Privacy Policy

This Privacy Policy (the "Policy") describes what personal data remesla.com.ua ("Remesla", the "Site") collects and processes when you register, use the Site and make purchases, why, where it is stored, and what rights you have. Personal data is processed in accordance with the Law of Ukraine "On Personal Data Protection" of 1 June 2010, No. 2297-VI.

The data controller is Individual Entrepreneur Anton Dmytrovych Surmachevskyi, registration number (EDRPOU/RNOKPP) 3593800275, registered address: 97 Shevchenka Street, Nizhyn, Nizhyn District, Chernihiv region, 16600, Ukraine. Questions about personal data processing: support@remesla.com.ua.

When you register, you provide an email, name and password — or sign up via Google or Facebook. Your login and password are processed and stored by AWS Cognito, a separate authentication service: Remesla does not see or store your password in its own database.

• In our profile database (PostgreSQL) we store: email, name, phone number and whether it is confirmed, profile photo, selected delivery and payment methods (and the partial-prepayment share, if set), social-media links, account status and role, registration date and last-login date.
• Profile photo, delivery methods, payment methods and social links are optional fields you fill in yourself in "Settings". A phone number is optional for buyers, but a seller needs a confirmed number to publish products.
• A phone number is confirmed by a call: the AlphaSMS service calls it, and you enter the last 4 digits of the number that called you. For this we pass only your phone number to AlphaSMS.
• Your chosen interface language is stored in your profile and in a browser cookie — see "Cookies" below.

You can place an order with or without an account. When you place an order through the cart, you provide the receiver’s first and last name, phone number, email address, and — depending on the delivery method — a city, branch or address, plus the payment method you choose. This data becomes visible to the seller only after the order is confirmed; until then it is marked "Data locked". The order, status and price-negotiation history is kept for both parties to the deal and for the Site’s administration.

We send the order email to the address you enter. Once the order is confirmed, the buyer receives the seller’s phone number and email — in the order details and in an email. If Remesla is the seller of a product, we process the order data as the party to the sale contract.

Photos you upload to products, posts or your profile are stored in S3-compatible object storage (MinIO) and served publicly through the Site’s CDN — the same as any other public image on the Site; these photos have no separate access control, since they are meant to be shown in the catalogue.

Before saving, every photo is automatically re-encoded, and its metadata — including location (GPS) data and the device/camera model (EXIF) — is stripped.

When you sign in, we record your IP address and the sign-in time — for account security and abuse prevention. Your IP address and browser user-agent are also sent to Meta — see "Sharing data with Meta" and "Cookies".

When you fill in the form on the "Contact" page, you send us your name, email, optionally a phone number, a subject and a message. This data is used only to respond to your request.

• registration, authentication and account security;
• showing products and seller profiles;
• confirming sellers’ phone numbers;
• placing and fulfilling orders, including without an account; sharing the seller’s contacts with the buyer once the order is confirmed;
• calculating and collecting the marketplace commission, and maintaining the "Balance";
• content moderation and preventing fraud and rule violations;
• sending transactional emails (email verification, password reset, order emails and status updates, moderation decisions);
• responding to support requests;
• with your consent (see "Cookies") — measuring the performance of Remesla ads and showing you relevant ads across Meta services: Facebook, Instagram, Threads, WhatsApp and others (see "Sharing data with Meta");
• complying with the requirements of Ukrainian law.

We do not sell your data. For advertising and analytics, data is shared with third parties only as follows: data about your actions on the Site with Meta (see "Sharing data with Meta"), data about visits to the Site with Google for analytics, and recordings of how you use the Site’s pages with Microsoft so that we can make the Site easier to use. This happens with your consent; how to limit it — see "Cookies".

To operate the Site we use the following services, which act as processors of personal data on our behalf:

• AWS Cognito (Amazon Web Services) — registration, authentication, password storage.
• AWS SES (Amazon Simple Email Service) — sending transactional emails (not marketing mail).
• S3-compatible object storage (MinIO) — storing photos.
• GlitchTip (self-hosted) — capturing backend technical errors for diagnostics; passwords, tokens and cookies are automatically stripped from these records before they are sent.
• AlphaSMS (INVESTUM LLC, Ukraine, EDRPOU code 36852257) — phone number confirmation by call; receives only the phone number.
• Google Analytics (Google LLC) — analysis of the Site’s traffic (see the "Cookies" section); data is processed outside Ukraine.

Receiver and delivery data for a specific order is shared with the relevant seller once the order is confirmed — this is necessary to fulfil the deal. The seller’s phone number and email become available to the buyer only once the order is confirmed — in the order details and in an email.

Apart from sharing data with Meta (see the next section), we do not share personal data with other third parties, except where directly required by Ukrainian law (for example, at the request of an authorised authority).

We share data about your actions on the Site with Meta Platforms Ireland Limited or Meta Platforms, Inc., depending on where you are located ("Meta"). Meta is not our processor: for this data it acts as an independent controller and processes it under its own Privacy Policy (https://www.facebook.com/privacy/policy/) and the Meta Business Tools Terms.

The legal basis for this sharing is your consent, which you give by continuing to use the Site after the cookie notice. The data Meta receives is listed in the "Cookies" section. Meta uses it to measure the performance of Remesla ads and to show you relevant ads across Meta services: Facebook, Instagram, Threads, WhatsApp and others, and — under its own terms — to improve its advertising systems.

How to limit the Meta pixel — see "Cookies". Data Meta has already received is stored and processed under Meta’s rules; you can manage it — including turning off the use of activity from other websites for ads — in Meta’s Accounts Center (ad preferences and activity off Meta technologies).

Some of the services we use store data on servers outside Ukraine: Amazon Web Services (AWS Cognito, AWS SES) and Meta, Google (Google Analytics) and Microsoft (Microsoft Clarity). These transfers are carried out in accordance with Article 29 of the Law of Ukraine "On Personal Data Protection": to Amazon Web Services because it is necessary to perform our agreement with you (registration, sign-in, sending emails), and to Meta, Google and Microsoft on the basis of your consent.

The Site uses technically necessary cookies for account and language settings, and the Meta (Facebook/Instagram) pixel, to measure ad performance and show you relevant ads across Meta services: Facebook, Instagram, Threads, WhatsApp and others, Google Analytics, to analyse the Site’s traffic, and Microsoft Clarity, to understand how visitors use the Site’s pages and make them easier to use. No other web-analytics or advertising tools are installed on the Site. The Meta pixel, Google Analytics and Microsoft Clarity work from the first time you open the Site: on your first visit a cookie notice with a link to this Policy is shown at the bottom of the screen, and by continuing to use the Site you agree to their use. How to limit them — see the end of this section.

The Meta pixel never loads on a page that carries account or personal data (for example, "Settings", the seller dashboard, sign-in and registration, or e-mail verification). It records page views; product views, cart additions and orders — including the product id, quantity and value involved; and the text of a search query if you used the Site's search. We also send the same events straight to Meta's server (Conversions API), which improves ad measurement accuracy. In doing so, Meta receives your IP address and browser user-agent (standard technical data of any request to the Site) and the "_fbp"/"_fbc" identifiers described below. Every event we send to Meta's server also carries your country ("ua") in hashed form (SHA-256). If you are signed in, product views, cart additions, the start of checkout and orders additionally carry your e-mail address and phone number (only if verified), your account identifier and the city from your account — all hashed (SHA-256); an order placed without an account carries the phone number and e-mail address from the order form, hashed. Hashing makes this data harder to match against other sources, but does not make it fully anonymous. Each order sent to Meta's server also carries its own technical signature so it cannot be substituted for someone else's order.

Google Analytics (Google LLC) does not run in the admin panel or on the email-confirmation, password-reset and email-change pages. It receives: a pseudonymous browser identifier (the "_ga" cookie); the addresses and titles of the pages you visit (data you type into forms — name, phone, email, address — is not sent; the exception is the search queries you type on the Site, which are sent as typed); technical data about your device and browser; approximate location, which Google derives from your IP address (Google Analytics does not store the IP address itself); data about the products you view, add to your cart and buy (name, price, category, identifier and public name of the seller); order totals and the checkout identifier; the names of the chosen delivery and payment methods only; as well as automatic events: page scrolling, clicks on external links (the link address) and file downloads. If you are signed in, Google also receives your internal account identifier on the Site (not your email, phone or name), so that it can link your activity across devices. Names, phone numbers, email addresses, delivery addresses, comments and other text you type into forms (except search queries) are not sent to Google Analytics. Google processes this data outside Ukraine. We keep it in Google Analytics for 14 months and use it only to analyse how the Site works. The Google Analytics property is linked to our Google Ads and Google Merchant Center accounts, but the Site marks all data as not usable for advertising (consent for advertising storage and ad personalisation is sent as "denied"), and Google Signals is turned off. Google Analytics cookies last up to 180 days. Data sent earlier remains in Google Analytics until the end of its retention period; on your request we will delete it by your account identifier.

Microsoft Clarity (a Microsoft Corporation service) records how visitors use the Site’s pages and builds click and scroll heatmaps from these recordings. Clarity never runs for the Site’s administrators and moderators. Clarity runs only on public pages (home, catalogue, search, product pages, sellers’ public profiles — including your own, help, information pages, error pages), in the cart and at checkout (including checkout without an account and "Buy in 1 click"), and while you create a listing or import listings. Clarity does not run in the admin panel, on the sign-in and registration pages, on the email-confirmation, password-reset and email-change pages, in settings and on your personal profile page, in the seller dashboard ("My listings", "Posts", "My sales"), on the order, "My purchases", "Balance" and promotion pages, while you edit listings or create or edit posts, or on the contact form. Clarity receives: the layout of the pages and their public content (product names, prices and photos, category names, sellers’ public names, reviews, the Site’s texts and page titles); your clicks and taps, scrolling, mouse movements and window size; the full addresses of the pages you visit — including the search text and the filters you chose — and the address of the site you came from; technical data about your device and browser; errors in the pages’ scripts; approximate location, which Microsoft derives from your IP address; pseudonymous browser and session identifiers (the "_clck" and "_clsk" cookies and the "_cltk" entry in the browser's session storage); and labels added by the Site: the page type (for example, "checkout"), whether you are signed in ("yes"/"no") and the page language. Your name, email and phone number, your profile photo in the site header and account menu, the photos you upload while creating a listing or importing listings (before publication), sellers’ contact details, recipient and delivery details, order numbers, everything you type into forms (including the search box), import feed addresses, and the titles and descriptions of import drafts are masked in your browser — replaced with placeholders before anything is sent — so Microsoft does not receive them; the exception is the search text, which Microsoft receives as part of the address of the results page. The Site does not pass your account ID to Clarity as a user identifier (the "identify" feature is not used), and the page labels contain no personal data; your own public profile and listing pages are recorded like any public page. The Site always tells Clarity that advertising storage is "denied"; the Clarity project is not linked to Google Analytics, Microsoft Advertising or any other service. For Microsoft Clarity data, Microsoft acts as an independent controller, not as our processor: it processes the data under the Microsoft Clarity Terms of Use and the Microsoft Privacy Statement, may use it for its own purposes described there, and processes it outside Ukraine. Session recordings are kept in Clarity for 30 days, and heatmaps and recordings we have labelled or marked as favourites for analysis for up to 13 months. Recordings are not linked to your account, so we cannot find and delete the recordings of your particular visits on request (Microsoft only allows deleting the data of the whole project): they are deleted automatically when the retention period ends. Microsoft may also set its own cookies on its domains (for example, "CLID", "MUID"); the Site cannot delete them — you can do so in your browser settings. The "_clck" cookie lasts up to 1 year and "_clsk" up to 1 day. Data sent earlier remains in Clarity until the end of its retention period.

• "board_rt" — an encrypted session refresh token (httpOnly, inaccessible to JavaScript); keeps you signed in; valid up to 30 days.
• "board_authed" — a technical "you are signed in" flag with no credentials (httpOnly); lets the page immediately show the correct sign-in state; valid up to 30 days.
• "board_pkce" — a short-lived technical cookie used only during Google or Facebook sign-in; valid up to 10 minutes and removed right after sign-in completes.
• "NEXT_LOCALE" — remembers your chosen interface language (Ukrainian/English); valid up to 1 year.
• "board_consent" — remembers that you closed the cookie notice, so it is not shown again; our own technical cookie, not an advertising one; valid up to 180 days.
• "_fbp" — set by the Meta pixel to recognise your browser within Meta's advertising system; valid up to 90 days.
• "_fbc" — set by the Meta pixel or by the Site itself to link a click on a Meta ad to what you do afterwards on the Site; valid up to 90 days.
• "_ga" — set by Google Analytics to tell visitors’ browsers apart; lasts up to 180 days.
• "_ga_<ID>" — set by Google Analytics to keep the state of a visit; lasts up to 180 days.
• "_clck" — set by Microsoft Clarity to recognise your browser between visits (a pseudonymous identifier); lasts up to 1 year.
• "_clsk" — set by Microsoft Clarity to join the page views of one visit into one recording; lasts up to 1 day.

The first four cookies above are strictly necessary for the Site to work (staying signed in, language preference) — no separate consent is needed for them, the same as for any technical cookie the Site cannot function correctly without. "board_consent", "_fbp", "_fbc", "_ga", "_ga_<ID>", "_clck" and "_clsk" are not needed for the Site to work: they are set from your first visit on the basis of the consent you give by continuing to use the Site after the cookie notice. There is no separate consent switch on the Site. If you do not agree to the use of the Meta pixel, Google Analytics or Microsoft Clarity, you can stop using the Site or limit them in your browser: turn on tracking protection or a tracker blocker — these services then do not load in your browser; for Google Analytics there is also the official Google Analytics Opt-out browser add-on; you can delete their cookies in your browser settings. Events that the Site itself sends to Meta's server (Conversions API) cannot be turned off in the browser. You can manage how Meta uses data for ads in Meta's Accounts Center. Deleting cookies in your browser settings may sign you out.

Profile data is kept for as long as your account is active. Order data, including orders placed without an account, is kept for as long as needed to fulfil the order, for accounting and to resolve possible disputes. After account deletion, the record is marked deleted and hidden from public view; we may keep some anonymised or aggregated data (e.g. order statistics) for longer, for accounting, dispute resolution or legal compliance. Technical logs are kept for a limited period and used only for diagnostics and security. Cookie lifetimes are listed in the "Cookies" section; data shared with Meta is retained by Meta under its Privacy Policy.

You can delete your account in "Settings" → "Account management". Deletion is a soft delete: the account and its associated content are hidden from public view. After deletion, re-registering with the same email or the same Google or Facebook account is permanently blocked — a deliberate technical measure against abuse (for example, re-registering to evade a ban).

If you need your personal data fully removed from backups, contact support@remesla.com.ua.

Under the Law of Ukraine "On Personal Data Protection", you have the right to:

• know the sources of collection and location of your personal data and the purpose of its processing;
• obtain access to your personal data;
• request correction of inaccurate or outdated data (available yourself, in "Settings", for most fields);
• withdraw consent to processing and request deletion (via account deletion or a support request);
• limit the Meta pixel, Google Analytics and Microsoft Clarity using your browser (see "Cookies");
• lodge a complaint about the processing of your personal data with the Ukrainian Parliament Commissioner for Human Rights.

To exercise any of these rights, write to support@remesla.com.ua or use the "Contact" page.

We apply technical and organisational safeguards: your password is stored and verified solely by AWS Cognito, not by the Site; the connection to the Site is encrypted (HTTPS); the session token is only ever carried in a protected httpOnly cookie; technical errors that reach our monitoring system (GlitchTip) are automatically stripped of passwords, tokens and cookies before being sent. Despite these measures, no method of transmitting data over the internet is completely secure.

We may update this Policy — in particular in connection with changes to the Site’s functionality or to the law. The current version is always available on this page, with the last-updated date shown above.

Questions about this Policy: support@remesla.com.ua or the "Contact" page. Data controller: Individual Entrepreneur Anton Dmytrovych Surmachevskyi, registration number (EDRPOU/RNOKPP) 3593800275, registered address: 97 Shevchenka Street, Nizhyn, Nizhyn District, Chernihiv region, 16600, Ukraine.