ReVibe Privacy Policy
Last updated: 26 September 2026
Effective from: 26 September 2026
This Privacy Policy explains how ReVibe collects, uses, shares and protects your personal data when you use the ReVibe mobile app, the website revibecy.com and related services (together, "ReVibe" or the "Service"). It applies to everyone who uses ReVibe, whether you buy, sell or just browse.
We have tried to write this in plain language. If anything is unclear, contact us at support@revibecy.com.
1. Who we are
The controller of your personal data is:
Dimitris Charalambous, trading as "REVIBE" (registered business name, sole trader)
Registered in: Limassol, Cyprus
Business registration no.: ΕΕ 683563
Email: support@revibecy.com (for privacy requests, please put "Privacy" in the subject line)
We have not appointed a Data Protection Officer because we are not legally required to. All privacy requests are handled by the contact above.
2. The short version
- We collect what we need to run a second-hand marketplace: your account details, your listings, your messages, your orders and basic technical data.
- We never see or store your full card details. Payments are handled by Stripe.
- Photos you upload are checked automatically for prohibited content before they appear on ReVibe.
- We do not sell your personal data and we do not use it for third-party advertising.
- Your data is stored in the European Union (Ireland). Some service providers may process limited data outside the EU under approved safeguards.
- You can access, correct, export or delete your data at any time, and you can complain to the Cyprus data protection authority.
3. What data we collect
3.1 Data you give us
| Category | Examples |
|---|---|
| Account data | Email address, password (stored only as a secure hash), name, username, city/area, profile photo, bio, language preference. If you sign in with Apple, we receive the name and email (or Apple's private relay email) that Apple shares with us. |
| Listing data | Photos, title, description, category, brand, size, colour, condition, price. |
| Messages and offers | Chat messages, offers, counter-offers and bundle offers you send to other users. |
| Order data | Items bought or sold, prices, fees, chosen delivery locker, delivery status, confirmations, problem reports and cancellations. |
| Reviews and ratings | Reviews you write and receive. |
| Reports and support | Reports you submit about listings or users, and your emails to support. |
| Seller payout and tax data | If you receive payments as a seller: data collected by Stripe for identity verification and payouts (see section 6), and data we are legally required to collect under EU tax rules (DAC7), such as full name, date of birth, address, tax identification number and bank account identifier (see section 5.4). |
3.2 Data collected automatically
| Category | Examples |
|---|---|
| Device and technical data | Device type, operating system, app version, IP address, crash and error logs. |
| Usage data | Listings you view, like or search for, and actions you take in the app (used for recommendations, safety and improving ReVibe). |
| Push notification tokens | A device token issued by Apple or Google, only if you allow notifications. |
| Security data | Sign-in events, one-time verification codes, and signals used to detect spam, fraud or abuse (for example, how many listings or messages an account sends in a short time). |
3.3 Data we receive from others
- Stripe: payment status, payout account status and verification results (never your full card number).
- Delivery partner (BoxNow): delivery and locker pickup status for your orders.
- Other users: information another user includes in a message, review or report about you.
3.4 Data we do not want
Please do not put sensitive information (such as health data, ID documents, or bank details) in listings or chat messages. Do not include other people's personal data in listing photos.
4. Why we use your data and our legal basis
Under the GDPR, we must have a legal basis for each use of your data.
| Purpose | Legal basis |
|---|---|
| Create and run your account, sign you in, verify your email | Contract (Art. 6(1)(b) GDPR) |
| Publish your listings, enable chats, offers, orders, delivery and reviews | Contract |
| Process payments, hold funds until delivery, pay out sellers, handle refunds (through Stripe) | Contract |
| Send essential service messages (verification codes, order updates, security alerts) | Contract |
| Send push notifications | Consent (Art. 6(1)(a)) — given through your device's permission prompt; you can turn them off at any time |
| Automatically screen photos and detect spam, fraud and abuse; enforce our Terms | Legitimate interest (Art. 6(1)(f)) in keeping ReVibe safe and lawful, and legal obligation under the EU Digital Services Act |
| Handle reports, moderation decisions and appeals | Legal obligation (Digital Services Act) and legitimate interest |
| Show personalised recommendations | Legitimate interest in showing you relevant items (see section 8) |
| Improve and fix the Service, measure performance | Legitimate interest |
| Keep accounting and tax records; report seller information to tax authorities (DAC7) | Legal obligation (Art. 6(1)(c)) |
| Respond to legal requests, establish or defend legal claims | Legal obligation / legitimate interest |
Where we rely on legitimate interest, we have balanced our interests against your rights. You can object at any time (section 11).
5. Automated processing, moderation and safety
5.1 Automated photo screening
Every photo uploaded to ReVibe is automatically analysed by an AI model (Google's Gemini API) before it is published. The check looks only for prohibited content in these categories: sexual content or nudity, violence or gore, weapons, drugs, hate symbols, and clearly illegal goods. Ordinary clothing photos are allowed, including swimwear and underwear shown as products.
If a photo is flagged, it is not uploaded and you see a message explaining the reason. You can upload a different photo. If you think a photo was blocked by mistake, contact support@revibecy.com and a person will review it.
This check does not identify people, does not use facial recognition, and does not produce a decision with legal or similarly significant effects on you under Art. 22 GDPR. Account suspensions are not made by automated means alone.
Photos sent for screening are processed by Google under its paid-service terms. Google does not use them to train its models. Google may keep them for a short time to detect abuse, as its terms allow.
5.2 Spam and abuse limits
To protect users, ReVibe automatically limits how much an account can do in a short time (for example, the number of listings per day, messages per minute and offers per hour). If you hit a limit, the action is paused temporarily.
5.3 Reports and human review
Users can report listings, messages and accounts. Our team reviews reports, aiming to act within 24 hours. When reviewing a report, we may read the reported listing or chat conversation. We do not otherwise read your private messages, except where needed to investigate fraud, to resolve an order dispute you are part of, or where required by law.
When we remove content or restrict an account, we tell the affected user the reason, as required by the Digital Services Act (see our Terms of Service, "Moderation, reports and appeals").
5.4 Tax reporting for sellers (DAC7)
EU law (Council Directive (EU) 2021/514, "DAC7") requires online platforms to collect information about sellers and report certain sellers to the tax authority. In Cyprus this is the Tax Department. A seller is reported if they complete 30 or more sales, or receive more than €2,000, in a calendar year.
To comply, we may ask sellers for their full name, date of birth, primary address, tax identification number and the bank account used for payouts. We then report the seller's sales count and total earnings for that year. We will tell you before your information is reported. If you don't provide required information after reminders, we may have to withhold payouts or suspend selling, as the law requires.
6. Who we share your data with
We share personal data only as described here. We do not sell your personal data.
6.1 Other users
- Public profile: your name or username, profile photo, city/area, bio, listings, ratings and reviews are visible to other users.
- When you trade: the buyer and seller see the information needed to complete the order (such as names, order details and delivery status). We do not share your email address or phone number with other users.
- Messages are visible to the users in that conversation.
6.2 Service providers (processors)
These companies process data on our behalf, under contracts that require them to protect it:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage and server functions | EU (Ireland, AWS eu-west-1) |
| Google LLC / Google Ireland Ltd | AI photo screening (Gemini API); push notifications (Firebase Cloud Messaging) | EU / USA |
| Resend Inc. | Sending account emails (verification codes, notifications) | USA |
| Cloudflare Inc. | Domain name services, email routing and website security | Global network (EU/USA) |
| Apple Inc. | Push notifications on iPhone (APNs); Sign in with Apple | USA / global |
6.3 Independent controllers
These organisations make their own decisions about your data and have their own privacy policies:
- Stripe Payments Europe, Ltd. (Ireland) processes payments and seller payouts, and performs identity verification and anti-money-laundering checks on sellers. See stripe.com/privacy.
- BoxNow (delivery partner) receives the details needed to deliver your parcel to the chosen locker (for example, the recipient's name, phone number or email, and the locker). See BoxNow's privacy policy.
- Public authorities (such as the Cyprus Tax Department, police or courts) when the law requires it.
6.4 Business changes
If ReVibe is sold, merged or restructured, your data may be transferred to the new owner. They will remain bound by this Policy, and we will notify you in advance.
7. International transfers
Our main database is in the EU. Some providers (for example Resend, Google, Cloudflare and Apple) may process data in the United States or other countries outside the European Economic Area. When this happens, we rely on:
- the EU–US Data Privacy Framework, where the provider is certified; and/or
- the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
You can ask us for a copy of the relevant safeguards at support@revibecy.com.
8. Recommendations
The "For you" and similar sections on ReVibe show listings based mainly on:
- the categories, brands and items you have viewed, liked or searched for;
- how recent and popular a listing is; and
- your general area.
We do not use sensitive data for recommendations. You can always find items without personalisation by using search and categories, which are not based on your profile.
9. How long we keep your data
| Data | Retention |
|---|---|
| Account and profile | While your account is active. Deleted when you delete your account. |
| Listings and photos | While published. Deleted with your account, or when you delete them. |
| Chat messages | While your account is active. Deleted with your account. A copy may be kept for up to 6 months if needed for an open report, dispute or legal claim. |
| Order and payment records | 6 years after the end of the tax year, as required by Cyprus tax and accounting law. After account deletion these are kept in a form that no longer shows your profile. |
| DAC7 seller data | For the period required by DAC7 and Cyprus law (up to 10 years after the end of the reporting year). |
| Moderation decisions and reports | Up to 6 months after the decision, or longer if needed for a legal claim. |
| Security and error logs | Up to 90 days. |
| Push tokens | Until you disable notifications, sign out, uninstall the app or the token expires. |
| Support emails | Up to 2 years after the matter is closed. |
You cannot delete your account while you have an active order. This protects the other person in the transaction. Once the order is completed or cancelled, you can delete it.
10. Security
We protect your data with measures including:
- encryption in transit (HTTPS/TLS) and at rest;
- database access rules so that users can only see their own private data;
- server-side checks that stop users from changing prices, order status or other protected fields;
- email verification and one-time codes at sign-up;
- limits against spam and automated abuse; and
- card payments handled only by Stripe (PCI-DSS certified). ReVibe never receives your full card number.
No system is 100% secure. If a personal data breach is likely to put your rights at high risk, we will notify you and the Commissioner as the GDPR requires.
11. Your rights
Under the GDPR you have the right to:
- Access — get a copy of your personal data.
- Rectification — correct inaccurate data (most profile data can be edited directly in the app).
- Erasure — delete your data. You can delete your account in the app under Settings. Some records must be kept by law (section 9).
- Restriction — ask us to limit how we use your data.
- Portability — receive the data you gave us in a machine-readable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — for example, turn off push notifications in the app or in your device settings at any time.
To exercise these rights, email support@revibecy.com (subject: "Privacy") from the email address linked to your account. We will reply within one month. If the request is complex, we may extend this by up to two more months, and we will tell you why. We may need to verify your identity.
Complaints: you can complain to the Commissioner for Personal Data Protection (Cyprus), Iasonos 1, 1082 Nicosia, Cyprus — www.dataprotection.gov.cy — or to the data protection authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
12. Cookies and local storage
The ReVibe app and website use strictly necessary local storage only. This keeps you signed in, remembers your language and settings, and keeps the app secure. These do not require consent.
We do not use advertising cookies or cross-site tracking. If we add optional analytics in the future, we will ask for your consent first and update this Policy.
13. Children
ReVibe is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it. If you think a minor is using ReVibe, contact us at support@revibecy.com.
14. Changes to this Policy
We may update this Policy when our Service or the law changes. We will show the date of the latest version at the top. If the changes are significant, we will notify you in the app or by email before they take effect.
15. Contact
Dimitris Charalambous, trading as "REVIBE"
Limassol, Cyprus
Email: support@revibecy.com