Privacy Policy

The data controller is the Pass it team. You can reach us at hello@passitdanang.com for any privacy question, request or complaint.

• Account data: email, phone number, display name, avatar, language preference.
• Listing data: titles, descriptions, prices, photos, category, neighbourhood, condition.
• Messages: chat content exchanged with other users.
• Usage data: approximate location (neighbourhood you pick), device type, browser, pages visited, error logs.
• Verification data: phone verification status; ID checks if you opt in to verified seller status.

• Contract: to run your account, host your listings, and enable buyers and sellers to message each other.
• Legitimate interest: to prevent fraud, moderate content, keep the marketplace safe, and improve the product.
• Consent: for marketing emails (weekly digest), and for optional cookies. You can withdraw consent at any time.
• Legal obligation: to respond to lawful requests from authorities.

We share the minimum data needed with vetted providers who act as processors on our behalf:

• Supabase (database, authentication, file storage) — hosted in the EU.
• Twilio (SMS phone verification).
• Sightengine (automated image moderation to detect unsafe photos).
• Google (Google Sign-In, optional).
• Cloudflare (CDN, DDoS protection, edge runtime).

We never sell your data. We do not share it with advertisers.

• Right of access — request a copy of your data (available in-app via Profile → Download my data).
• Right to rectification — edit your profile and listings at any time.
• Right to erasure — delete your account from Profile, or email us.
• Right to restriction — pause your account from Profile.
• Right to data portability — your export is provided in machine-readable JSON.
• Right to object — opt out of marketing emails in one click.
• Right to lodge a complaint with your local data protection authority.

To exercise any right, email hello@passitdanang.com. We respond within 30 days.

We keep account data while your account is active. After deletion, listings and profile data are removed within 30 days. Messages are kept for up to 12 months to support dispute resolution, then anonymised. Backups are rotated within 90 days.

Pass it primarily stores data on EU servers. Some processors (e.g. Google, Cloudflare, Twilio) may process data outside the EU. We rely on Standard Contractual Clauses and equivalent safeguards approved by the European Commission for these transfers.

We use a small set of strictly necessary cookies to keep you signed in and remember your language. We do not use advertising cookies. If we add analytics, we will ask for consent first via the cookie notice.

Pass it is for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.

We protect your data with TLS in transit, encryption at rest, row-level security in the database, strict access controls, and Content Security Policy headers. No system is perfect — please use a strong, unique password.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by Articles 33 and 34 of the GDPR.

We may update this policy. Material changes will be announced in-app and via email at least 14 days before they take effect.

Questions, requests, or complaints: hello@passitdanang.com.