This policy explains what personal data we process, why, for how long and what rights you have, under the General Data Protection Regulation (GDPR) and Portuguese law.
1. Data controller
The controller is SideHustle. For any question about personal data, write to geral@sidehustle-club.com.
2. What data we process
Account and profile: email, name, country, language, phone (if you provide it), password (stored encrypted), photo, shop name and description.
Subscription and billing: plan, status, charge history, billing details (name, address, tax number, if you provide them). Card details are handled directly by Stripe; we do not see or store them.
Content you upload: items, photos, prices, sales, expenses, sheets and documents.
Marketplace (SideShop): listings, favourites, offers, messages between users, orders, chosen pick-up points, reviews, wallet and withdrawals (including the IBAN you provide to get paid).
Technical and security data: IP address, approximate country, device and browser type, access dates and times, actions in the app, credit usage and error logs.
Communications: support requests and conversations with us.
Affiliate programme: referral code and channel, commissions and payout details.
Chrome extension: only what the extension reads from Vinted to show you (sales, unread messages, listings) and the connection token. See the extension policy.
We do not process special categories of data (health, religion, etc.) nor ask you to provide them.
3. What we use data for and on what basis
Providing the service and performing the contract (Art. 6(1)(b) GDPR): creating and managing the account, running features, processing subscriptions and purchases, managing the wallet, sending service notices.
Complying with legal obligations (point c): invoicing, accounting and tax, responding to authorities, anti-money-laundering where applicable.
Legitimate interests (point f): platform security, preventing and detecting fraud and abuse, defending rights in proceedings and in payment disputes (chargebacks), improving the service, customer support, aggregated statistics.
Consent (point a): push notifications, marketing communications, non-essential cookies and other cases where we ask. You can withdraw it at any time without affecting earlier processing.
4. Defence in disputed payments and fraud prevention
To prove that the service was requested and provided, we keep records of acceptance of the Terms and of the immediate start of the service (date, time, version), of account access and use (IP addresses, actions, credits consumed) and of communications. We may share them with Stripe, banks and card networks to answer disputes. The basis is our legitimate interest in defending ourselves and preventing fraud, and performance of the contract.
5. Artificial intelligence
When you use features assisted by artificial intelligence, we send the content you submit (for example photos of items and text) to artificial-intelligence providers to generate the result. Those providers act as processors, for that purpose and on our instructions. We do not take automated decisions that produce legal effects on you.
6. Who we share data with
We use processors that handle data on our behalf, under data-processing agreements:
hosting and database, file storage and authentication (Supabase);
application hosting and delivery network (Vercel);
payments and subscriptions (Stripe);
artificial intelligence (language and image model providers);
sending emails and notifications;
carrier and pick-up points (DHL), when you choose delivery to a pick-up point.
On SideShop, we share with the other party to a transaction the data needed (for example shop name and pick-up point). We may also disclose data to authorities where the law requires, and to third parties in a merger or sale of the business, with the same level of protection. We do not sell your data or give it to advertising networks.
7. Transfers outside the European Economic Area
Some processors are, or process data, outside the EEA (for example in the United States). In those cases we rely on GDPR mechanisms such as adequacy decisions (including the EU-US Data Privacy Framework, where applicable) or the European Commission's standard contractual clauses, and additional measures where needed.
8. How long we keep data
Account and content: while the account exists; if you delete the account we delete associated data, except what we must keep by law or to defend rights.
Billing and tax documents: the period required by tax and accounting law (generally up to 10 years).
Security, access and consent-evidence logs: up to 24 months, or longer while a dispute or chargeback is open and until applicable limitation periods end.
Support communications: up to 3 years.
Marketing data: until you withdraw consent.
9. Your rights
You can request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent. Write to geral@sidehustle-club.com; we reply within one month and may ask for proof of identity.
Some requests may be limited where we must keep data by legal obligation or to defend rights. You may lodge a complaint with the Portuguese data protection authority (CNPD, cnpd.pt) or the authority in your country.
10. Security
We use appropriate technical and organisational measures: encrypted connections, encrypted passwords, per-account access control and logs. No system is completely secure; in the event of a data breach posing a risk to you, we notify you and the authority, as the law requires.
11. Minors
The service is not intended for people under 18 and we do not knowingly process minors' data. If we learn of it, we delete the account and data.
12. Cookies and similar technologies
See the Cookie Policy.
13. Changes to this policy
We may update this policy. The date of the last update is shown at the top and we give notice of material changes.