Privacy Policy

1. Introduction

SellMyShit ("we", "our", or "us") is a marketing automation platform for indie developers and digital product creators. This Privacy Policy explains how we collect, use, and protect your information when you use our service at sellmyshit.asv.pt, in compliance with the General Data Protection Regulation (GDPR) and Portuguese data protection law.

2. Data Controller

3. Information We Collect

Account Information

• Email address
• Name
• Password (encrypted, never stored in plain text)

Product Information

• Product names and descriptions you provide
• Marketing content you create or we generate for you
• Media assets you upload (images, videos)

Social Media Connections

When you connect social media accounts (X (Twitter), Facebook, Instagram, LinkedIn, TikTok, YouTube, and others), we receive via our partner Late:

• Account identifiers to post on your behalf
• Page/profile names
• Post engagement metrics (likes, comments, shares)

We do NOT access your personal messages, friends lists, or any data beyond what's needed for posting and analytics.

Payment Information

Payment processing is handled by LemonSqueezy. We do NOT store your credit card details. We only receive confirmation of payment status and subscription details.

4. Legal Basis for Processing

We process your personal data on the following legal bases (GDPR Art. 6):

Contract Performance (Art. 6(1)(b))

• Account creation and management
• Providing the SellMyShit service
• Processing payments and subscriptions
• Generating AI-powered marketing content
• Publishing posts to your social media accounts

Legitimate Interest (Art. 6(1)(f))

• Service improvements and analytics
• Security and fraud prevention
• Responding to support requests

Legal Obligation (Art. 6(1)(c))

• Compliance with tax and accounting requirements
• Responding to lawful requests from authorities

5. How We Use Your Information

• To provide and maintain the SellMyShit service
• To generate AI-powered marketing content for your products
• To schedule and publish posts to your connected social media accounts
• To display analytics about your post performance
• To send you service-related notifications (account, billing, important updates)
• To respond to your inquiries and support requests

6. Data Sharing and Processors

We do NOT sell your personal data. We share data only with the following processors who help us provide our service:

7. International Data Transfers

Some of our service providers are located in the United States. When we transfer your data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework certification (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules of the processor

You can request information about the specific safeguards applied to your data by contacting us.

8. Data Retention

• Account data: Retained while your account is active, deleted within 30 days of account deletion
• Product and content data: Deleted when you delete products or your account
• Social media tokens: Deleted immediately when you disconnect an account
• Payment records: Retained for 7 years as required by Portuguese tax law
• Server logs: Automatically deleted after 90 days

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• HTTPS/TLS encryption for all data transmission
• Bcrypt password hashing (never stored in plain text)
• Encrypted storage for sensitive tokens
• Regular security updates and monitoring
• Access controls limiting who can access personal data

10. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format (JSON)
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at info@asv.pt. We will respond within 30 days.

11. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority:

We encourage you to contact us first so we can try to resolve your concerns directly.

12. Cookies

We use only essential cookies required for the service to function:

• Session cookie: Keeps you logged in during your visit
• CSRF token: Protects against cross-site request forgery attacks
• Theme preference: Remembers your light/dark mode choice (localStorage)

We do NOT use tracking, analytics, or advertising cookies. No cookie consent banner is required as we only use strictly necessary cookies.

13. Children's Privacy

SellMyShit is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes, we will notify you via email or in-app notification at least 14 days before the changes take effect. The "Last updated" date at the top indicates when the policy was last revised.

15. Contact Us

For privacy questions, data requests, or concerns, contact us at:

Email: info@asv.pt