Privacy Policy

1. Data controller

The JustSell platform is operated by Cubus Arts S.R.L. (cubus.ro), acting as data controller within the meaning of EU Regulation 2016/679 (GDPR). Contact us at: suport@justsell.ro.

2. What data we collect and why

Account data

When you create an account we collect: your email address, name and profile photo (if you sign in via Google or Facebook). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

User-generated content

Photos and product descriptions you upload are stored to provide the automated listing creation service. Photos are transmitted to the Anthropic Claude Vision API for AI analysis (see section 5). Legal basis: performance of a contract.

Usage data

We collect technical data (IP address, browser type, pages visited) for security and diagnostic purposes. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Preferences and settings

We store your language preference and other account settings. Legal basis: performance of a contract.

3. How long we keep your data

• Account and active listings: for as long as the account is active
• Deleted listings: 30 days, then permanently removed
• Technical logs: up to 90 days
• Billing data (when the service becomes paid): 5 years under Romanian tax law

4. Who we share data with

Hetzner Cloud (hosting and storage)

Servers and object storage (images) are hosted by Hetzner Online GmbH, based in Germany, in compliance with GDPR. Data remains within the European Union.

Anthropic (AI analysis)

Product photos are transmitted to Anthropic, PBC (USA) via the Claude Vision API to generate automated descriptions. Anthropic processes data as a data processor. The transfer is made under Standard Contractual Clauses (SCCs) approved by the European Commission. Anthropic does not use your data for model training. Anthropic privacy policy →

Google / Facebook (authentication)

If you use OAuth sign-in, profile data (email, name, avatar) is provided by those platforms according to their own policies. We do not store OAuth passwords.

5. Your rights (GDPR)

Under GDPR you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit processing of your data
• Portability — receive your data in a structured format (JSON/CSV)
• Objection — object to processing based on legitimate interests
• Withdrawal of consent — at any time, without retroactive effect

To exercise your rights, email suport@justsell.ro. We will respond within 30 days.

6. Supervisory authority

If you believe your rights have not been respected, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Website: www.dataprotection.ro
• Email: anspdcp@dataprotection.ro
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania

7. Security

All communications are encrypted via HTTPS/TLS. Passwords are hashed with bcrypt. Data access is restricted through role-based access control (RBAC). We conduct periodic security audits.

8. Changes to this policy

We reserve the right to update this policy. Significant changes will be communicated by email at least 14 days before they take effect. The date of last update is shown at the top of this page.