Privacy Policy
Last updated: 6 July 2026
Who we are (data controller)
QuelPosto is operated by Tsoukalas Group (“we”, “us”), the data controller responsible for your personal data under the UK GDPR and EU GDPR. You can reach our data protection contact at privacy@quelposto.com for any question about how we handle your information.
Legal bases for processing
We process your personal data on these legal bases: to perform our contract with you (creating your account, listing and buying items, processing orders); our legitimate interests (keeping the marketplace safe, preventing fraud, improving the service); your consent (marketing messages and non-essential cookies, which you can withdraw at any time); and to comply with legal obligations (tax, accounting and anti-money-laundering rules).
Information we collect
We collect the information you give us when you create an account, list or buy items, and message other users — such as your username, name, email address, phone number, date of birth, delivery addresses and the content of your listings and messages. We automatically collect technical data such as your device type, approximate location, IP address and how you interact with QuelPosto. We do NOT collect or store your full payment card number — see ‘Payments and card data’ below.
Payments and card data (processed by Stripe)
All card payments and seller payouts are handled by Stripe, a PCI-DSS Level 1 certified payment provider. When you pay, your card details are entered directly into Stripe's systems — they never pass through or rest on QuelPosto's servers. We only store non-sensitive references from Stripe (such as a customer or payment token and the last four digits and card brand) so we can charge, refund and pay out securely. This means your raw card number is never visible to us, to sellers, or to anyone else on the platform.
Fraud prevention & signup IP
To keep the marketplace safe we record the IP address associated with your account at sign-up and at key actions, together with device and usage signals. We use these to detect and prevent fraud, duplicate or abusive accounts, and misuse of promotions and referrals. This processing is carried out on the basis of our legitimate interest in protecting our users, our sellers and the integrity of the platform; we retain these signals only for as long as needed for that purpose.
Accounts & session management
Authentication is handled by our infrastructure provider, Supabase. We never store your password in a readable form — it is salted and hashed. When you sign in, a secure session token is issued and kept in your browser's cookies (on the web) or your device's encrypted secure storage (in the app); it is used to keep you signed in and is refreshed automatically. You can end a session at any time by logging out, and we may expire or revoke sessions for security reasons, such as a password change or suspected compromise.
How we use your information
We use your information to operate the marketplace, process orders, escrow payments and payouts, prevent fraud, mediate disputes, provide customer support and improve our services. With your consent, we may also send you updates about features, offers and items we think you’ll like — which you can turn off at any time.
Sharing your information
We share information with other users only as needed to complete a transaction (for example, sharing a delivery address with the seller so they can ship your order). We also work with trusted service providers such as Stripe (payments and payouts), Supabase (hosting and database) and delivery couriers, and may disclose information where required by law or to protect our rights and users.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. QuelPosto gives you self-service tools for the two most common rights: you can export a copy of your data and permanently delete your account (which removes your listings and closes your Stripe relationship) directly from your account settings. You can exercise any other right by contacting us at privacy@quelposto.com.
Children
QuelPosto is not intended for anyone under 18. We do not knowingly collect personal data from children; if you believe a minor has created an account, contact us and we will remove it.
Data security
We use technical and organisational measures — including encryption in transit and access controls — to protect your information. No system is completely secure, so we encourage you to use a strong password and keep your account details private.
Data retention
We keep your personal data only for as long as needed to provide our services, comply with legal obligations, resolve disputes and enforce our agreements. When data is no longer required, we delete or anonymise it.
Processors & international transfers
We share data with trusted processors who act only on our instructions — including Stripe (payments and seller payouts), Supabase (hosting and database), and delivery couriers. Some of these providers may process data outside the UK/EEA; where they do, we rely on adequacy decisions or the UK/EU Standard Contractual Clauses to keep your data protected.
Contact us & complaints
If you have any questions about this Privacy Policy or wish to exercise your data rights, email privacy@quelposto.com. If you are in the UK or EU and believe we have not handled your data properly, you also have the right to complain to your local supervisory authority (in the UK, the Information Commissioner’s Office).