Privacy Policy

Last updated: 15 August 2026

This policy explains what personal data Veloseller collects, why, on what legal basis, who else sees it, and what you can require of us. It is written for the General Data Protection Regulation (EU) 2016/679 (“GDPR”), which applies to us because we offer the Service to people and companies in the European Union.

1. Who is responsible

The controller is Individual entrepreneur Aleksandr Andreevich Enotaev, TIN 643969557672, state registration number 311643925100010, Zelenograd, bldg. 1444, Moscow, Russian Federation. Contact for any data-protection question, including the requests described in section 7: info@veloseller.ru.

We are established outside the EU. We have not appointed a representative in the Union under Article 27 GDPR; write to us at the address above and we will answer directly. We have not appointed a Data Protection Officer, as we are not required to under Article 37.

2. What we collect

• Account data — email address, password hash (bcrypt), display name if you set one, time zone, plan.
• Inventory data you upload — SKUs, product names, stock levels, prices, cost prices, barcodes, notes, tags. This is business data; it becomes personal data only insofar as it is linked to your account.
• Integration credentials — marketplace API keys, stored encrypted, used only to fetch your own data.
• Billing records — order identifiers, amounts, dates, subscription status. We never receive or store card numbers: those are entered on the payment provider’s side.
• Technical data — IP address, browser and device type, request logs, error reports.

3. Legal bases

• Performance of a contract (Art. 6(1)(b)) — account data, inventory data, integration credentials, billing. Without them the Service cannot be provided.
• Legal obligation (Art. 6(1)(c)) — retention of accounting and tax records.
• Legitimate interests (Art. 6(1)(f)) — security, abuse prevention, error monitoring and service-related emails. We keep these to what is necessary and you can object under section 7.
• Consent (Art. 6(1)(a)) — web analytics and any marketing email. You may withdraw consent at any time; withdrawal does not affect processing already carried out.

4. Where your data is stored

Data of Veloseller.com accounts is stored on servers located in the European Union, on infrastructure rented from a hosting provider established in the EU. The database is self-hosted: we do not use a third-party managed database service for it.

Administration of that infrastructure is carried out by the controller from the Russian Federation, which is a transfer within the meaning of Chapter V GDPR — see section 5.

5. Recipients and international transfers

Russia has no adequacy decision from the European Commission. The transfer to Russia above therefore rests on the derogation named in the table, not on an adequacy finding.

We do not sell personal data and do not use it for advertising.

6. Cookies and analytics

We run no analytics on this site. No Yandex.Metrica, no Google Analytics, no session replay, no advertising trackers — nothing that watches what you do here. The only cookies we set are the ones that keep you signed in; which ones and how long each lives is set out in the Cookie Policy.

7. Your rights

Under the GDPR you may ask us to:

• access the personal data we hold about you (Art. 15);
• correct inaccurate data (Art. 16) — most of it you can edit yourself in settings;
• erase your data (Art. 17), subject to records we must keep by law;
• restrict processing (Art. 18);
• receive a copy of the data you provided, in a machine-readable format (Art. 20) — inventory data can also be exported from the dashboard at any time;
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, without affecting processing already carried out.

Write to info@veloseller.ru. We answer within one month, as required by Article 12(3); if a request is complex we may extend that by two months and will tell you why.

You also have the right to lodge a complaint with a supervisory authority in the EU member state where you live or work (Art. 77).

8. How long we keep it

• Active account — for as long as you use the Service.
• Inactive account — if you have not signed in for 12 months we email you. Your data stays intact: we do not delete the account ourselves — you can delete it in settings at any time, or ask us to.
• After deletion — removed from the live database immediately, and from backups within 30 days.
• Billing records — 7 years, as required by accounting and tax law. When you delete your account these are anonymised, not deleted: the amount, date, plan and invoice number remain, the link to you is removed. Art. 17(3)(b) exempts data we are legally obliged to keep.
• Technical logs — 90 days.

9. Security

• Traffic is encrypted in transit (TLS); integration credentials are encrypted at rest.
• Passwords are stored as bcrypt hashes and are never recoverable in plain text.
• Access to production data is limited to the controller.
• Row-level security in the database keeps each account’s data separate.

If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and, where the risk is high, notify you directly (Arts. 33–34).

10. Children

The Service is intended for business use and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Changes

We may update this policy. The current version is always published here with its date; material changes are announced by email at least 14 days in advance.

12. Contact

Any question about this policy or about your data: info@veloseller.ru.