Privacy Policy

This Privacy Policy (the "Policy") describes what personal data remesla.com.ua ("Remesla", the "Site") collects and processes when you register, use the Site and make purchases, why, where it is stored, and what rights you have. Personal data is processed in accordance with the Law of Ukraine "On Personal Data Protection" of 1 June 2010, No. 2297-VI.

The data controller is [LEGAL ENTITY / SOLE-PROPRIETOR NAME — FILL IN], registration number (EDRPOU/RNOKPP) [EDRPOU/RNOKPP REGISTRATION NUMBER — FILL IN], registered address: [REGISTERED LEGAL ADDRESS — FILL IN]. Questions about personal data processing: support@remesla.com.ua.

When you register, you provide an email, name and password — or sign up via Google. Your login and password are processed and stored by AWS Cognito, a separate authentication service: Remesla does not see or store your password in its own database.

• In our profile database (PostgreSQL) we store: email, name, optionally phone and profile photo, selected delivery methods, social-media links, account status and role, registration date and last-login date.
• Phone, profile photo, delivery methods and social links are optional fields you fill in yourself in "Settings".
• Your chosen interface language is stored in your profile and in a browser cookie — see "Cookies" below.

When you place an order through the cart, you provide the receiver’s first and last name, phone number, and — depending on the delivery method — a city, branch or address. This data becomes visible to the seller only after the order is confirmed; until then it is marked "Data locked". The order, status and price-negotiation history is kept for both parties to the deal and for the Site’s administration.

Photos you upload to listings, posts or your profile are stored in S3-compatible object storage (MinIO) and served publicly through the Site’s CDN — the same as any other public image on the Site; these photos have no separate access control, since they are meant to be shown in the catalogue.

Before saving, every photo is automatically re-encoded, and its metadata — including location (GPS) data and the device/camera model (EXIF) — is stripped.

When you sign in, we record your IP address and the sign-in time — for account security and abuse prevention.

When a buyer taps "Show contacts", we record the fact of the reveal anonymously and in aggregate: a per-listing reveal counter is incremented, and your IP address is used only as a temporary de-duplication key (up to 24 hours) so the same visitor cannot inflate the counter repeatedly. That IP address is not stored permanently and is not linked to your account or to a specific reveal.

When you fill in the form on the "Contact" page, you send us your name, email, optionally a phone number, a subject and a message. This data is used only to respond to your request.

• registration, authentication and account security;
• showing listings, seller profiles and contact details to buyers who requested them (contact reveal);
• placing and fulfilling orders, and communication between buyer and seller about delivery;
• calculating and collecting the marketplace commission, and maintaining the "Balance";
• content moderation and preventing fraud and rule violations;
• sending transactional emails (email verification, password reset, order status, moderation decisions);
• responding to support requests;
• complying with the requirements of Ukrainian law.

We do not use your data for third-party targeted advertising and do not sell it.

To operate the Site we use the following services, which act as processors of personal data on our behalf:

• AWS Cognito (Amazon Web Services) — registration, authentication, password storage.
• AWS SES (Amazon Simple Email Service) — sending transactional emails (not marketing mail).
• S3-compatible object storage (MinIO) — storing photos.
• GlitchTip (self-hosted) — capturing backend technical errors for diagnostics; passwords, tokens and cookies are automatically stripped from these records before they are sent.

Receiver and delivery data for a specific order is shared with the relevant seller once the order is confirmed — this is necessary to fulfil the deal. A seller’s contact details (phone, email, social links) are shown to a buyer after they tap "Show contacts".

We do not share personal data with other third parties, except where directly required by Ukrainian law (for example, at the request of an authorised authority).

The Site uses only technically necessary cookies — no third-party advertising or analytics trackers. The Site does NOT run Google Analytics, the Facebook pixel, or any other web-analytics or advertising tool.

• "board_rt" — an encrypted session refresh token (httpOnly, inaccessible to JavaScript); keeps you signed in; valid up to 30 days.
• "board_authed" — a technical "you are signed in" flag with no credentials (httpOnly); lets the page immediately show the correct sign-in state; valid up to 30 days.
• "board_pkce" — a short-lived technical cookie used only during Google sign-in; valid up to 10 minutes and removed right after sign-in completes.
• "NEXT_LOCALE" — remembers your chosen interface language (Ukrainian/English); valid up to 1 year.

All of the cookies above are strictly necessary for the Site to work (staying signed in, language preference), so no separate consent banner is shown for them — the same as for any technical cookie the Site cannot function correctly without. You can remove cookies in your browser settings, but this may sign you out.

Profile data is kept for as long as your account is active. After account deletion, the record is marked deleted and hidden from public view; we may keep some anonymised or aggregated data (e.g. order statistics) for longer, for accounting, dispute resolution or legal compliance. Technical logs are kept for a limited period and used only for diagnostics and security.

You can delete your account in "Settings" → "Account management". Deletion is a soft delete: the account and its associated content are hidden from public view. After deletion, re-registering with the same email or the same Google account is permanently blocked — a deliberate technical measure against abuse (for example, re-registering to evade a ban).

If you need your personal data fully removed from backups, contact support@remesla.com.ua.

Under the Law of Ukraine "On Personal Data Protection", you have the right to:

• know the sources of collection and location of your personal data and the purpose of its processing;
• obtain access to your personal data;
• request correction of inaccurate or outdated data (available yourself, in "Settings", for most fields);
• withdraw consent to processing and request deletion (via account deletion or a support request);
• lodge a complaint about the processing of your personal data with the Ukrainian Parliament Commissioner for Human Rights.

To exercise any of these rights, write to support@remesla.com.ua or use the "Contact" page.

We apply technical and organisational safeguards: your password is stored and verified solely by AWS Cognito, not by the Site; the connection to the Site is encrypted (HTTPS); the session token is only ever carried in a protected httpOnly cookie; technical errors that reach our monitoring system (GlitchTip) are automatically stripped of passwords, tokens and cookies before being sent. Despite these measures, no method of transmitting data over the internet is completely secure.

We may update this Policy — in particular in connection with changes to the Site’s functionality or to the law. The current version is always available on this page, with the last-updated date shown above.

Questions about this Policy: support@remesla.com.ua or the "Contact" page. Data controller: [LEGAL ENTITY / SOLE-PROPRIETOR NAME — FILL IN], registration number (EDRPOU/RNOKPP) [EDRPOU/RNOKPP REGISTRATION NUMBER — FILL IN], registered address: [REGISTERED LEGAL ADDRESS — FILL IN].