Privacy Policy

1. What we collect

• Account: name, username, email, password (stored hashed by our auth provider), profile photo and bio if you add them.
• Orders: what you bought, from whom, amounts, shipping name and address, and notes you send the shop. Card details are collected by Stripe; we only see the card brand and last four digits.
• Shops: shop details, listings, your legal name, date of birth, country of residence and billing address, the result of your identity check (done by Stripe Identity, which handles your ID and selfie images under its own privacy policy — we receive the verified name and status), and your payout account — the US bank account details, country of residence and the IRS tax form (W-8BEN or W-9) you sign. Account numbers and tax IDs are stored encrypted and used only for payouts and tax reporting. Where the law requires it (for example for high-volume sellers), we also keep the business details you give us.
• Messages, posts, comments, reviews and reports you send.
• Usage: the pages, searches and listings you view, items you add to your cart, and ad clicks — counted without cookies, as described below.

2. Analytics without cookies

We count visits without cookies and without tracking scripts. When you open a page, our server turns your IP address and browser details into a scrambled code using a secret that changes every day. Your IP address itself is never stored, and the code can't be linked from one day to the next.

• What we record with that code: the pages you view, your searches, the listings you open, items added to your cart, your country (worked out from the request) and your device type (phone, tablet or computer).
• Why: site statistics, spotting fraud and abuse, and the marketplace ranking — listings that people view and add to their carts rank higher.
• If you're signed in, this activity is also linked to your account. When you delete your account, that link is removed and only anonymous counts remain.
• We keep these records for 13 months, then delete them.

3. Filagora Ads clicks

When you click a listing marked "Sponsored", we record the click the same cookie-free way. We use it to charge the shop only for real, unique clicks (one per person, per listing, per day), to stop click fraud, and to tell the shop if the click led to a purchase within 30 days. Shops see totals — clicks, orders and sales — never who clicked.

4. Why we use it

• To provide the service you asked for — accounts, checkout, delivery, messaging, downloads (contract).
• To prevent fraud, abuse and infringement, keep the platform secure, measure how the site is used, and rank listings and posts (legitimate interests).
• To meet legal obligations such as tax, accounting and seller-verification records (legal obligation).
• To send transactional emails (orders, shipping, messages). We don't send marketing without your consent.

5. Who we share it with

Only what's needed. When you buy a physical item, the shop gets your name, shipping address and order notes — only to make and deliver your order, not for marketing. Service providers process data for us under contract:

• Stripe — card payments, sellers' identity checks (Stripe Identity) and the card sellers save for their account
• Our US bank — sending seller payouts (name, bank account and amount only)
• Supabase — database, login and file storage
• Vercel — hosting
• Resend — email delivery
• Cloudflare — file and image storage (when we move storage there; we'll update this list)

We never sell personal data. We disclose data to authorities only when legally required — for example tax reporting on sellers, or a valid court order.

6. International transfers

Our providers may process data in the United States and the EU. Where data leaves the EEA, UK or Türkiye, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. How long we keep it

• Account data stays while your account exists. When you delete your account we remove your profile, posts, favorites and follows, and unlink your analytics records.
• Order records are kept, de-identified, for as long as tax and accounting law requires (typically up to 10 years).
• Analytics and ad-click records: 13 months.

8. Your rights

Depending on where you live (GDPR, UK GDPR, KVKK, CCPA), you can access, correct, export or delete your data, object to or restrict processing, and complain to your data protection authority. Most of this is in Account settings; for anything else email support@filagora.com. We reply within 30 days.

9. Cookies and local storage

We use only what the site needs to work: a sign-in cookie, and your browser's local storage for the cart and recently viewed items. No advertising or cross-site tracking cookies, so there's no cookie banner to click through.

10. Children

Filagora isn't for children under 16, and we don't knowingly collect their data.