Privacy Policy

1 Introduction

Welcome to BuyNSell (“we,” “our,” or “us”). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our e-commerce marketplace platform, mobile applications, and related services (collectively, the “Service”).

By accessing or using our Service, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access or use our Service.

2 Information We Collect

2.1 Information You Provide Directly

• Account Information: When you register an account, we collect your name, email address, phone number, and password.
• Profile Information: Additional details you choose to provide such as profile picture, business name, store description, and location.
• Listing Information: Product descriptions, images, pricing, and other details you provide when creating listings.
• Communications: Messages, inquiries, and correspondence you send through our platform or to our support team.

2.2 Information from Third-Party Authentication

When you sign in using a third-party service, we may collect information provided by that service:

• Google (Gmail) Login: Your name, email address, profile picture, and Google account identifier. We use Google’s OAuth 2.0 protocol for secure authentication and do not store your Google password.
• Apple Login: Your name (if you choose to share it), email address (or Apple’s private relay email), and Apple account identifier. Apple may provide a private relay email to protect your real email address, which we respect and support.

2.3 Information from Social Media Integrations

If you connect your store with social media platforms for automatic posting, we collect:

• Facebook Integration: Your Facebook Page ID, Page name, and Page access tokens. We use the Meta Graph API to publish product listings on your behalf to your connected Facebook Page. We do not access your personal Facebook profile, private messages, or friend lists.
• Instagram Integration: Your Instagram Business Account ID linked to your Facebook Page. We use the Instagram Graph API to automatically create posts for your product listings. We do not access your personal Instagram account, direct messages, or follower data beyond what is necessary for publishing.

2.4 Information Collected Automatically

• Device Information: Browser type, operating system, device type, and unique device identifiers.
• Usage Data: Pages visited, features used, search queries, time spent on pages, and interaction patterns.
• Location Data: Approximate geographic location based on IP address or region selection to provide localised marketplace experiences.
• Cookies and Similar Technologies: We use cookies, local storage, and similar technologies for session management, preferences (such as dark/light mode and region selection), and analytics.

3 How We Use Your Information

We use the information we collect for the following purposes:

• Account Management: To create and manage your account, authenticate your identity, and provide customer support.
• Marketplace Operations: To display your listings, facilitate communications between buyers and sellers, and operate the marketplace.
• Social Media Publishing: To automatically post your product listings to your connected Facebook Page and/or Instagram Business Account when you enable this feature.
• Personalisation: To customise your experience based on your preferences, location, and browsing activity.
• Communications: To send you service-related notices, updates, security alerts, and promotional messages (with your consent where required).
• Safety and Security: To detect, prevent, and address fraud, abuse, security issues, and technical problems.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Analytics and Improvement: To analyse usage patterns, measure performance, and improve our Service.

4 Payments & Financial Information

BuyNSell is a listing and marketplace platform. We do not process, store, or handle on-site payments or financial transactions between buyers and sellers. All payment arrangements are made directly between the buyer and seller outside of our platform.

For any subscription or premium service fees, payments are processed by secure third-party payment processors. We do not store your credit card numbers, bank account details, or other sensitive financial information on our servers. Please refer to the respective payment processor’s privacy policy for information on how they handle your financial data.

5 Third-Party Services & Data Sharing

5.1 Authentication Providers

• Google: We use Google’s OAuth 2.0 for sign-in. Google’s privacy policy applies to the data Google collects. Visit Google’s Privacy Policy.
• Apple: We use Sign in with Apple for authentication. Apple’s privacy policy governs the data Apple collects. Visit Apple’s Privacy Policy.

5.2 Social Media Platforms (Meta)

• Facebook & Instagram: When you connect your store, we interact with the Meta Graph API and Instagram Graph API using access tokens you authorise. We only request permissions necessary for publishing content (e.g., pages_manage_posts, instagram_basic, instagram_content_publish). We do not sell or share your Meta data with any other third parties. Visit Meta’s Privacy Policy.

5.3 Other Third Parties

We may share your information with:

• Service Providers: Hosting, email delivery, analytics, and customer support providers who process data on our behalf under strict data protection agreements.
• Legal Authorities: When required by law, subpoena, court order, or governmental regulation, or to protect rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.

We do not sell your personal information to third parties.

6 Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Service. We may also retain certain information as required by law, to resolve disputes, enforce agreements, or for legitimate business purposes.

• Account Data: Retained until you delete your account or request deletion.
• Listing Data: Retained for the duration your listing is active and for a reasonable period thereafter for record-keeping.
• Social Media Tokens: Meta (Facebook/Instagram) access tokens are retained only while the integration is active. Tokens are deleted when you disconnect the integration.
• Log Data: Automatically collected usage data is typically retained for up to 12 months.

7 Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption of data in transit using TLS/SSL protocols.
• Encryption of sensitive data at rest (e.g., access tokens, passwords).
• Regular security assessments and vulnerability monitoring.
• Access controls and authentication for internal systems.
• Secure OAuth 2.0 token handling for all third-party integrations.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining the highest reasonable standard.

8 Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain legal exceptions.
• Portability: Request your data in a structured, commonly used, and machine-readable format.
• Withdrawal of Consent: Withdraw consent for data processing where consent is the legal basis.
• Objection: Object to processing of your personal information for certain purposes.

Managing Social Media Connections

You can disconnect your Facebook and/or Instagram integration at any time through your store settings. Upon disconnection:

• We immediately delete your stored Meta access tokens.
• We stop all automatic posting to your social media accounts.
• Previously published posts remain on your social media pages (managed by you directly on those platforms).

Managing Authentication

You can unlink your Google or Apple login at any time from your account settings. You may also revoke our access through your Google Account permissions or Apple ID settings.

9 Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for basic platform functionality, including session management, CSRF protection, and authentication.
• Preference Cookies: Store your preferences such as dark/light theme mode and selected region.
• Analytics Cookies: Help us understand how visitors interact with our platform to improve user experience.

You can control cookie preferences through your browser settings. Note that disabling essential cookies may affect the functionality of the Service.

10 Children’s Privacy

Our Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately so we can take appropriate action to delete such information.

11 International Data Transfers

Your information may be transferred to and processed in countries other than the Maldives. When we use third-party services (such as Google, Apple, or Meta), your data may be processed in accordance with those providers’ data processing practices. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

12 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised “Last updated” date. For significant changes, we may also notify you via email or a prominent notice on our Service.

Your continued use of the Service after changes are posted constitutes your acceptance of the revised Privacy Policy.

13 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: