Privacy Policy

Depending on how you use Bazarus, the service may process account information such as your email address, first name and last name, authentication information, profile information and account status.

When you use marketplace features, Bazarus may also process listing titles, descriptions, prices, locations, categories, photographs, favorites, messages, notifications, user blocks, reports and moderation-related records.

Technical information required to maintain an authenticated session or complete an account-recovery flow may also be processed.

Security activity records include browser information and, when hosted on Vercel, an approximate city and country derived by the hosting provider from your IP address. These details help you review account activity; they are not GPS location and may be inaccurate when using a VPN or mobile network. This feature does not send your IP to an additional geolocation service or store raw IP addresses in these activity records.

Personal data is used to provide account access, publish and manage marketplace listings, enable communication between users, maintain favorites and notifications, prevent abuse, process reports, enforce marketplace rules and operate security features.

Active listings are intended to be publicly visible. Public seller profiles may display a seller's first name, last-name initial, membership information and active listings.

Do not include sensitive personal information in a public listing, photograph, description or other public marketplace field.

Vercel hosts and delivers the website and runs server-side application requests. This involves processing request information, including IP addresses, and the data needed to handle the requested feature.

Bazarus currently uses Supabase infrastructure for authentication, database functionality, file storage and realtime application features.

The selected Supabase project region is Central Europe (Zurich), Switzerland.

Resend delivers account emails, such as email verification and password recovery messages. It processes recipient addresses, email content and delivery information. Infomaniak hosts the info@bazarus.ch mailbox used for support and privacy correspondence, including any attachments you send.

Infomaniak states that its mail service is hosted in Switzerland. Vercel and Resend describe processing in the United States in their data processing agreements. Choosing an email sending region does not mean that all email data stays in that region. Supabase's selected project region also does not exclude processing elsewhere by its service providers.

The full list of applicable processing countries and contractual transfer safeguards still requires confirmation for this deployment. This section is not yet a complete international-transfer disclosure.

• Vercel — DPA
• Supabase — DPA
• Resend — DPA
• Infomaniak — Privacy Policy

Bazarus uses cookies and similar browser mechanisms where they are technically necessary for authentication, session continuity and password recovery.

Optional usage measurements require your permission and are off by default. They record daily action totals, not your account, search words, messages, photos, listing IDs or precise location. See the Cookie Policy to allow or stop collection. Normal infrastructure request logs are separate from these totals.

Registered users can update certain account information through the account area. Bazarus also provides an account-deletion flow.

Account deletion includes a cleanup step for files uploaded by the account before the account itself is deleted. If cleanup fails, deletion may need to be resumed or handled with support. Archiving a notification or letting a listing expire is not the same as deleting the underlying data.

Our approved retention policy is six months after resolution for support requests and support email correspondence, and twelve months after resolution for moderation records. Reopened cases start a new period when resolved again. Necessary records relating to an ongoing dispute or a legal retention obligation may be kept longer, with the reason and continued need reviewed.

Implementation notice: the database cleanup process is prepared but is not yet activated. Support emails held in the Infomaniak mailbox require separate manual review and deletion; the website does not delete them. We do not yet guarantee automatic deletion at these deadlines.

There is currently no single automatic deletion period for all account, marketplace, support and security records. In particular, the application does not apply a fixed age-based cleanup to account security activity. A shorter period must not be assumed simply because only recent entries are displayed.

If optional usage measurements are enabled and you consent, they store daily aggregate counts. Entries outside the current 90-day window are removed when new measurements are recorded, rather than by a scheduled daily deletion. If collection stops, older totals may remain until cleanup runs again.

Retention periods for operational logs and provider backups still need to be confirmed. Deleting data from the application must not be interpreted as immediate deletion from every provider log or backup. Contact the operator for a data-deletion request or information about a specific record.

Depending on the law applicable to you and the circumstances of the processing, you may have rights relating to access, correction, deletion or other handling of your personal data.

For privacy questions or requests about your personal data, use the support and privacy email address in the operator details above. Never send your password or verification codes.

Bazarus uses application-level access controls and database authorization rules designed to limit access to user data. No internet service can guarantee absolute security.

This policy may change when Bazarus introduces new features or changes how personal data is processed. The date shown at the top of this page identifies the current revision.