Privacy Policy

Rezell is built by Lufti Labs LLC ("we," "us"). This policy explains what we collect, how we use it, and the rights you have over your data.

What We Collect

• Account information (email, authentication data)
• Item photos you upload
• Inventory data you create in the app
• Usage analytics (feature usage, crash reports, device type)

How We Use Data

We use your data to provide and improve core app functionality, communicate with you about the product, and analyze usage to prioritize features.

Communications

We may use your email address to:

• Send account-related and transactional messages (signup confirmations, security alerts, account changes)
• Send occasional product updates, new feature announcements, and founder check-ins
• Respond to questions or support requests you send us

You can opt out of non-essential emails at any time by replying to any message and asking to be removed, or by emailing privacy@luftilabs.com. Transactional and account-related messages will continue as long as your account is active.

AI Processing

When you use AI features, item photos and text are sent to third-party AI services (currently Google Gemini) to generate analysis and listings. This data is processed under the provider's API data usage policy and is not used to train their models. See Google Gemini API Terms.

Third-Party Service Providers

The following providers process data on our behalf, under their own security and privacy terms:

• Google Gemini (AI processing) — Privacy
• Supabase (database, authentication, file storage) — Privacy
• Vercel (hosting) — Privacy

These providers act as sub-processors and are contractually required to protect your data and use it only to deliver services to us.

Data Sharing

We do not sell, rent, or trade your personal information. Your data is shared only with the service providers above, solely to deliver app functionality, or when required by law (e.g., valid legal process).

Data Retention

Your data is retained until you delete your account. After deletion, personal data is removed from active systems within 30 days, and from backups within 90 days.

De-identified Data

After you delete your account, we may retain de-identified and aggregated market data (such as item categories, sale prices, and platform trends) that is not linked to your identity. This data helps us improve pricing accuracy and market insights for all users.

Data Security

We use industry-standard security measures including encrypted connections (TLS), secure authentication, and access controls. Photos and files are stored in encrypted cloud storage.

Data Breach Notification

If we discover a data breach that affects your personal information, we will notify you promptly — within 72 hours where required by law — with information about what was affected and what steps you should take.

Your Rights

Depending on where you live, you may have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Deletion — ask us to delete your account and associated personal data
• Portability — request your data in a machine-readable format
• Objection / Restriction — object to or restrict certain processing
• Withdraw consent — where we rely on consent, withdraw it at any time

To exercise any of these rights, email privacy@luftilabs.com. We will respond within 30 days.

For EU/UK users (GDPR): Our legal basis for processing is (a) performance of the contract when you use the app, (b) our legitimate interests in improving and securing the product, and (c) your consent where required (e.g., AI processing of uploaded photos). You have the right to lodge a complaint with your local data protection authority.

For California users (CCPA/CPRA): You have the right to know what personal information we collect, to delete it, to correct it, and to opt out of any sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA.

Children's Privacy

Rezell is not intended for users under 13 (or under 16 in the EU/UK, or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact privacy@luftilabs.com and we will delete it.

Account Deletion

You can request permanent account deletion at /delete-account or by emailing privacy@luftilabs.com.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes through the app or by email, and update the "Effective date" above.

Contact

Lufti Labs LLC
Portland, OR, USA
privacy@luftilabs.com