Privacy Policy
In force since 28 August 2026
This policy sets out what personal data RepCartel collects, on what basis, who receives it and how long it is retained.
1.Data controller
The controller of personal data collected through the site is RepCartel.
The site is not currently operated through a registered business. Should that change, the entity’s details will be published here.
Contact for matters concerning personal data: contact@syntaxcrew.pl.
2.Data we collect
We collect only the data required for the individual features of the site to work.
Data provided by the user
- Email address, when requesting the extension install link, subscribing to the newsletter, and optionally in the feedback form and the consultant. Providing an address is voluntary.
- The content of messages sent to the shopping consultant and of search queries.
- Discord account identifier, when signing in to the site and when linking an account to the RepHunter extension.
- Content of a creator page (handle, display name, description, links and referral codes), where a user chooses to run one. This content is published publicly by the user.
Data sent by the browser
- IP address and user agent. Some records store these values in plain form, as matching an extension install to the click that produced it requires it. The remainder store only a hash, which is sufficient to detect abuse.
- Pages visited, time of visit and the source of entry. Clicks on creator-page buttons are counted per button per day, without recording the IP address or user agent.
- Language, currency and selected agent, stored in the user’s browser.
Signing in to the site is possible only through a Discord account; the site maintains no password-based registration. Beyond the attribution described below, we do not build user profiles.
3.Legal bases for processing
Each purpose rests on one of the bases below. Consent may be withdrawn at any time. Processing based on legitimate interest may be objected to.
- Consent — Art. 6(1)(a) GDPR
- Newsletter and the message containing the install link. Analytics and advertising measurement, including the TikTok pixel and events sent to TikTok from our server.
- Legitimate interest — Art. 6(1)(f) GDPR
- Providing the site and the consultant, protection against abuse, measuring feature usage, and attributing an extension install to a campaign.
- Legal obligation — Art. 6(1)(c) GDPR
- Maintaining required records and responding to lawful requests from authorities.
4.Recipients of the data
The entities below process data in connection with the operation of the site. This does not cover agents and marketplaces that the site merely links to; following an external link does not involve any transfer of data by us.
| Entity | Scope of service | Data transferred | Location |
|---|---|---|---|
| Vercel | Hosting and server-side execution. | Request metadata, IP address, user agent. | Outside EEA |
| Netcup | German server running the database and the internal lookup API. | All data held in the database. | EEA |
| OpenAI | Generating the shopping consultant’s responses. | Content of messages sent to the consultant. | Outside EEA |
| Pinecone | Search index used by the consultant. | Catalogue and guide content, query text. | Outside EEA |
| Resend | Delivery of transactional email, including the extension install link. | Email address, message content. | Outside EEA |
| TikTok | Advertising measurement, via a pixel on the page and events sent from our server. | Pages viewed, click identifier, IP address, user agent. | Outside EEA |
| Cloudflare | Worker retrieving QC photographs. | Order or item number, IP address. | Outside EEA |
Transfers outside the EEA
Entities marked “Outside EEA” process data in third countries. Such transfers are based on the standard contractual clauses approved by the European Commission or on an adequacy decision. Details are available on request.
5.Retention periods
The periods below run from the date a record is created. Data not listed is retained for as long as the resource it relates to exists.
| Type of data | Period |
|---|---|
| Consultant conversations | 90 days |
| Search and QC lookup logsRetained without a fixed period, for site statistics and catalogue development. | — |
| Abuse records | 180 days |
| Referral and install attribution | 180 days |
| Analytics events | 365 days |
| Feedback submitted by users | 365 days |
| Newsletter subscriptionUntil unsubscribed. A link is included in every message. | — |
| Discord verification for the extensionFor the duration of the link between the Discord account and the extension. | — |
6.Cookies
The site uses two groups of cookies. Declining consent for the optional group does not restrict use of the site.
- EssentialRequired
- Maintain the session and remember the selected language, currency and agent. They also protect forms against abuse. The site does not function correctly without them.
- Analytics and advertisingOptional
- Measure traffic and the performance of advertising campaigns, including through the TikTok pixel. These require consent.
Browser settings allow cookies for this domain to be blocked or deleted. Blocking the essential group prevents the site from remembering language, currency and the selected agent.
7.Rights of the data subject
Requests should be sent to contact@syntaxcrew.pl. We respond within 30 days.
- Access to the data and a copy of it.
- Rectification of inaccurate data.
- Erasure of the data.
- Restriction of processing.
- Objection to processing based on legitimate interest.
- Portability of the data to another controller.
- Withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.
Complaint to the supervisory authority
A data subject has the right to lodge a complaint with:
President of the Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warszawa, Polska
uodo.gov.pl8.Age of users
The site is not directed at persons under the age of 16 and we do not knowingly collect their data. If such data has reached the site, please contact us and it will be deleted.
9.Data security
Access to the database is restricted, transmission is encrypted, and responses containing personal data are encrypted. These measures do not rule out a breach. Should one occur, we will notify the data subjects and the supervisory authority to the extent required by law.
10.Changes to this policy
The date given at the beginning of the document indicates when the current version took effect. It is updated with every substantive change.