Privacy Policy

1. Controller & Contacts

Crateed is operated by Christer Ek, an individual based in Sweden. Christer Ek is the data controller for personal data processed through the Services.

Privacy: privacy@crateed.com

Support: support@crateed.com

The supervisory authority for Sweden is Integritetsskyddsmyndigheten (IMY) — imy.se.

2. Scope

This policy applies when you use our Services as an individual or on behalf of a business, and to personal data as defined by applicable laws (e.g., GDPR, UK GDPR, CCPA/CPRA).

3. Data We Collect

• Account data: name, email, password hashes, country, language, preferences.
• Vault & listing data: item photos, attributes, categories, prices, SKU, condition, ownership, dimensions, valuations, listing history and status.
• Location data: if you grant permission, we process precise or approximate device location to power location-based features such as nearby discovery and your home location. Public display on the Live Network is a separate, optional setting — granting device location permission for nearby discovery does not by itself enable public map display. If you enable Live Network sharing, we convert your location into an approximate or pseudonymised location before any public display; see Section 18 for details on precision, update frequency, and retention. You can revoke location permission at any time in your device settings.
• Subscription and purchase data: when you purchase or restore a subscription or add-on, we process the store used, product identifier, transaction or purchase identifier, receipt or purchase token, subscription plan, entitlement status, purchase date, renewal date, expiration date, cancellation status, refund or revocation status, and store country and currency. Apple or Google processes your payment information; Crateed does not receive your complete payment-card details.
• Advertising and rewarded-ad data: advertising identifiers, consent status, ad impressions, clicks, and rewarded-ad completion and reward-grant events, processed to display general advertisements and sponsored content and to grant bonus AI scans to Free users who choose to view a rewarded ad.
• Integrations data: Crateed provides assisted tools that help you prepare and transfer listing information to 161+ marketplaces, including eBay. You choose what information to copy, review, and submit to each destination marketplace. Crateed does not currently connect to your third-party marketplace accounts or store marketplace login credentials, access tokens, session cookies or marketplace order data.
• Usage & device data: app interactions, logs, crash reports, device type, OS, browser, IP address, cookie identifiers, advertising IDs.
• Support & communications: messages you send us, surveys, feedback, and call/chat transcripts.
• Marketing data: preferences, engagement with emails and in‑app messages.
• Public content: information you choose to publish through a public profile, storefront, listing, collection, comment, trade offer, or other public feature, which may be visible to other users and, where applicable, to visitors outside the app. Do not publish information you do not want others to view, share, or copy. Private Vault information is not made public unless you expressly use a sharing or publishing feature.
• Compliance data: identity verification (KYC) status, AML screening results where required by law or platform policy.

4. Sources of Data

• Directly from you (account setup, uploads, forms, messages).
• Automatically via cookies/SDKs when you use the Services.
• From third-party services involved in features you use, such as app stores, payment and shipping providers, analytics providers, advertising providers and fraud-prevention vendors. Crateed does not currently retrieve account, listing or order data from third-party marketplaces through a connected marketplace account.

5. Purposes & Legal Bases

• Contract Provide, maintain, and personalize the Services; create and distribute listings; process orders and payments; provide support.
• Legitimate interests Improve features; analytics; prevent abuse and fraud; protect security; market similar services to existing users (where permitted).
• Consent Non-essential cookies/SDKs; certain marketing; optional data processing where required.
• Legal obligation Tax, accounting, AML/KYC and compliance with lawful requests.

Where we rely on legitimate interests, we balance our interests with your privacy rights and implement safeguards.

6. Sharing & Recipients

• Service providers (processors): cloud hosting, storage, analytics, monitoring, communications, customer support, fraud prevention, and any receipt-validation or subscription-management provider we use.
• Apple and Google: process your subscription purchase and payment information as the store operator for mobile purchases; Crateed does not receive your complete payment-card details.
• Advertising providers and ad networks: receive advertising identifiers and interaction data to serve general advertisements, sponsored content, and rewarded ads.
• Third-party marketplaces: when you choose to open or submit information to a third-party marketplace such as eBay through Crateed's assisted listing workflows, that marketplace processes the information under its own terms and privacy notice. Crateed does not automatically publish, update, or remove listings on third-party marketplaces through the currently available assisted listing workflows. Search providers, analytics providers, advertising providers, app stores and shipping providers may receive limited information where necessary to provide the feature you choose to use, as described in this policy.
• Payment & shipping providers: processors and carriers involved in transactions you initiate.
• Corporate transactions: your data may be transferred in a merger, acquisition, or asset sale.
• Legal: to comply with law or protect rights, security, and safety.

We do not sell personal data. We may publish a list of core subprocessors on our website; material changes will be notified where required.

7. International Transfers

Where personal data is transferred outside your country (e.g., from the EEA/UK to third countries), we use lawful transfer mechanisms such as the European Commission’s Standard Contractual Clauses (SCCs) and implement additional safeguards where appropriate.

8. Data Retention

• Account data: retained while your account is active and for up to 24 months after closure, unless a longer period is required by law.
• Vault/listing data: retained while needed for Services and audit/compliance (typically 24–36 months after last activity).
• Transaction data: retained per tax/accounting rules (usually 7–10 years depending on jurisdiction).
• Support communications: typically 24 months.
• Location data: only your most recently shared coordinate is retained for nearby-discovery features; we do not keep a location history. When you revoke location permission, disable Live Network sharing, or delete your account, the retained coordinate is deleted within 30 days. See Section 18 for Live Network-specific retention.
• Subscription and purchase data (receipts, entitlement and transaction identifiers): retained for as long as needed for accounting, tax, fraud-prevention, and legal-compliance purposes, typically 7–10 years depending on jurisdiction.
• Cookie identifiers: per cookie lifecycle; see Cookies.

9. Security

• Encryption in transit, network isolation, access controls, and logging.
• Vendor security reviews and data processing agreements.
• Incident response program; we will notify authorities and users where legally required.

10. AI, Profiling & Automated Decisions

• We use AI for product recognition, attribute detection, suggested titles/descriptions, translations, and estimated valuations.
• To provide these features, Crateed may send item images, text, product attributes, and related metadata to Crateed-operated systems and contracted AI or data-processing providers. We do not describe your content as excluded from provider model training unless that exclusion is supported by our actual provider agreements and technical configuration currently in place; contact privacy@crateed.com if you need current details on a specific provider's retention or training practices. Scan images and temporary derivatives are retained only as long as needed to produce and support the recognition result, then deleted or de-identified.
• These outputs are assistive, not determinative. You can edit or ignore them. We do not make legally significant decisions solely by automated means without human involvement.
• You may object to profiling used for direct marketing at any time.

11. Cookies & Similar Technologies

We use cookies/SDKs to operate the site, remember preferences, measure performance, and personalize content. Strictly necessary cookies are always active. Analytics and marketing cookies or similar technologies are only activated after you give active consent using the control below, and you can withdraw that consent at any time by returning to this control and updating your choice.

• Strictly necessary (always on): login, security, load balancing.
• Analytics (consent where required): usage measurement, crash diagnostics.
• Marketing (consent): campaign attribution, personalization.

12. Marketing Communications

You can opt out of marketing emails via the unsubscribe link or in settings. We may still send service or transactional messages.

13. Your Rights

Your rights vary by region and may include: access, rectification, erasure, restriction, portability, and objection; and the right to withdraw consent at any time.

• To exercise rights, contact privacy@crateed.com. We may request verification and will respond within one month (or as required by law).
• EEA/UK: You may lodge a complaint with your local supervisory authority (e.g., Sweden’s IMY).
• California: You may exercise rights under the CPRA as described in Regional Disclosures.

14. Children’s Privacy

Our Services are not directed to children under 16. If you believe a child provided personal data, contact us to request deletion.

15. Changes to this Policy

We may update this policy to reflect changes to our practices or legal requirements. If changes are material, we will provide notice (e.g., email or in‑app) and indicate the effective date.

16. Regional Disclosures (EEA/UK & California)

A. EEA/UK

• Controller & DPA: Where we process data on your behalf (e.g., buyer/order data), a Data Processing Addendum (DPA) may apply upon request.
• Transfers: We rely on SCCs and supplementary measures for transfers to third countries.
• Legal bases: See Section 5 for mapping of purposes to legal bases.

B. California (CCPA/CPRA)

• Categories collected: Identifiers; commercial information; internet/electronic activity; precise or approximate geolocation (device GPS — this is sensitive personal information under CCPA); subscription and purchase identifiers; advertising identifiers; inferences (valuation suggestions); and professional information (for business accounts).
• Business purposes: Provide and improve Services; security; debugging; short‑term transient use; advertising/marketing (subject to opt‑out/consent where required).
• Sale/Sharing: We do not sell personal information for money. Some analytics/advertising uses may be considered “sharing” under the CPRA. You may opt out using cookie preferences or by contacting us.
• Consumer rights: Right to know, delete, correct, and opt‑out of sale/sharing; limit use of sensitive personal information; and non‑discrimination for exercising rights.
• Authorized agents: You may use an authorized agent; we may require verification.
• GPC: Where our current tooling detects a Global Privacy Control signal, we treat it as an opt-out request for sale/sharing to the extent required by law. If you rely on GPC, you can confirm your specific opt-out was applied by contacting privacy@crateed.com.

17. Account Deletion and Data Removal

Deleting your account removes or anonymises personal data that Crateed no longer needs to provide the Services. Certain records may be retained where required for tax, accounting, fraud prevention, security, dispute resolution, enforcement of agreements, or other legal obligations. Deleting your Crateed account does not automatically cancel subscriptions billed through Apple or Google — see Terms of Service for cancellation instructions.

To delete your account, follow these steps in the app:

1. Go to Menu.
2. Navigate to Settings.
3. Click Delete Account.

If you're unable to delete your account via the app, please contact us at support@crateed.com.

18. Live Network Public Display

Crateed operates a public Live Network page at crateed.com/live that displays real-time activity on the platform. Public display on the Live Network is controlled by its own explicit in-app setting, separate from ordinary location-based functionality — granting device location permission for nearby discovery does not by itself enable public map display. This page may show:

• Approximate or pseudonymised location dots: if you enable Live Network location sharing, your device's precise GPS coordinate is converted into an approximate, jittered position (~500 m) before it is stored for public display or shown as a dot on a world map. Only your most recent coordinate is retained for this purpose; we do not keep a public location history. The dot updates each time you share a new location while sharing is enabled. Public dots are not displayed with your name, username, email address, or account identifier — but because Crateed can still associate the underlying location with your account internally, this location information is pseudonymised rather than fully anonymous and remains personal data under GDPR.
• Activity events: recent listings, sales, trades, and new user registrations shown with item title, city name, and country. User IDs and emails are never shown.

If you do not want your activity or approximate location to appear on the Live Network page, you can:

• Disable Live Network location sharing in the app without disabling other location-based features — your dot is removed from public display immediately, and the underlying coordinate retained for that dot is deleted from active systems within 30 days.
• Revoke device location permission entirely in your device settings.
• Contact privacy@crateed.com to request exclusion from the activity feed.

The legal basis for this processing is our legitimate interest in demonstrating platform activity publicly. We apply the minimum data necessary (approximate, pseudonymised coordinates, no personal identifiers on the public dot) to minimise privacy impact.