Privacy Policy

Seekfy is the controller of the personal data processed through Seekfy. This Policy describes what we process, why, on which legal basis, for how long, with whom it is shared and the rights available to you under the Brazilian General Data Protection Law (Lei 13.709/2018 — LGPD), the EU/UK General Data Protection Regulation (GDPR) and comparable laws.

Contact for privacy matters and data-subject requests: [email protected].

• Account data — email address, display name, authentication identifiers and, if you sign in with Google, the basic profile shared by that provider. Passwords are stored only as salted hashes by our authentication provider; we never see them in clear text.
• Activity data — collections and saved items, ratings, notification preferences, and the reports, update requests, website submissions and Market listings you send, including the contact email you provide with them.
• Technical data — IP address, user agent, timestamps and request logs generated when your browser contacts our hosting, database and storage providers, kept for security and troubleshooting.
• Aggregate counters — page views and saves per entry (as daily totals) and clicks per Market listing. These are stored as totals and are not linked to your identity.
• Search terms — the words typed into the gallery search, counted per day together with whether anything was found, so we can tell which websites people are missing. They are not linked to you or your device, and terms that look like an e-mail address or a long number are discarded.

We do not knowingly collect special categories of data. The Service carries no advertising and builds no advertising profiles.

• Providing the Service and your account, collections, ratings and preferences — performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Reviewing submissions, listings and reports, and contacting you about them — contract and legitimate interests in operating a curated service (LGPD art. 7, V and IX; GDPR art. 6(1)(b) and (f)).
• Security, abuse and fraud prevention, including vote-integrity checks — legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Optional storage on your device beyond what is strictly necessary — consent, which you can withdraw at any time (LGPD art. 7, I; GDPR art. 6(1)(a)).

We do not sell personal data. We share it only with processors acting on our instructions and under data-processing terms:

• Supabase — authentication and managed PostgreSQL database.
• Cloudflare — object storage (R2) and content delivery for images and uploads.
• Our web hosting provider — serving the application and edge logs.
• Google — only if you choose Google sign-in.

We may disclose data where required by law or a valid order from a competent authority, or to establish, exercise or defend legal claims.

Market listings link to Sellers' own stores. When you follow such a link you leave the Service; the Seller or marketplace is an independent controller of any data you provide there, and we receive none of it.

Our providers may process data outside your country. Where required, transfers rely on adequacy decisions or on standard contractual clauses and equivalent safeguards (LGPD arts. 33–36; GDPR Chapter V).

• Account and activity data — for the life of the account, then deleted or anonymised within 30 days of deletion, except where retention is legally required.
• Submissions, listings and reports — while under review and, once resolved, for up to 24 months for audit purposes.
• Technical logs — up to 90 days, unless needed for an ongoing security investigation.
• Search term totals — up to 13 months.

Subject to applicable law you may request: confirmation of processing and access; correction; anonymisation, blocking or deletion of unnecessary or excessive data; portability; information about sharing; withdrawal of consent; objection to processing based on legitimate interests; and review of solely automated decisions. We do not make decisions producing legal effects by solely automated means.

Send requests to [email protected]. We respond within the statutory period (15 days under LGPD; one month under GDPR). You may also lodge a complaint with your supervisory authority — in Brazil, the ANPD.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), row-level access control in the database so each user can read only their own private records, least-privilege credentials and short-lived signed URLs for uploads. No system is perfectly secure; we will notify affected users and authorities of a qualifying incident as the law requires.

The Service is not directed to children under 16 and we do not knowingly process their data. If you believe a child has provided data, contact us and we will delete it.

We may update this Policy to reflect changes in the Service or the law. The effective date above indicates the current version; material changes are announced on the Service.