Privacy Policy

In the context of the use of the StoFlow service, we collect the following categories of personal data:

2.1 Identification data

• Surname and first name
• Email address
• Password (stored in encrypted form)

2.2 Billing data

• Billing address
• Country
• Transaction history

Note: Bank card data is processed directly by Stripe and is never stored on our servers.

2.3 Technical data

• IP address
• Browser type
• Connection data (date, time)

2.4 Usage data

• Actions performed on the platform
• Products created and published
• Statistics on the use of features

Your personal data is collected and processed for the following purposes:

In accordance with the GDPR, each data processing operation relies on a legal basis:

• Performance of the contract (Article 6.1.b): The processing is necessary for the performance of the subscription contract (account creation, provision of the service, billing). This legal basis also covers the AI processing of photos submitted to the Service (automatic cutout, generation of descriptions), as this is an essential feature of the Service subscribed to.
• Legitimate interest (Article 6.1.f): The processing is necessary for the purposes of the legitimate interests pursued by Stokode SARL (service improvement, security, prevention of fraud relating to the right of withdrawal).
• Legal obligation (Article 6.1.c): The processing is necessary for compliance with legal obligations (retention of billing data).
• Consent (Article 6.1.a): For optional processing (newsletter, marketing communications), your consent is required.

We publish statistical studies calculated across all sellers. Each published statistic aggregates at least 50 distinct sellers; test accounts and internal StoFlow accounts are excluded from them. These statistics never make it possible to identify a seller, a product or a sale. This processing relies on our legitimate interest in documenting the second-hand market. You can object to it at any time by writing to contact@stoflow.com: your data will be excluded from subsequent editions.

Your personal data may be shared with the following recipients:

5.1 Data processors

Clarification on AI flows. When you submit a product photo to the Service, it is temporarily transmitted to Google Cloud for AI processing (automatic cutout, description generation). Images are not retained by Google beyond the processing, and no image is used to train third-party models ("no training" configuration explicitly enabled). The processing takes place in the European Union.

5.2 Third-party marketplaces

When you publish a listing on a marketplace via the Service, Stokode SARL transmits to that marketplace only the data you have chosen to publish: title, photos, description, price, product attributes.

These marketplaces (Vinted, eBay, Etsy, Leboncoin, Vestiaire Collective, and others) are independent data controllers for the data they receive. They have their own privacy policies, which you accepted by registering directly on their marketplace. Stokode SARL is not responsible for the processing carried out by these marketplaces on the published data, nor for any transfers of that data outside the EU.

5.3 Other recipients

• Administrative or judicial authorities in the event of a legal obligation
• Legal advisers (lawyer, chartered accountant) under an obligation of confidentiality

Your data is never sold to third parties.

5.4 Status of Stokode SARL under the GDPR

Stokode SARL is a data controller for the data linked to your account (identification, authentication, billing, support, commercial communications).

For the flows linked to the AI processing of the photos you submit to the Service, Stokode SARL acts as joint controller with you: you provide the content (photo of your product) and choose to trigger the processing, while Stokode SARL determines the technical means (AI model, parameters, Google Cloud data processor). This characterisation has no effect on the exercise of your rights provided for in Article 8 below, which can be exercised directly with Stokode SARL.

The respective responsibilities of Stokode SARL and of the User, as joint controllers within the meaning of Article 26 of the GDPR, are defined by this policy and by the Terms of Use, which together constitute the arrangement between joint controllers required by that Article. In summary: the User remains solely responsible for the content they submit (lawfulness, intellectual property rights, rights of third parties depicted in the photos), and Stokode SARL is responsible for the technical operation and security of the AI processing. Any request to exercise GDPR rights may be addressed to either of the joint controllers, in accordance with Article 26.3 of the GDPR.

Your personal data is retained for the following periods:

At the end of these periods, your data is deleted or irreversibly anonymised.

In accordance with the GDPR, you have the following rights over your personal data:

Complaint to the CNIL
If you consider that your rights are not being respected, you can lodge a complaint with the French supervisory authority, the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr

8.1 What is a cookie?
A cookie is a small text file placed on your device when you visit a website. It stores information relating to your browsing.

8.2 Strictly necessary cookies
These cookies are essential for the service to function:

8.3 Audience measurement
StoFlow measures the traffic of its site with PostHog, hosted in the European Union. By default, this measurement works without placing anything on your device: each visit is counted anonymously and is not linked to any other.

If you accept it via the banner displayed on your first visit, an identifier is stored on your device in order to link your visits to one another and to understand which content actually leads to a registration. You can refuse without losing access to anything: the anonymous measurement continues, only the link between your visits disappears.

Under the same conditions, your browser retains the source of your first and of your last visit (UTM advertising keyword, site that referred you to StoFlow, page on which you landed). This information is used by us to find out which channel brings us our registered users; if you create an account, it is attached to it at that time.

8.4 Third-party cookies
StoFlow does not use any advertising cookie, nor any cookie for sharing with a social network or an advertising network.

Stokode SARL implements appropriate technical and organisational measures to ensure the security of your personal data:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of passwords (secure hashing algorithm)
• Secure authentication by encrypted token
• Restricted access to data (principle of least privilege)
• Regular backups
• Intrusion monitoring and detection

In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed without undue delay in accordance with Article 34 of the GDPR.

Stokode SARL gives preference to data processors established in the European Union. Where a transfer outside the EU is necessary, it is governed by:

• the standard contractual clauses (SCCs) approved by the European Commission;
• the EU-US Data Privacy Framework (DPF) for certified companies.

Specific cases:

• Stripe (payment): headquartered in the United States, Data Privacy Framework certified.
• Google Cloud (AI processing): the processing is confined to the European Union; no image is transferred outside the EU for AI processing. Any Google administrative logs are governed by the SCCs.
• OVHcloud and Brevo: French providers, processing entirely in France.

These mechanisms guarantee an adequate level of protection of your personal data in accordance with the requirements of the GDPR.

Stokode SARL may amend this privacy policy to take account of legal, regulatory or technical developments or changes in the sub-processing chain. Any substantial amendment is notified to the User by email and published on this page.

Substantial amendments take effect thirty (30) days after their notification. During this period, the User may exercise their right to object to the new processing, or terminate their subscription without penalty with a pro rata refund for the unused part of the period. Failing an objection within this period, the new policy is deemed accepted.

Purely formal amendments, or amendments favourable to the User (editorial corrections, addition of further safeguards), take effect immediately.

We invite you to consult this page regularly to take note of any amendments.