1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
Moritz Foglia
Leihgesterner Weg 36
35392 Gießen, Germany
Email: kontakt@supplybay.de
Phone: +49 1575 7118724

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functioning website (SupplyBay) as well as our content and services. The legal bases are in particular Art. 6(1)(a) (consent), (b) (performance of a contract or pre-contractual measures), and (f) (legitimate interest) GDPR.

3. Provision of the Website and Hosting

Our application is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (“Vercel”). When you access our pages, Vercel automatically processes technical connection data (including IP address, date and time of access, page accessed, browser used) in so-called server log files to ensure the operation, security, and stability of the service. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning operation). Where data is transferred to the USA as a result, this is based on appropriate safeguards (EU Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework).

4. Cookies

SupplyBay uses only technically necessary cookies. For the login area, a session cookie is set via our database and authentication provider Supabase, which serves to keep you logged in during your session. In addition, our hosting provider Vercel may set technically required cookies that serve the secure operation of the infrastructure (e.g. protection against abuse). These cookies are exempt from the consent requirement under § 25(2) No. 2 TDDDG (German Telecommunications-Digital-Services-Data-Protection Act), as they are strictly necessary to provide a service you have explicitly requested (login function, secure provision of the website). We do not currently use any analytics, marketing, or tracking cookies.

5. Registration and User Account

Using SupplyBay requires a user account. During registration, we collect your username, email address, and password. Account management and authentication are handled by our service provider Supabase, Inc.; your password is stored exclusively in encrypted (hashed) form and is not visible to us. This processing is carried out to fulfil the usage agreement with you (Art. 6(1)(b) GDPR). We also store your email notification preferences (e.g. whether you wish to be notified when an item's stock is low or it becomes unavailable).

6. Linking Your eBay Account

SupplyBay allows you to connect your eBay account to your SupplyBay account via eBay OAuth. In doing so, the application redirects you to eBay, where you explicitly authorize the connection. After successful authorization, we receive and store the following via the eBay Identity API:

• Access and refresh tokens to connect to your eBay account
• Your eBay user ID and eBay username
• The expiration date of the access token

We use this data exclusively to read your eBay watchlist on your behalf and to detect stock and price changes of the items contained in it. The legal basis is Art. 6(1)(b) GDPR (performance of the service you requested) or Art. 6(1)(a) GDPR (your explicit authorization in the eBay OAuth flow). You can revoke this connection at any time via your account settings in SupplyBay or directly through your eBay account; in this case, we delete the stored access tokens. eBay itself processes data as an independent controller within the scope of using its platform, in accordance with eBay's own privacy policy. The provider of eBay services is eBay Inc., 2065 Hamilton Avenue, San José, CA 95125, USA, meaning data may be transferred to the USA.

7. Watchlist and Item Data

For the items you monitor, we store the item data retrieved via the eBay Trading API and the eBay Browse API (e.g. item ID, title, price, currency, listing end date, and the determined availability status). This data is generally publicly viewable on eBay. Optionally, you can add your own Kleinanzeigen URL to individual items to make them easier to identify; this information is visible only to you within your account.

8. Account Deletion Notifications from eBay

eBay automatically sends us notifications when an eBay user deletes or closes their eBay account (so-called Marketplace Account Deletion/Closure Notifications). These notifications may in principle relate to any eBay user, regardless of whether they use SupplyBay. Incoming notifications contain the eBay user ID (and optionally the username) of the affected person and are cryptographically signature-verified by us. We then match the eBay user ID against our stored eBay account connections (see Section 6); if there is a match, we delete the associated access and refresh tokens as well as the eBay user ID from our database. This processing serves to fulfil our contractual obligations toward eBay as an API provider and to promptly erase data of affected individuals that is no longer required. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in complying with our obligations toward eBay and in protecting the data of affected users).

9. Notification Emails

If you enable this in your settings, we will notify you by email when a monitored item is no longer available or its stock is running low. These emails are sent via our email service provider Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Your email address and the relevant item data (title, price, link) are transmitted to Resend for this purpose. The legal basis is Art. 6(1)(b) GDPR, to the extent you actively use this feature, and otherwise Art. 6(1)(f) GDPR (legitimate interest in reliable technical delivery). You can disable these notifications at any time in your account settings.

10. Contact Form and Demo Request

If you contact us via the contact or demo request form on our website, we process the data you provide (name, email address, optionally company and message) in order to process your request and respond to you. The request is delivered by email via Resend to our inbox at kontakt@supplybay.de; replies are sent directly to the email address you provided. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). We delete this data as soon as it is no longer required to process your request, unless legal retention obligations require otherwise.

11. Database and Data Processors

All account, watchlist, and connection data is stored in a database operated by our service provider Supabase, Inc. Data processing agreements under Art. 28 GDPR are in place, or will be entered into as required, with all named service providers (Vercel, Supabase, Resend) that process personal data on our behalf. Your data is not transferred to any other third parties, with the exception of eBay in connection with the account linkage you authorize (see Section 6).

12. Retention Period

We store personal data for as long as your user account exists. If you delete your account or request deletion, we remove your account, watchlist, and connection data, unless legal retention obligations require otherwise.

13. Your Rights

Subject to the applicable legal requirements, you have the right at any time to:

• Access your stored personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal message to kontakt@supplybay.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

14. Data Security

We employ technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access. Data is transmitted between your device and our servers in encrypted form (TLS/SSL).

15. Changes to This Privacy Policy

We update this privacy policy whenever our data processing practices or the applicable legal requirements change. The current version is always available on this page.