Privacy Policy

Wornly is operated by Kamont Digital B.V., Amsterdam, Netherlands (Chamber of Commerce number 97839752). We are the data controller for the personal data described here. Questions go to info@wornly.nl.

If you create an account

• Email address and nickname (your nickname is public)
• Password, stored only in hashed form
• Phone number and profile picture, if you add them
• If you sign in with Google: your Google account ID and the details Google shares with us
• That you accepted our terms, when your account was created and when you last logged in

If you buy

• Email address (also when you check out as a guest)
• Delivery address or chosen pickup point
• Your orders and offers, and the option and note you add to a custom request
• The payment amount, status and payment method type. We do not receive or store your full card or bank details

If you sell

• Your listings, including photos and descriptions
• The first name, last name and address you give as shipping details
• Your sales, wallet balance, wallet transactions and withdrawal requests
• The date you confirmed that you are 18 or older
• Your Stripe account ID and whether your Stripe sign-up is complete. Identity documents and bank details go directly to Stripe, and we do not store them ourselves

When you contact us

• Your email address and what you write to us

When you use the site

• IP address, browser details and pages requested, in our server logs
• What you do on the site, such as viewing a listing or moving through checkout, linked to your account if you are logged in and otherwise to a session ID, together with your IP address
• How you found us: the referring site, campaign tags, or the seller share link you followed
• If you scan one of our QR codes: your IP address and browser details

• To carry out our agreement with you: running your account, processing orders and payments, arranging shipping, paying out sellers, and sending order, offer and account emails and notifications
• To meet legal obligations: keeping financial and tax records
• Because we have a legitimate interest: keeping the platform secure, preventing fraud and abuse, answering support questions, understanding how the site is used so we can improve it, and featuring listings to promote the marketplace

We do not sell your personal data. We do not make automated decisions about you that have legal or similarly significant effects.

We share data only as far as needed with the parties below. Some of them also act as independent controllers under their own privacy policies.

• Stripe (payments, seller identity checks and payouts): payment details, your email address if you sign up as a seller, and what you enter in Stripe's sign-up
• Our delivery partner (shipping): the delivery address or pickup point and the buyer's nickname. Labels carry Wornly's details as sender, not the seller's name or address
• Resend (sending and receiving email): email addresses and the content of our emails
• Google (our support mailbox runs on Gmail, and Google sign-in): support emails and sign-in details
• Cloudflare (our domain and forwarding of email sent to @wornly.nl): email addresses and the content of those emails
• Amazon Web Services and DigitalOcean (hosting of the site, database, backups and photos, in EU data centres): all data described in this policy
• Anthropic (AI tools we use to monitor the platform, handle support and maintain our software): this can include personal data in our database, logs and support email
• PDOK, the Dutch government address service (address search): the address text you type at checkout, sent from our server
• Authorities, when the law requires it

Outside the EU

Some of these providers are based in the United States or process data there. Where that happens, the transfer relies on safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, as offered by those providers.

• Your nickname, public profile and listings are visible to everyone, including search engines
• Buyers do not see a seller's real name, address or email address, and sellers do not see a buyer's. A seller does see the nickname of the buyer and any custom request option and note the buyer adds, so don't put personal details in that note
• We may feature listings in posts on Wornly's Instagram account, showing the seller's nickname, the wear time, the price, a link and sometimes the listing photo

• Account data: until your account is closed and, if you ask, erased (see below)
• Orders, payments, payouts and related records: 7 years, as Dutch tax law requires
• Web server logs with IP addresses: 14 days
• Other technical logs: as long as needed for troubleshooting
• Site usage events and QR visits, including IP addresses: we have not set a fixed period yet. You can ask us to delete yours at any time
• Backups: daily database backups are stored on our server for about a month, so deleted data can remain in them for that long

Closing your account or erasing your data

You can close your account in your profile once you have no orders in progress. Your login stops working immediately and your profile and listings disappear from the site, but the account record stays in our database so order and payment history is kept.

To have your personal data erased as well, email info@wornly.nl. We will erase or anonymise what we are not legally required to keep within one month.

Under the GDPR you have the right to:

• Access your personal data and receive a copy
• Correct inaccurate data
• Have your data erased
• Restrict or object to how we use your data, including use based on our legitimate interests
• Receive your data in a portable format
• Withdraw consent at any time, where we rely on it

To use these rights, email info@wornly.nl. We reply within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Wornly's own code does not set cookies. Your login and a few site settings are kept in your browser's local storage, along with how you found us. Other parties do use cookies and tracking on our site:

• Stripe: sets cookies at checkout to process payments and prevent fraud.
• Google: sets cookies if you use Google sign-in.
• Email links: links in our emails go through our email provider, so we can see that a link was clicked. We do not track whether an email was opened.

• All traffic to the site is encrypted (HTTPS)
• Passwords are stored only in hashed form
• Our servers and database are in EU data centres
• Access is limited to what is needed to run Wornly and provide support

Wornly is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If you believe a minor is using Wornly, please tell us.

We update this policy when Wornly changes, and change the date at the top when we do. We tell users about significant changes.

Kamont Digital B.V., Amsterdam, Netherlands. Email: info@wornly.nl.