Privacy Policy

This policy explains what personal data Thriffie collects, why we collect it, and what rights you have over it. We have tried to write it in plain language rather than legal boilerplate.

1. Who we are

Thriffie is operated by [COMPANY NAME] OÜ, a company registered in Estonia (registry code [REGISTRY CODE]), with its registered address at [ADDRESS].

For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the data described here. Because we are established in the European Union, the GDPR applies to our processing regardless of where you are located.

Where you are located in Indonesia, Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) also applies to our processing of your data.

You can reach us about anything in this policy at privacy@thriffie.com.

2. What we collect

We only collect what the marketplace needs to function.

When you create an account

• Email address and a securely hashed password
• Username, and optionally your full name, profile photo and short bio
• Your general location (for example “Canggu”)
• Optionally a WhatsApp number, if you choose to add one

When you list an item

• Photographs you upload
• Title, description, price, category and condition
• A pickup address. This is shared with a buyer once they have paid for the item, so that they can arrange collection.

When you buy something

• A delivery address. This is shared with the seller so the item can be handed over.
• Order records: what, from whom, for how much, and the current status

When you message someone

• The content of messages and offers you send through the app

When you withdraw money

• Bank or e-wallet account name and number, and bank name
• A record of the amounts credited to and debited from your balance

Automatically

• Technical data needed to serve the site and keep it secure: IP address, browser type, and timestamps of requests
• A session cookie that keeps you signed in. We do not use advertising or third-party tracking cookies.

3. Why we use it, and on what legal basis

We do not sell your personal data, and we do not use it for advertising or profiling.

4. What other users can see

This deserves its own section, because it is the part people are most often surprised by.

• Public to anyone: your username, profile photo, bio, general location, and your active listings.
• Visible to the other party in an order only: the pickup or delivery address relevant to that order. A seller sees the buyer's delivery address; a buyer sees the seller's pickup address. Neither is visible to anyone else.
• Visible only to you: your email address, your balance, your withdrawal details, and your order history.

5. Who we share it with

• Supabase — hosts our database, file storage and authentication.
• Vercel — hosts and serves the application.
• A payment provider — once payments go live, a regulated provider will process card and e-wallet payments and seller payouts. We will never store your full card details; they go directly to the provider.
• Authorities — where we are legally required to disclose information.

Grab, or any other courier you choose, is arranged directly by you and is not our processor. Any information you give them is governed by their own privacy policy.

6. Where your data is stored

Our database and uploaded files are hosted by Supabase in Singapore (ap-southeast-1). Because we are established in the EU, this is a transfer of personal data outside the European Economic Area. We rely on [SAFEGUARD — e.g. Standard Contractual Clauses concluded with Supabase] as the lawful basis for that transfer under Chapter V of the GDPR.

7. How long we keep it

• Account data — until you delete your account.
• Order and transaction records — 7 years, as required by Estonian accounting law. These survive account deletion, in an anonymised form where possible.
• Messages — until the related account is deleted.
• Listings — until you remove them, or until your account is deleted.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased (“the right to be forgotten”)
• Restrict or object to how we process it
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent

UU PDP gives you broadly equivalent rights, including access, correction, erasure and the right to object to automated decision-making.

To exercise any of these, email privacy@thriffie.com. We will respond within one month.

You can delete your account and its data at any time from your profile settings.

9. Complaints

If you think we have handled your data improperly, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority:

• Estonia: Andmekaitse Inspektsioon — aki.ee
• Indonesia: the authority designated under UU PDP

10. Security

Passwords are hashed and never stored in readable form. Access to data is enforced at the database level through row-level security, so one user cannot read another's orders, messages or balance even if the application itself were compromised. All traffic is encrypted in transit.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority — within 72 hours under the GDPR, and within 3×24 hours where UU PDP applies.

11. Children

Thriffie is not intended for anyone under 17. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

12. Changes

If we change this policy in a way that materially affects you, we will tell you in the app or by email before the change takes effect.