Privacy Policy

Information we collect

• Account data: name, username, email address, phone number and password (stored in hashed form), and profile photo if you add one. If you sign in with Google, we receive your name, email and avatar from Google.
• Transaction data: orders, bids, bookings, wallet top-ups and balance, shipping addresses, and payment status. Card details are collected and processed directly by Stripe, our payment processor — Needo never stores your full card number.
• Seller data: store details, listings, sales, payout information and, for account verification, the information our payment partners require.
• Content you create: listings, reviews, chat messages with other users and support requests.
• Usage and device data: pages you visit, searches you run, listings you open, items you add to the cart and purchases, device and browser type, and the site you arrived from. We store a random visitor and session identifier in your browser to count visits; it carries no name or email. For these measurements your IP address is never stored in full: our server trims it to a network block and from that we keep only an approximate country, state and city.
• Error reports and technical session recordings: when something breaks we record the error, the page you were on and technical details of your browser. Our monitoring provider (Sentry) also receives your IP address, and it records a technical replay of roughly 10% of all sessions and of 100% of the sessions where an error happens. In those replays your text is masked and images and videos are blocked, but your clicks, the layout of the screens and the pages you go through are recorded.
• Notification tokens: if you enable push notifications we store a device token (Firebase Cloud Messaging) to deliver them.

How we use your information

• Provide the marketplace: accounts, listings, orders, auctions, service bookings, wallet, chat and notifications.
• Process payments, prevent fraud and secure the platform.
• Connect buyers and sellers: when you buy, the seller receives the information needed to fulfil your order (name, shipping address, contact for the order).
• Customer support and dispute resolution.
• Send transactional communications (order updates, auction results, receipts) and, only with your consent, marketing communications.
• For sellers who purchase promotion campaigns: create and measure advertising on platforms such as Google, Meta or TikTok. Campaign advertising uses the seller’s listing content, not buyers’ personal data.
• Comply with legal obligations (tax, accounting, law enforcement requests).

Who we share information with

We do not sell your personal information. We share it only with:

• Stripe (payment processing and fraud prevention).
• Infrastructure providers that host the platform and its data: Supabase (database, authentication, storage), Fly.io (hosting) and Google Firebase (push notifications).
• Resend (transactional email delivery).
• Sentry (error and performance monitoring): receives error reports, the paths you navigate through, your IP address and the technical session recordings described above.
• Cloudflare, which checks from your browser that whoever signs in, signs up or resets a password is a person and not a bot. It receives your IP address and technical signals from your browser.
• Address services, to autocomplete and verify shipping addresses: Google Places (when you use the address search) and the public U.S. Census Bureau geocoder (to check that a manually typed address really exists). These lookups leave from our servers and carry only the address text — not your name, not your IP, not your account data.
• geojs.io, to know which state or city Needo is being used from: it receives the trimmed network block, never your full IP address or your identity.
• Sellers and suppliers, strictly to fulfil your orders (e.g. name and shipping address passed to the seller or their fulfilment partner).
• Advertising platforms (Google, Meta, TikTok) when a seller runs a promotion campaign — limited to campaign content and aggregate performance data.
• Authorities, when required by law or to protect the rights and safety of Needo and its users.

Google appears three times on this list for three different reasons: Firebase for push notifications, Places for shipping addresses, and its advertising platforms for seller campaigns.

Cookies and similar technologies

Needo uses a small number of cookies and browser storage, in three groups:

• Essential: keeping your session open (authentication), your cart, security and fraud prevention (including cookies set by Stripe during checkout and by Cloudflare when it checks you are not a bot as you sign in or sign up). The platform cannot work without these.
• Preferences: remembering your language, theme and similar settings.
• Measurement and diagnostics: a random visitor and session identifier stored in your browser, which we use to count visits and page views, plus the browser storage our monitoring provider uses to group the errors and the technical recording of one same session.

We do not use third-party advertising cookies on needo.shop.

The first time you visit we ask you about measurement, and until you answer we do not measure anything. If you choose "essential only", we keep your session, cart and preferences working and nothing is sent to our analytics. You can change your mind whenever you like from "Cookie preferences" at the bottom of any page.

You can also delete or block cookies in your browser settings; blocking essential cookies may prevent you from signing in or completing purchases.

Data retention

We keep your data while your account is active. Detailed usage measurements are deleted after 90 days; all that survives them is aggregate daily totals, which identify no one.

When an account is deleted we delete the profile and, with it and in cascade, everything attached to it: listings, orders, bids, reviews, chat messages, saved addresses and wallet movements. The deletion is permanent and cannot be undone. Two things do survive it, because they are accounting evidence of a dispute over money: the claims you took part in (with their internal identifier, amounts, messages and any photos submitted) and any card refund orders. We keep them to be able to prove what was decided and why.

Before deleting an account we check that it has no balance, no frozen funds and no withdrawals in the queue.

If you are a seller, note that deleting your account also deletes the orders other people placed with you, and those buyers lose that history.

Card payments are processed by Stripe, which keeps its own records of the charge under its own policies and the law that applies to it; those records do not depend on your Needo account existing.

Security

All traffic is encrypted with HTTPS/TLS. Access to personal data is restricted through row-level security and role-based permissions, payments are handled by PCI-DSS compliant processors, and passwords are stored hashed. No system is 100% secure, but we review and improve our security controls continuously.

Your rights and choices

You can access and update your profile data from your account. In addition, you may request from us:

• A copy of the personal data we hold about you.
• Correction of inaccurate data.
• Deletion of your account and personal data, with the limits explained under "Data retention".
• To opt out of marketing communications at any time (transactional messages about your orders will still be sent).

To exercise these rights, write to support@needo.shop from your account email. Residents of states with consumer privacy laws (e.g. California) may exercise the rights those laws grant through the same channel; we do not discriminate for exercising them.

Minors

Needo is intended for adults aged 18 or over. We do not knowingly collect data from minors; if we become aware of such data we will delete it.

Changes to this policy

We may update this Privacy Policy. Material changes will be announced on the platform and the "Last updated" date will be revised.

Contact

Needo Technologies · Miami, Florida, United States · support@needo.shop.