Politique de confidentialité

1. Who is the data controller

Zagrena LLC, a limited liability company formed in Delaware, USA (filing ID 10695301, principal office 8 The Green, Suite 23221, Dover, DE 19901, USA), is the data controller (and, under US privacy law, the "business") for personal data processed through the Zagrena platform.

We serve users worldwide. This Policy applies globally; specific regional rights (EEA/UK and California) are set out in sections 8 and 9. For any privacy inquiry, contact our privacy team at [email protected].

2. What we collect

• Account data: username, email address and a bcrypt hash of your password.
• Profile data: avatar, bio and public seller rating.
• OAuth identifiers: if you sign in with Google or Discord, we store the provider name, the provider-issued user ID and the email returned by the provider.
• Identity verification data: for sellers, a government-issued ID image and a liveness selfie, plus the metadata produced by our verification provider.
• Transaction data: orders, wallet balance, payouts and references to payment instruments held by our payment partner (full card numbers and CVV are never stored on our servers).
• Communications: in-platform chat messages, support tickets and dispute evidence (screenshots, recordings) you upload.
• Technical data: IP address, user-agent string, the device type / OS / browser captured at sign-in, login timestamps and security events.
• On-platform activity: the listings you save to your wishlist and any searches you save for re-engagement notifications.

3. Why we process it (lawful bases)

We process your data for the purposes below. Where the EU or UK GDPR applies to you, these correspond to the GDPR Article 6 lawful bases shown:

• Contract: creating and operating your account, processing your orders, paying out seller balances, providing support, running disputes.
• Legal obligation: identity (KYC) and anti-money-laundering checks, sanctions screening, tax reporting, and retention of financial records under applicable law.
• Legitimate interests: fraud prevention, abuse detection, account security, product improvement and defending legal claims. We balance these against your rights and will stop the processing if you object successfully.
• Consent: any non-essential cookies (today, the only one is the optional language-preference cookie set when you actively choose an interface language — see our Cookie Policy) and any future marketing communications. You can withdraw consent at any time without affecting prior lawful processing.

4. Who we share it with

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share it only with the following recipients, and only to the extent needed for the purpose:

• Other users: your username, public profile, listings, ratings and the chat messages you send to them.
• Payment and KYC partner: our regulated payment partner (and the card networks it routes to) for processing payments and payouts, and for processing the ID image and selfie you submit as part of seller verification.
• Infrastructure providers: cloud hosting, email delivery (transactional only) and error/log processing. These vendors act as processors / service providers under written contracts.
• Authorities: we may disclose data to law enforcement, tax authorities or courts where we are legally required.
• Successors: in the event of a merger, acquisition or asset sale, where the recipient takes on the same protection obligations.

5. International data transfers

We operate from the United States and use service providers in several countries, so your personal data may be processed outside your country of residence. Where we transfer personal data from the EEA or UK, we rely on an adequacy decision where one applies, and otherwise on the EU Standard Contractual Clauses (with the UK Addendum / International Data Transfer Agreement, as applicable), together with additional technical and organizational safeguards where needed. You can request a copy of the safeguards in place by emailing [email protected].

6. How long we keep it

We keep your data only for as long as we have a lawful purpose to do so. The table below shows the minimum periods we apply; we may retain data longer where required by law or for the legitimate purposes set out in section 3.

If you want a precise retention period for a specific item of your data, email [email protected].

7. Security

• AES-256-GCM encryption at rest for seller-supplied credentials.
• TLS for all data in transit.
• Bcrypt-hashed passwords (cost factor 12).
• Secrets stored with our cloud provider; least-privilege access for staff.
• Rate limiting on authentication and other sensitive endpoints.
• Periodic review of suppliers and access controls.

8. Your rights (EEA / UK)

If you are in the EEA or the UK, the GDPR gives you the rights below; we extend most of them to all users regardless of location:

• Be informed about how we process your data (this Policy).
• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Request erasure of your data, where the legal basis no longer applies.
• Restrict processing in certain circumstances.
• Object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.
• Receive your data in a portable, machine-readable format and ask us to transmit it to another controller.
• Some platform decisions are automated, for example an automated credentials check that approves or rejects a listing. You can ask for human review of any such decision by emailing our privacy team.

To exercise any of these rights, email [email protected]. We will respond within the time the applicable law requires (one month under the GDPR) and free of charge. If you are unhappy with how we handle your data, you can complain to your local data protection authority (in the EEA or UK, your national supervisory authority).

9. Your US / California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the rights below. We honour them and extend most of them to all US users:

• The categories of personal information we collect are listed in section 2; the sources and purposes in section 3; and the categories of recipients in section 4.
• We do not "sell" your personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA.
• You have the right to know/access, delete, and correct your personal information, and to limit the use of sensitive personal information.
• You may opt out of any sale or sharing (not applicable here, because we do neither).
• We will not discriminate against you for exercising any of these rights.
• Because we do not sell or share personal information, there is no sale or sharing for an opt-out signal to stop; if we ever begin to sell or share, we will honour Global Privacy Control (GPC) browser signals as a valid opt-out request.

To exercise a right, email [email protected]. You may use an authorized agent. We will verify your request and respond within 45 days (extendable by a further 45 days with notice).

These statements reflect our current practices: we do not run analytics, advertising or cross-site tracking. If we ever begin to sell or share personal information as those terms are defined under applicable law, we will update this Policy and provide the opt-out the law requires before doing so.

Do Not Track.We do not track our users over time or across third-party websites, and we do not allow third parties to collect personal information about your activities over time and across different websites through the Platform (our payment partner's embedded checkout may set its own fraud-prevention cookies, as described in our Cookie Policy). Because there is no tracking to disable, the Platform does not respond to browser "Do Not Track" signals.

10. Cookies and similar technologies

We currently set strictly necessary cookies to keep you signed in and the Platform secure, plus a single preference cookie that remembers your chosen interface language. We do not use analytics, advertising or cross-site tracking cookies. See our Cookie Policyfor the full list. You can change your choices at any time from the "Cookie preferences" link in the footer.

11. Marketing

At present we only send transactional emails: account verification, password reset, order updates, dispute notices, security alerts, KYC outcomes and similar. We do not currently run a marketing program. If we ever do, marketing emails will be sent only after you opt in, and every such email will contain a one-click unsubscribe link.

12. Children

Zagrena is not directed to, and we do not knowingly collect data from, children under 13. If you are under 13, you may not create an account or use the Platform. A minor at least 13 years old may use the Platform only with the consent and supervision of a parent or legal guardian. If you believe a child under 13 has an account on Zagrena, contact [email protected] and we will close the account and delete the data.

13. Changes to this Policy

We will notify you of material changes by email or in-app notification at least 30 days before they take effect. The current version is always available at this URL with the "last updated" date at the top.

14. Contact

Zagrena LLC
8 The Green, Suite 23221, Dover, DE 19901, USA
Email: [email protected]