Demnaro

Privacy Policy

Last updated: July 28, 2026

1. Who we are

Demnaro ("we", "us") is an AI-powered marketplace intelligence tool that helps users evaluate resale opportunities. This policy explains what personal data we process and why.

2. Data we collect

  • Account data: email, name, avatar (from Google if you sign in with Google).
  • Preferences: country, city, currency, language, favorite categories and marketplaces.
  • Product analyses: the listings and photos you submit for analysis, and the AI results.
  • Usage & diagnostics: product analytics (page views, key actions) and application error logs (message, stack, route). Attribution: UTM parameters and referrer at first visit.
  • Purchase data: subscription status, plan, period, and provider transaction identifiers. On iOS, purchases are handled by Apple; we receive a subscription status signal (not your card details) via RevenueCat. On the web, purchases are handled by Stripe.
  • Device push tokens: if you grant push permission in the iOS app, we store an APNs device token bound to your account so we can deliver notifications you enabled.
  • Support requests: messages you send us via the in-app feedback form (message text, optional reply-to email, current route, user agent).

3. How we use it

  • To provide the analysis, watchlist, and inventory features you request.
  • To personalize currency, language, and marketplace defaults.
  • To detect and prevent abuse of our AI endpoints (per-user rate limits and quotas).
  • To deliver in-app and push notifications you have enabled.
  • To grant and verify your Pro subscription entitlement.
  • To debug errors and improve the product.

4. Legal basis (GDPR)

We process your data on the basis of (a) performance of contract — to deliver the service, and (b) legitimate interests — to keep the service secure, prevent abuse, and improve it.

5. Data sharing

We do not sell your personal data. We share it only with the processors we need to run the service:

  • Supabase — database, authentication, and file storage.
  • Google (Gemini via Lovable AI Gateway) — to process listing text and photos you submit and return an analysis. Submitting a listing or screenshot means the text and image are transmitted to Google for AI processing.
  • Third-party marketplaces (e.g. eBay, Blocket, Tradera, Kleinanzeigen, FINN.no, Marktplaats) — we send search terms you configure to these providers to fetch public listings. We do not share your identity with them.
  • Stripe — web subscription payments and billing.
  • Apple / RevenueCat — iOS subscription payments. Apple processes your payment; RevenueCat relays the subscription status to us. Cancelling an Apple subscription must be done in your Apple ID settings.
  • Apple Push Notification service (APNs) — delivery of iOS push notifications if enabled.
  • Resend — transactional email delivery (support replies, password reset).
  • Cloudflare — application hosting and edge runtime.

6. Retention

We keep your analyses and inventory records for as long as your account is active. You can delete individual analyses at any time, or delete your account to permanently erase all your data (Settings → Account & data). Deletion is immediate and irreversible; associated auth records, profile, analyses, saved deals, watchlist entries, alerts, notifications, and push tokens are removed. Deleting your account does not automatically cancel an active Apple subscription — cancel it in your Apple ID settings.

7. Your rights

  • Access & portability: export a JSON copy of your data from Settings.
  • Rectification: edit your profile in Settings.
  • Erasure: delete your account in Settings — this is permanent.
  • Objection / restriction: contact us at the address below.

8. Security

Data is encrypted in transit (TLS). Database access is protected by row-level security so each user can only read their own records. Uploaded images are size- and type-validated.

9. Cookies

We only use cookies and local storage strictly necessary to keep you signed in and to remember your theme and preferences. We do not use third-party advertising cookies.

10. Children

Demnaro is not directed to children under 16 and we do not knowingly collect their data.

11. Changes

We will update this policy when the product changes. The "last updated" date at the top will change.

12. Contact

Questions or GDPR requests: privacy@demnaro.app.