Who is responsible for your data
Relisto is published by Julien Rousselot, sole trader (SIRET 934 525 890 00018), 39 avenue Clemenceau, 57100 Thionville, France. For any question or request about your data, contact relistocompany@gmail.com.
Privacy
Privacy Policy
Relisto is an extension that relists your own Vinted listings. This page explains exactly what data is processed, why, and by whom.
Last updated: 27 September 2026
Data processed locally (in your browser)
Relisto reads your active Vinted listings and saves a snapshot of each one (title, price, brand, size, condition, photos) in your browser's local storage, so it can relist them. Your settings, the current relist queue, and the activity log are stored the same way. None of this ever leaves your browser, except when you trigger a relist yourself — the listing is then sent to Vinted, the same way it would be if you did it by hand.
Data sent to Relisto (your account)
To use the extension, you create a Relisto account. Your name and email are sent to our backend to create and identify that account. Your password is transmitted over HTTPS and stored only as a salted hash — never in plain text, never sent back to the extension. A sign-in token is kept in the extension's local storage to keep you signed in.
Closet and usage data sent to Relisto
So that a plan can be enforced fairly, the extension registers the numeric id of the Vinted account (the "closet") you use it on, and reports counts back to us: how many listings the closet has, how many are old enough to relist, how many items have sold, and how many relists you have used this month. It also keeps an anonymous per-item counter — how many relists it took before an item sold — identified by a random id generated in your browser, not by the Vinted item. These are numbers only: no titles, no prices, no descriptions, no photos, no buyer or message data ever leaves your browser. The one exception is the publisher's own administrator account, which stores its own listing content for personal margin tracking; that is not enabled for, and cannot be enabled by, any other account.
Diagnostics and error reports
To find out where the extension breaks and fix it, it sends the Relisto backend a few operational events (signed in, wardrobe synced or not, listing republished or not, plan limit reached), tagged with the extension’s version. When a listing cannot be republished, it also sends an error report: the step that failed, the HTTP code and error message returned by Vinted, and the Vinted category, condition and size ids involved. No title, price, description or photo is included. Only if you click “Report” on a failed listing does the report also carry that listing’s Vinted id and the comment you write, so we can look at it.
Billing data (if you take a paid plan)
If you switch to a paid plan, payment is handled by Stripe — Relisto never sees your card number. Stripe passes us your name, billing address, and the type of card used (e.g. Visa •••• 4242), which we keep to issue your invoices and meet our accounting obligations.
Approximate location and IP address
To know which countries Relisto is used from, the extension sends our backend the timezone your browser reports and the Vinted marketplace you work on; the country is derived from those. Your IP address is used as a source only as a last resort, when neither of those signals says anything: a large share of connections come through a VPN, which makes the IP the least reliable of the three. Separately, your IP address is recorded on each sign-in and each call from the extension, for account security and fraud prevention; it is never used for advertising and is erased automatically 30 days after your last activity. Only the country, the timezone and the marketplace — none of which identify you — are kept beyond that.
Analytics and cookies
Our website relistoapp.com can measure aggregate traffic (page views, traffic sources) using Google Analytics via Google Tag Manager, and PostHog, hosted in the EU. Neither is loaded until you accept in the banner shown on your first visit: if you decline, no analytics script is loaded and no analytics cookie is set. You can change your mind at any time via the "Cookies" link at the bottom of any page. The extension uses no third-party analytics; it only sends Relisto the diagnostics described in “Diagnostics and error reports”.
The legal basis for each use of your data
Your account, your usage counters and the enforcement of your plan rest on performance of our contract with you (article 6.1.b GDPR). Billing and the keeping of invoices rest on our legal, accounting and tax obligations (article 6.1.c). Recording your IP address and the country derived from it rests on our legitimate interest in keeping accounts secure and preventing fraud (article 6.1.f) — you may object to it at any time. Website audience measurement (Google Analytics, PostHog) rests solely on your consent (article 6.1.a), which you can withdraw at any time through the “Cookies” link in the footer, as easily as you gave it. Diagnostics and error reports rely on our legitimate interest in keeping the service working and fixing its faults (Article 6(1)(f)).
Who your data is shared with
Relisto relies on a small number of technical providers, solely to run the service: Stripe (payment and billing), Resend (transactional emails such as subscription confirmations), Railway (hosting the backend and database), and — on the website only, and only with your consent — Google Analytics via Google Tag Manager and PostHog for aggregate traffic statistics. None of your data is sold, and none of it is used for advertising.
Transfers outside the European Union
Relisto’s database and backend are hosted in the European Union, and PostHog runs on its European infrastructure. Some providers are nevertheless established in the United States: Vercel (website hosting), Stripe (payments) and Google (Google Analytics and Google Tag Manager). Those transfers are covered either by the EU–US Data Privacy Framework, to which these companies adhere, or by the European Commission’s standard contractual clauses together with additional security measures. You can ask us for a copy of the safeguards that apply at relistocompany@gmail.com.
What Relisto does not do
No ad tracking, no reselling of data, no building of advertising profiles. Website analytics (see "Analytics and cookies" above) is limited to aggregate statistics and requires your consent. Your listing content — titles, prices, descriptions, photos — is never sent to us: the extension keeps it in your browser and only ever sends counts (see "Closet and usage data" above). Relisto never asks for or stores your Vinted password, and never stores your Relisto password on your machine — the extension uses your browser's already-signed-in Vinted session and a revocable sign-in token. No access to your browsing history outside of Vinted.
How long your data is kept
Data stored locally (listings, settings, log) is deleted when you uninstall the extension or clear its storage. Your account data is kept for as long as the account exists. IP addresses are erased 30 days after your last activity, and expired sign-in sessions are deleted automatically. Invoices are kept even after account deletion, in line with the legal obligation to retain accounting records (10 years, Article L123-22 of the French Commercial Code). Operational events are deleted after 180 days and error reports after 90 days.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on our legitimate interest, to withdraw a consent you have given at any time, and to leave instructions about what happens to your data after your death. You can delete your account yourself from the Pricing page — deletion removes your account and the data attached to it, except invoices, which the law requires us to keep for ten years. For anything else, write to relistocompany@gmail.com: we reply within one month, extendable by two months for complex requests, in which case we tell you. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr), or with the supervisory authority of your own country.
Contact
For any question about this policy: relistocompany@gmail.com.