Privacy notice (UK GDPR)

Effective 7 October 2026.

Who we are

The controller of your personal data is SUNHAT DEV (Romans Hattrait, sole trader), 63 Chemin du Cros du Pont, 13710 Fuveau, France — contact@sunhat.fr.

What we collect, why, and on what basis

• Account — email address, password (hashed, never stored in clear), language, and if you fill them in your billing details. Purpose: provide your account and invoices. Basis: contract; legal obligation for invoices.
• Your photos and listings — reduced copies of the photos you upload (1600 px max; originals stay on your device) and the generated listings. Purpose: generate your listings. Basis: contract.
• Credits and payments — credit ledger, purchases and subscriptions (card payments handled by Stripe; we never see your card). Basis: contract; legal obligation (accounting).
• Your Vinted shop names and extension keys — to route drafts to the right browser profile. Basis: contract.
• eBay (only if you connect it) — access tokens, eBay username, ids of your listings. Basis: contract.
• Support and website chat — messages you send us and questions typed into the website chat assistant. Basis: contract; legitimate interests (answering visitors).
• Emails — service emails (contract) and, if you opted in or are a customer, news about our products for Vinted sellers (consent, or legitimate interests in promoting similar services — you can opt out at any time).
• Visit statistics — a first-party counter without cookies (page, referring site, campaign tag). Basis: legitimate interests (understanding how the site is found).
• Technical logs (IP address, browser) — security and fraud prevention. Basis: legitimate interests.

We never sell your data and make no decisions about you based solely on automated processing. Your photos are never used to train AI models.

Who we share it with

IONOS (hosting and backups, European Union), Stripe (payments, Ireland / United States), Brevo (email delivery, France), Anthropic (AI analysis of your photos and the website chat assistant, United States; images are processed on the fly and not used for training), and eBay only if you connect your eBay account. To withdraw from eBay an item sold on Vinted, the FriShot Connect extension reads, within your Vinted session, the list of your listings (id, title, sold or not) and sends it to Frishot: this only happens when you have a listing live on eBay, and that list is not stored. If you delete your eBay account, eBay notifies us and your tokens are erased.

International transfers

Our servers are in the European Union, which benefits from UK adequacy regulations. Where data is transferred to the United States, it is protected by the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or otherwise by the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Photos: deleted automatically 90 days after the item's last activity, or earlier if you delete the item.
• Account, listings and email preferences: until you delete your account (My account → Security).
• Invoices and the credit ledger: 10 years, as required by French commercial law (kept in anonymised form after account deletion).
• Technical logs: a few weeks.

Sharing within SUNHAT DEV products

SUNHAT DEV also publishes Fripilot, Friprix and Vinted Tracker. Your email address and communication preferences (opt-in, unsubscribe) may be consolidated in an internal tool shared by these products, to manage consent and — if you are a customer or have opted in — to tell you about our other products for Vinted sellers. You can object at any time.

Account linked to Fripilot. If you open Frishot from Fripilot (“✨ Create listings”, after ticking “I agree” there) or click “Log in with Fripilot”, Fripilot sends Frishot your email address, language, Vinted shop names and plan, so that your Frishot account opens without a new sign-up and the credit quota included in your Fripilot plan applies. In return, Frishot sends Fripilot the items you create here (title, reference, brand, size, category, suggested price, first photo) so that they enter your stock. Same controller (SUNHAT DEV); lawful basis: performance of the contract. You can unlink the two accounts at any time from Fripilot; deleting your Fripilot account also deletes the Frishot account created through this link, unless you have made it independent (own password or purchase).

Your rights

You have the right to access, correct, erase, restrict or port your data, to object to processing based on legitimate interests, to object at any time to direct marketing, and to withdraw your consent at any time. You can delete your account yourself (My account → Security) or write to contact@sunhat.fr: we reply within one month. Every marketing email contains a one-click unsubscribe link.

You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.

Cookies and local storage

A single session cookie, strictly necessary to keep you logged in. In your browser's local storage we keep your cookie-banner choice and, if you use the website chat, a conversation id so the conversation continues across pages. No advertising cookies, no third-party analytics or tracking.