Privacy policy

Resold is a UK app that helps people who sell on Vinted, Depop and eBay see their real profit and keep records ready for HMRC. In this policy, “Resold”, “we” and “us” mean the team that runs the Resold app and this website.

Resold is the controller of your personal data under UK GDPR and the Data Protection Act 2018. If you have any question about your data, email rayanbilal183+resold@gmail.com. A real person reads every message.

Resold is not affiliated with Vinted, Depop, eBay or HMRC. We never share your data with those companies.

We only collect what we need to run Resold for you.

• Your account. Your email address, your name if you give it, how you sign in (Apple, Google or an email link) and the user ID our sign in provider creates.
• Your books. The items, stock, sales, prices, fees, postage, expenses, mileage and notes you add, any photos you attach, your settings and the answers you give during onboarding (for example which platforms you sell on).
• Receipt images. Photos of receipts you scan, and the details we read from them such as the shop, date and amounts.
• Forwarded emails. If you forward sold emails to your private Resold address, we receive the email text. We keep that text for 30 days and then delete it. The sale details we pulled out (platform, item title, price, date and order reference) stay in your books.
• Subscription details. Your plan, status, trial and renewal dates, and payment references. If you subscribe on the website we receive these from Stripe, and if you subscribe in the iPhone or iPad app we receive them from Apple and RevenueCat. Stripe and Apple take the payment, so your card details never reach our servers and we never see or store them.
• Device details. A push notification token, your phone platform and app version, so we can send the reminders you turn on.
• Usage counts. Simple events such as “sale recorded” or “receipt scanned”. These never include item titles, prices, names, receipt contents or email text. On this website, analytics only run if you say yes to analytics cookies.
• Creator codes. If you use a creator’s code or link, in the app or at checkout on this website, we record which code you used so the creator can be paid a commission from your payments. The creator only sees totals, never who you are.
• Support messages. Anything you send us when you ask for help.

UK GDPR asks us to name a lawful basis for each use. Here they are in plain English.

Running ResoldContract

Storing your books, working out profit and tax estimates, building your Tax Pack, reading receipts and forwarded emails, and syncing your devices.

BillingContract and legal obligation

Taking payment on the website through Stripe, receiving your subscription status from Stripe, Apple and RevenueCat, turning Pro on and off, working out creator commission, and keeping the records the law asks us to keep.

Keeping it safeLegitimate interests

Preventing fraud and abuse, protecting accounts, and finding and fixing bugs through error reports.

Improving the appLegitimate interests

Counting which features get used, without names, prices, titles or email text.

Website analyticsConsent

Anonymous page counts on this website, only after you accept analytics cookies.

Ad attributionConsent

Telling whether a visit to this website came from one of our own ads, only after you accept analytics cookies. We do not show ads to you on this website or in the app.

RemindersContract

Weekly summaries, deadline reminders and inbox alerts you choose to receive. You can turn each one off in the app or in your phone settings.

We do not sell your data, we do not show ads, and we do not make automated decisions about you that have legal or similarly significant effects.

When you scan a receipt or forward a sold email, we send the image or text to OpenAI through their API. The model only identifies details such as the shop, date, items and amounts. All totals, profit and tax year maths are then done by our own code, and you always review the result before it is saved.

OpenAI does not use data sent through its API to train its models. OpenAI may keep API data for up to 30 days to monitor for abuse, and then deletes it.

We use a small number of trusted providers (processors) who handle data only on our instructions and under a written contract.

FirebaseGoogle

Sign in and account security.

SupabaseEU region

Database and private file storage for your records and receipt images.

OpenAI

Reading receipts and forwarded emails. API data is not used to train models.

RevenueCat

Tracking App Store subscription status. We receive only your subscription status and transaction references, never payment details.

Apple

Payments made in the iPhone and iPad app, through the App Store, and Sign in with Apple. Apple processes your payment data as an independent controller under its own privacy policy.

StripeStripe Payments Europe and Stripe, Inc.

Card payments, free trials and the billing portal on this website. We share your email address, your Resold workspace ID and the plan you choose, and receive back your payment and subscription status. You enter your card details directly with Stripe, so they never touch our servers. Stripe also acts as an independent controller for some payment data, for example to prevent fraud and meet its legal duties.

Vercel

Hosting for this website and the Resold API.

Cloudflare

Receiving the emails you forward to your private Resold address.

PostHogEU cloud

Product analytics without names or prices.

Whop

Ad measurement: tells us whether a visit to this website came from one of our ads, and whether that visit led to a sign up, a free trial or a payment. Only runs after you accept analytics cookies. We send an anonymous visitor id, the page you arrived on, your IP address and browser type, and the amount and time of a payment. We never send your name, email address or anything from your books. If you do not accept analytics cookies, Whop only receives anonymous totals that are not linked to you.

Sentry

Error reports so we can find and fix crashes.

We may also share data with professional advisers, or with authorities where the law requires it. We never send your records to HMRC. What you file is always your decision.

Your records are stored in the EU. Some providers above are based in, or process data in, the United States or other countries outside the UK.

When data leaves the UK we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where a provider is certified), or on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with extra safeguards where needed. Ask us at rayanbilal183+resold@gmail.com if you would like more detail.

Your account and books

For as long as your account is open. Deleted when you delete your account.

Forwarded email text

30 days, then deleted automatically. Extracted sale details stay in your books.

Receipt images

Until you delete them, or automatically after the number of years you choose in the app settings.

Billing records

As long as the law requires, typically 6 years after the end of the tax year they relate to.

Support emails

Up to 2 years after your last message, unless we need them for a dispute.

Error reports

Up to 90 days.

You can delete your account at any time in the app from SettingsDelete account. This permanently removes your items, sales, stock, expenses, receipt images, forwarded email text, push tokens and your sign in. It cannot be undone.

We keep a small record that the account was deleted, so an old sign in cannot bring it back, plus any billing records the law requires. Encrypted backups roll off within 30 days.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectification, so anything wrong gets corrected. Most of it you can edit in the app.
• Erasure of your data, which you can do yourself by deleting your account.
• Restriction of how we use your data while a concern is looked into.
• Portability, a copy of your data in a common, machine readable format.
• Objection to uses based on our legitimate interests.
• Withdraw consent at any time, for example to website analytics, without affecting what happened before.

To use any of these rights, email rayanbilal183+resold@gmail.com from the address on your account. We will reply within one month, and it is free in almost all cases. We may ask you to confirm it is really you.

This website uses as little browser storage as possible. Strictly necessary items are always on because the site needs them. Analytics are off until you say yes.

resold_consentStrictly necessary, 6 months

Remembers your cookie choice so we do not ask on every page.

resold_creatorStrictly necessary, 30 days

Remembers the creator code from a link you opened, so the right creator is credited and any discount applies when you subscribe.

Sign inStrictly necessary

If you sign in on this website to create or manage your account, Firebase keeps your sign in state in your browser storage.

Stripe checkoutStrictly necessary

Stripe sets its own cookies on its checkout and billing pages to process payment and prevent fraud.

PostHogOptional analytics, up to 1 year

A cookie and local storage entry starting with ph_ that counts visits anonymously. Only set after you accept analytics.

WhopOptional ad attribution

A cookie and local storage entry named _wuid, plus the address of the first page you opened, kept so a later sign up or payment can be linked to the ad you came from. Only set after you accept analytics.

You can change your mind at any time with Cookie settings in the footer of every page, or by clearing cookies in your browser. The Resold app does not use cookies.

Data is encrypted in transit and at rest. Receipt images and exports sit in private storage and are only shared through signed links that expire. Access inside Resold is limited to what is needed to run and support the service, and every admin action is logged.

Resold is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has signed up, email rayanbilal183+resold@gmail.com and we will delete the account.

If you are unhappy with how we have handled your data, please email rayanbilal183+resold@gmail.com first so we can put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk or by calling 0303 123 1113.

If we change this policy, we will update the date at the top of this page. If the change is important, we will also tell you in the app or by email before it takes effect.