Privacy Policy

1. Who we are

Playfultech, Lda ("Playfultech", "we", "us", "our") is a company registered in Portugal and the operator of the Pierre Le Duck mobile application and website at pierreleduck.app (collectively, the "Service").

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Portuguese Data Protection Act (Lei n.º 58/2019), Playfultech, Lda is the data controller of the personal data processed through the Service.

Registered office: Rua Dr Eduardo Santos Silva 162, Fração AM, 4200-283 Porto, Portugal

VAT / NIPC: PT 518555119

Contact: [email protected]

Parent company privacy notice: playfultech.io/privacy

2. Scope of this policy

This policy applies to the Pierre Le Duck app, the pierreleduck.app website, and any related features such as public seller storefronts and shareable cards. It does not apply to third-party marketplaces (such as Vinted, Depop, eBay, Wallapop, and similar) that you may choose to list on after using Pierre. Those platforms have their own privacy policies, which we strongly recommend reading even though they are usually less charming than this one.

3. What we collect, and why

Pierre is built around a simple promise: take a photo, get a resale valuation. To make that work, we process a small amount of data. Here is the complete list.

3.1 Information you give us

• Account information. When you create an account, we collect your email address, a display na. If you sign in via Apple or Google, we receive the basic identifiers those providers share with us.
• Photos and item details. When you scan an item, you upload one or more photos and may add notes, brand, condition, or category information. These are the inputs Pierre needs to estimate value.
• Listings and storefront content. If you save items to your archive or publish them to a public storefront, we store the listing details, prices, links, and visibility settings you choose.
• Communications. If you email us, fill in a feedback form, or contact support, we keep that correspondence so we can actually help you.

3.2 Information we collect automatically

• Device and usage data. App version, operating system, device model, language, time zone, crash reports, and basic usage events (for example: "scan started", "valuation completed"). This is how we know whether the app is working, not what you're scanning.
• Approximate location. Derived from your IP address, used for regional pricing context and platform recommendations. We do not collect precise GPS location.
• Cookies and similar technologies. On our website only, we use a small number of cookies for essential functionality, and — only with your consent — analytics and advertising. See Section 9.

3.3 What we do not collect

We do not collect payment card numbers, government IDs, health data, biometric identifiers, or contacts from your phone.

4. How the AI part works

When you scan an item, your photo and any notes are sent to our valuation system, which uses a combination of in-house models and third-party AI providers to identify the item, assess its condition, and estimate a resale price. Here is what that means for your data:

• Photos are processed to generate a valuation and are stored in your account so you can return to them later. You can delete any scan at any time.
• We do not allow third-party AI providers to train their models on your content. Our AI providers operate under contracts that prohibit training on customer inputs.
• We may use your content to improve our own valuation models, including reviewing scans, valuations, and outcomes to make Pierre more accurate over time. Where we do this, we apply technical and organisational measures to protect your data, and we de-identify content wherever possible.
• Valuations are estimates, not guarantees. Pierre is opinionated but not omniscient. Actual resale prices depend on the market, your listing, and luck.

5. Legal bases for processing (GDPR)

Under the GDPR, we must have a legal basis for every type of processing. Ours are:

• Performance of a contract (Art. 6(1)(b)): processing your account data, scans, and listings so we can actually provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): improving the app and our valuation models, securing the Service against fraud and abuse, and analysing aggregated usage. We balance these interests against your rights and you can object at any time.
• Consent (Art. 6(1)(a)): optional marketing emails, certain analytics cookies, and any feature we introduce that asks for explicit opt-in. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): keeping records required by tax, accounting, or other applicable law.

6. Who we share data with

We do not sell your personal data. We share it only with the following categories of recipients, and only as needed:

• Cloud and infrastructure providers that host our database, storage, and servers (Firebase / Google Cloud).
• AI and machine learning providers that help generate valuations from your photos, under contracts that prohibit training on your content.
• Analytics and crash reporting tools that help us understand product performance.
• Email and communication providers (Klaviyo) for transactional and, where you've opted in, marketing emails.
• Professional advisors such as lawyers, specialists and accountants when strictly necessary.
• Authorities if we are legally required to disclose data under a valid court order or equivalent legal process.

Each provider acts as a data processor under a written agreement and may only process your data on our instructions.

7. International data transfers

Some of our providers are based outside the European Economic Area, including in the United States. When personal data leaves the EEA, we rely on the safeguards permitted by the GDPR, primarily the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions (such as the EU–US Data Privacy Framework). You can request a copy of the relevant safeguards by emailing us.

8. How long we keep your data

• Account data is kept for as long as your account is active.
• Scans, listings, and storefront content are kept until you delete them or close your account.
• Anonymised, aggregated data may be kept indefinitely because it no longer identifies you.
• Support correspondence is kept for up to 3 years after the matter is closed.
• Accounting and tax records are kept for the period required by Portuguese law (currently 10 years).

When you delete your account, we erase or anonymise your personal data within 30 days, except where law requires longer retention.

9. Cookies and tracking

The Pierre Le Duck mobile app does not use cookies. On the pierreleduck.app website, we use:

• Strictly necessary cookies for security, session management, and the site to function. These are always on.
• Analytics cookies to understand how visitors use the site. Provided by Google Analytics 4 (Google Ireland Limited). These run only with your consent.
• Personalization and advertising cookies to tailor what you see and measure our campaigns. Provided by Google Ads (Google Ireland Limited), including remarketing audience signals. These run only with your consent.

The cookies set once you consent to analytics are:

• _ga — distinguishes one visitor from another so we can count unique visits. Expires about 13 months after your last visit.
• _ga_B16SKEQ2XF — keeps the state of your visit for Google Analytics 4. Expires about 13 months after your last visit.

Nothing beyond the strictly necessary cookies loads until you choose. Until you consent, Google's consent signals stay denied and no analytics or advertising script is loaded at all. You can change or withdraw your choice at any time using the Cookies link in the site footer, which reopens the preferences panel. Switching a category off deletes the cookies it set.

10. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct anything inaccurate or incomplete.
• Erasure — ask us to delete your data ("right to be forgotten"), subject to legal retention requirements.
• Restriction — ask us to pause processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint — with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or your local supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask you to verify your identity first, because handing over your data to the wrong duck would defeat the point.

11. Security

We use industry-standard technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), encryption at rest where supported by our providers, access controls, and regular review of who can see what. No system is perfectly secure, and we won't pretend otherwise. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the CNPD within 72 hours and, where required, notify you directly.

12. Children

Pierre Le Duck is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Public storefronts and shared content

If you choose to publish a storefront or share a listing card, the information you make public (display name, profile photo, item photos, titles, descriptions, prices, and outbound links) becomes visible to anyone with the link. You decide what to make public, and you can unpublish or delete it at any time. Please do not put anything in your public storefront that you would not want a stranger, a former colleague, or your mother to see.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you through the app or by email before they take effect. The "Effective date" at the top of this policy will always reflect the latest version.

15. Contact us

Questions, requests, complaints, or compliments:

Playfultech, Lda
Rua Dr Eduardo Santos Silva 162, Fração AM
4200-283 Porto, Portugal
VAT / NIPC: PT 518555119
Email: [email protected]
Website: pierreleduck.app