Privacy policy

• Account details such as email, username, authentication records, profile text, and preferences.
• Listings, listing images, profile images, messages, message attachments, favourites, saved searches, and ratings you create on the platform.
• Reports, report details, and optional report evidence images submitted for moderation.
• Contact form messages and support correspondence.
• Request, device, IP-derived security, CAPTCHA, rate-limit, audit, and abuse-prevention metadata.
• Optional OAuth identity details when you choose to sign in with a third-party provider.

• To operate listings, messages, and notifications.
• To protect users from fraud, spam, or policy violations.
• To improve product features and performance.

• Cookie preference: stores your selected consent categories (essential, analytics, functionality, and optional marketing).
• Authentication cookies: required to keep you signed in and secure your session.
• Activity tracking and browser replay are disabled unless you accept the relevant non-essential cookie category.
• Google Consent Mode v2 + CMP signals: stores and syncs ad_storage, ad_user_data, ad_personalization, and analytics_storage preferences for Google services.

You can update your profile details and notification preferences from the settings page. Requests to delete your account will remove public listings and profile data.

For privacy requests, lawful-basis questions, or data-subject rights inquiries, contact our privacy team.

• Account, authentication, and security data: Contract performance for account access, plus legitimate interest for account integrity and security records.
• Listings, messages, ratings, and transaction coordination: Contract performance and legitimate interest (marketplace operation and dispute handling).
• Moderation, abuse reports, rate-limit events, and fraud indicators: Legitimate interest in platform safety, abuse prevention, and handling user reports.
• Diagnostics, performance telemetry, and replay data: Consent for non-essential tracking, plus legitimate interest for strictly necessary reliability telemetry.

If you believe your data protection rights were violated, you may contact your local supervisory authority or our lead authority below.

National Commission for Data Protection (CNPD): https://cnpd.public.lu/en.html

You can also contact us first at contact@techmaart.lu so we can investigate and resolve the issue quickly.

• Supabase: Database hosting, authentication, storage, and realtime infrastructure for core account and marketplace data.
• Vercel: Application hosting, edge routing, and deployment infrastructure processing request and performance metadata.
• Sentry: Error and performance monitoring to detect incidents and improve service reliability.
• Cloudflare: Turnstile CAPTCHA and traffic/security edge services to reduce abuse and automated attacks.

• Profile and account data is retained while your account is active. On verified account deletion, your account, profile, listings, sent messages, ratings, favourites, and notifications are permanently deleted. Uploaded-file cleanup is attempted immediately; automatic retry and verification are not yet guaranteed.
• Conversations you participated in and messages sent to you by other users may remain visible to those other participants after your account is deleted.
• Contact messages are retained for up to 12 months for support follow-up and abuse prevention, then automatically deleted.
• Security records such as login attempts and rate-limit events are retained for 30 days, then automatically deleted.
• Audit logs (including account-deletion records) are retained for 90 days, then automatically deleted.
• Message attachments automatically expire and are deleted after 7 days.

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access (Art. 15): you can request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): you can ask us to correct inaccurate data or complete incomplete data.
• Right to erasure (Art. 17): you can request deletion of your personal data when it is no longer necessary for the purpose it was collected.
• Right to restriction of processing (Art. 18): you can ask us to restrict processing while we verify accuracy or assess objections.
• Right to data portability (Art. 20): where the GDPR conditions apply, you can receive eligible consent- or contract-based data in a structured, machine-readable format.
• Right to object (Art. 21): you can object to processing based on legitimate interest, including profiling. We will stop unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent (e.g. analytics or marketing cookies), you can withdraw consent at any time via the cookie preferences in the footer. Withdrawal does not affect processing done before withdrawal.

To exercise any of these rights, contact us at contact@techmaart.lu or use the self-service features in your account settings. We will respond without undue delay and within one month; where permitted by GDPR, complex requests may take up to two additional months.

Some configured service providers may process data in the United States or other countries outside the European Economic Area (EEA). Where this happens, we rely on documented transfer safeguards made available by those providers, such as adequacy decisions, EU Standard Contractual Clauses (SCCs), or equivalent GDPR Chapter V mechanisms.

You can request a copy of the relevant transfer safeguards by contacting us at contact@techmaart.lu.

TechMaart does not use solely automated decision-making (including profiling) that produces legal effects or similarly significant effects on you. Automated systems are used only for spam detection and rate limiting, which do not produce legal effects. You can always appeal any moderation decision through our support team.