their listings are being seen, without tracking anyone. The counter contains no data about you: there is nothing to give back or delete about you. Retention: for the life of the listing; its counters disappear with it.
Lists — home page, categories, search, brands — keep the same kind of counter of views per listing per day, with the same exclusions: a number, with nothing about you.
Not counted: example listings, which have no statistics; bots: search engines, link previews from messaging apps and social networks, automated programs; pages preloaded by a browser that nobody opened; the person who published the listing, when they view it while signed in; the VeriFlip moderation team.
Legal basis: our legitimate interest in telling a seller whether their listings are being seen, without tracking anyone. The counter contains no data about you: there is nothing to give back or delete about you. Retention: for the life of the listing; its counters disappear with it.
Lists — home page, categories, search, brands — keep the same kind of counter of views per listing per day, with the same exclusions: a number, with nothing about you.
Prospecting professionals
If you run a shop, a consignment store or a workshop, we may have written to you to introduce VeriFlip. Here is where your address comes from, what we do with it, and how to stop everything with one word. The data controller is the one named at the top of this page.
✓Why we write to youTo suggest selling your pieces on VeriFlip, or working with us, when your business is related: reselling designer pieces, consignment, repair workshop, a tool or media outlet devoted to second-hand. We only write to businesses, never to private individuals. As soon as you reply, whatever your answer, no further follow-up is sent.
✓On what basisOur legitimate interest in presenting our service to professionals whose trade is related (GDPR, art. 6(1)(f)). It only applies to a message about your business: we do not write to you about anything else.
✓Whom we write to, and whereFrance: at the address your business publishes, and only if the message concerns your trade.Belgium: only to an impersonal company address (info@, contact@…), never to an address bearing a person’s name.We do not email businesses in any other country.
✓Where your address comes fromWe note down by hand the business address that your company itself publishes, on its website or public listing, recording the page and the day we noted it; every message tells you where we found it. We buy no lists, and we do not collect any address from a marketplace or a social network.
On LinkedIn, a member of our team may also send you a hand-written connection request from their own account: no address is collected there.
On LinkedIn, a member of our team may also send you a hand-written connection request from their own account: no address is collected there.
✓What we recordThe company name, its company number, its town, its activity code and its website; the published address, the page where it appears and the day it was noted; a person’s name only when the published address contains it; the days of our messages and your replies, and the exchanges themselves, in our mailbox. On LinkedIn: the name, job title and company shown on your public profile, and the day of the request.
Nothing else: no link in our messages that identifies you (a link may show which channel it reached you through, never whom it was sent to), no measurement of whether they are opened. Your address is not sold, rented or transferred; it is kept in a separate file, outside the site and its database.
Nothing else: no link in our messages that identifies you (a link may show which channel it reached you through, never whom it was sent to), no measurement of whether they are opened. Your address is not sold, rented or transferred; it is kept in a separate file, outside the site and its database.
✓How long: 3 years from your last contactThe period runs from the last contact that comes from you — a reply, a question — or, if you have never replied, from the day your address was noted. Our own messages never extend it. At the end, your entry is deleted, together with our exchanges in our mailbox.
✓To make it stop: reply “stop”To any of our messages, or by writing to contact@veriflip.app: no reason needed, free of charge. The same day, your address is removed from our file, and our exchanges are deleted from our mailbox. You can also ask us not to write to anyone else in your company.
We only keep a fingerprint of it, calculated from the address, which lets us recognise it but not read it back: this is what stops us writing to you again if your company reappears in a register. It is kept for at least 3 years, and for as long as we write to professionals; it is used for nothing else. Your other rights are exercised as indicated below, at the same address.
We only keep a fingerprint of it, calculated from the address, which lets us recognise it but not read it back: this is what stops us writing to you again if your company reappears in a register. It is kept for at least 3 years, and for as long as we write to professionals; it is used for nothing else. Your other rights are exercised as indicated below, at the same address.
Your rights, and how to exercise them
Six rights, one addressAccess, rectification, erasure, portability, objection, restriction (GDPR art. 15 to 22). Write to contact@veriflip.app: we reply within thirty days.
Deleting an account does not delete orders already placed: an invoice is an accounting record, and the law requires us to keep it for ten years. We would rather tell you than promise a complete deletion we could not deliver.
If our answer does not satisfy youYou can lodge a complaint with the Belgian supervisory authority: Autorité de protection des données, Rue de la Presse 35, 1000 Bruxelles — www.autoriteprotectiondonnees.be. You can also contact the authority in your country of residence.
If a period or a piece of data changes, this page changes the same day.
Legal notice · Terms of sale · How results are ranked · Back to the home page