Privacy policy

1. Who is responsible

The controller of your data is the operator of Rehauled, in Belgium. For anything about your data, contact us at privacy@rehauled.com.

2. What data we process

• Account: your email address, your password (stored only in encrypted form, as a hash) and whether you confirmed your email address. If you sign in with Google, Google gives us your email address, your name and a Google identifier.
• Profile: what you fill in yourself, such as your name, city, country, description and profile photo, and when you were last active.
• Listings: photos, title, description, price, brand, size, condition and delivery options. If you set a location for pickup or for searching nearby, that location as well.
• Messages and offers: what you send in conversations, including the photos you add.
• What you do on the site: favourites, collections, sellers you follow, saved searches, notifications, requests and orders, promotions, reviews and your style preferences.
• Views: we count how often a listing is viewed. For visitors without an account we only store a code that changes every day and cannot be traced back to you.
• Technical data: your IP address and browser details are used briefly to deliver and protect the site, for example against too many sign-in attempts. From your connection we also derive your country, to show nearby items first.
• Push notifications: if you turn them on, we store the address your browser provides for them.
• Messages: also when a message was delivered and read, for the ticks in the conversation.
• Reports: who reported what, the reason, and a copy of what was reported. Moderation: warnings, suspensions, blocks, removals and corrections to your balance, with the reason and who decided.
• Invitations: your invite code, who invited you and which rewards you received. Whoever invited you only sees how many people joined through their link and what that earned, not who.

3. Why, and on what basis

• To make your account, listings, messages and the rest of Rehauled work, and to send the emails that go with it, such as confirming your email address or a new password. Basis: our agreement with you.
• To keep Rehauled safe: preventing abuse, fraud and spam, checking listings automatically and handling reports. Basis: our legitimate interest and the legal duties of online platforms.
• To show nearby items first and to improve the site. Basis: our legitimate interest.
• We only use push notifications and Google sign-in if you choose them. Basis: your consent, which you can withdraw at any time.
• To comply with the law, for example for bookkeeping or requests from competent authorities. Basis: legal obligation.

4. Automatic listing check

• New and changed listings are checked by an AI model from Cloudflare (Workers AI). For this we pass on the first photos and the text of the listing. The model judges whether the item may be sold and whether the photos match the description.
• You can change a refused listing. If you disagree, ask for a review by a person at support@rehauled.com.
• Your name, city, ‘About you’, titles and reviews also go through a word list and the same AI check, for inappropriate content.
• We do not use your data to train AI models.

5. Who sees your data

Other members and visitors: your profile (name, city, country, photo, description and reviews) and your listings are public, including to search engines. Only the participants in a conversation can see its messages. We never show your email address to other members.

Discord: new and featured listings (title, photo, price, brand, size and the seller’s name) are also shared in Rehauled’s Discord server. What you post in that server yourself, such as messages and support tickets, is processed by Discord under its own privacy policy.

Service providers who help us, and only for what they need: Cloudflare (hosting, database, photo storage, security and the AI check; the database and photos are stored in Western Europe), Resend (sending emails), OpenStreetMap (only the postcode you search pickup points with), Google (only if you sign in with Google) and your browser’s push service (only if you turn on push notifications).

Authorities, only when the law requires it.

We never sell your data.

6. Data outside the European Union

Some service providers are American companies or operate worldwide. If data ends up outside the European Economic Area, this happens with the safeguards the law requires, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. How long we keep data

Account and profile: for as long as your account exists. The same goes for your invite code and who invited you.

Sign-in sessions: 30 days. A link for a new password is valid for 1 hour, a confirmation link for 3 days. We erase expired links within a week.

Data about sign-in attempts, for security: 24 hours.

Who viewed a listing: 90 days. The total number of views stays with the listing, without any data on who looked.

Notifications in your account: 180 days.

Safety records, such as refused listings: 1 year.

Reports by members and the moderation log: 2 years.

If you delete your account, we immediately erase your account, listings, photos, favourites, searches, notifications and settings. Your profile becomes “Deleted member”. Messages you sent stay visible to the other person in that conversation, because they are part of their conversation too. Completed orders are kept without an address, for bookkeeping.

8. Cookies and storage in your browser

• We only use cookies that are needed for the site to work: a sign-in cookie (30 days), cookies for your language and display, and a cookie if you choose to browse without an account, and a 30-day cookie if you opened an invite link.
• Your browser also stores your preferences, recently viewed items and drafts of listings.
• We use no advertising or tracking cookies and no analytics services from others. That is why we do not ask for cookie consent.

9. Your rights

• You have the right to access your data, have it corrected or erased, restrict its processing, object, and take your data with you.
• You can download your data in Settings → Privacy & your data, and delete your account in Settings → Safety & account. For anything else, email privacy@rehauled.com. We reply within one month.
• If you are not satisfied with how we handle your data, you can complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be), or to the authority in your own country.

10. Security

All connections are encrypted (https). We store passwords and sign-in sessions only as hashes. Sign-in attempts are limited, and access to data is limited to what is needed.

11. Young people

Rehauled is for people aged 16 and over. If we find that someone younger has an account, we delete that account.

12. Changes

If anything changes in how we handle data, we update this privacy policy. We will tell you about important changes in advance, on the site or by email.