Last updated: September 15, 2026
The data controller is the developer of VintPro. Contact: supporto@vintpro.it.
VintPro's architecture is privacy-first: the following data is never transmitted to our servers and remains under your exclusive control:
This data is stored locally in your browser and, if you enable sync, in your personal Supabase project, whose credentials only you hold. For that data you are the sole controller; Supabase Inc. acts as a hosting provider chosen by you (Supabase privacy policy).
| Data | Purpose | Retention |
|---|---|---|
| Email address | Identify the license, deliver the license key | Subscription duration + 12 months |
| License key | Subscription validity checks | Same as above |
| Device ID (random UUID) and OS name | Enforce the 2-device limit | Same as above |
| Last access timestamp | Device slot management | Same as above |
Legal basis: performance of a contract (Art. 6.1.b GDPR). Data resides on Cloudflare Workers/D1 (EU region). No profiling, no sharing with third parties.
Payments are handled entirely by Stripe. We never see or store your card details (Stripe privacy policy).
License key emails are sent via Resend (privacy policy). No newsletters or marketing emails without consent.
The VintPro extension uses no cookies, analytics or third-party trackers. This website uses no profiling cookies.
Under Articles 15-22 GDPR you may request access, rectification, erasure, restriction, portability and object to processing by writing to supporto@vintpro.it. You also have the right to lodge a complaint with your supervisory authority. For data in your Supabase you don't need to ask us anything: you have full direct control.
VintPro+ is a different extension from VintPro, with its own licenses on the same server. Sales, customers, stock and conversations stay on your computer: they never reach the license server.
| Data | Purpose | Retention |
|---|---|---|
| Email address and license key | Deliver and resend the key, check that the license is valid | As long as the license exists |
| Stripe identifiers of subscription invoice payments (payment, charge, subscription, invoice), tied to the license key — never card details | Recognise a bank dispute (chargeback) and close the licence | 540 days from the payment (the longest window in which a payment can be disputed) |
| Email address and license key of failed deliveries (the email with the key did not go out) | Deliver them by hand | 90 days |
| Linked Vinted account: number and username | Tie the license to a single account | As long as the license exists |
| Number of the Vinted account that had a trial or a license | Not grant a second trial to the same account | As long as VintPro+ exists |
| Access log (trial, linking, checks, engine turn): Vinted account with number and username, country and network the access comes from, first and last access, number of accesses | Enforce the license and block anyone who shares it | 12 months from the last access |
| Rejected attempts: Vinted account with number and username, country and network of whoever tries to use the key with another account or to keep a second engine on | Block abuse | 90 days |
| Brakes on trial and key-recovery requests: encrypted fingerprint of the email address and of the IP address they come from (neither address is ever kept in readable form) | Count the attempts and stop email floods | 2 days |
| Brakes on rejected-attempt writes and notices: the license key, the Vinted account number and the network, in readable form | Not rewrite the same attempt more than once every 10 minutes and not send the same notice more than once a day | 2 days |
In the access log and in the rejected attempts we do not keep your IP address: country and network are provided by Cloudflare at the time of the request. Only to stop email floods, trial and key-recovery requests count the attempts per mailbox and per IP address: of both an encrypted fingerprint is kept — never the email or the address in readable form — deleted after 2 days. The Vinted account number and username are reported by the extension. A license keeps one engine on at a time, on unlimited devices: the server remembers which running engine holds the turn — the installation that took it and a random token that changes at every renewal, to recognise a copy of the same folder — and deletes it within a day of its expiry. The same brakes also count rejected-attempt writes and notices: there the license key, the Vinted account number and the network stay readable — they are the same data the rejected-attempts log keeps for longer — and are deleted after 2 days. When a key looks shared, a notice with this data reaches support by email: if two installations contend for the engine, the notice shows both sides, because which one is the original the server does not know.
Legal basis: performance of the license contract (Art. 6.1.b GDPR) and, for the access log and rejected attempts, the legitimate interest in preventing a license from being shared (Art. 6.1.f GDPR). No profiling, no sharing with third parties. To find out what is recorded or to exercise your rights: supporto@vintpro.it.
Any changes will be published on this page with an updated date.
VintPro is not affiliated with, sponsored or endorsed by Vinted. Vinted is a trademark of Vinted SE.
