Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

Coyl SIA
Brīvības iela 1, Rīga, LV-1010, Latvia
Registration No. 40203 456789
Contact: the contact form

2. Data we collect

We collect personal data that you provide directly, data generated through your use of the Platform, and limited data from third parties (such as our authentication provider).

Category	Examples
Account & profile data	Name, email address, profile photo, account type (private/business), address, phone number, display currency
Listing data	Device brand, model, configuration, condition, battery health, photographs, description, price
Coyl scan reports	When you scan a laptop with the Coyl app: its hardware (processor, graphics, memory, storage, screen, ports), battery and drive health, keyboard layout, Windows edition, and whether the laptop is managed by an organisation. The serial number is never uploaded, only a one-way hash of it that can't be turned back into the number. The organisation's name is never shown on a listing.
Order & transaction data	Items bought or sold, the shipping address and phone number given at checkout, carrier and tracking number, order status, seller fee and payout figures
Disputes & reviews	Problem reports with their photos, Coyl's decision, and the ratings and answers buyers give about sellers. Reviews are public: they show on the seller's listings and profile with the buyer's first name and the date
Payment data	Masked payment reference only (e.g. last 4 digits). Full card numbers are never collected or stored by Coyl.
Device requests	The device you asked us to add under "Can't find your model?", the category you had chosen and the email address you gave for our reply
App statistics	A record of each click on the Coyl app download link, and of each finished scan in the app, with the app version. Download clicks carry a random browser ID if you allowed Statistics in the cookie settings, and your account ID if you're signed in; scans carry a random ID the app creates when it's installed. Nothing about the laptop is part of these counts.
Communications	Emails we send you about orders, notes from Coyl staff about a listing, and anything you write to us
Contact messages	What you send through the contact page: your email address, your name if you give it, the topic and your message, and your account ID if you're signed in
Technical data	IP address, browser type and log data processed by our hosting providers, and the browser storage described in §9

3. How we use your data

To create and administer your account and authenticate you when you sign in;
To publish and display listings, and to facilitate purchases between buyers and sellers;
To operate our simulated escrow flow, calculate seller fees and payouts, and manage order status;
To communicate with you about your account, orders, and changes to our Platform or policies;
To check a parcel's delivery status from its tracking number, so the buyer's 72-hour check can start;
To review disputes and decide whether a buyer is refunded;
To fill a laptop listing in from its Coyl scan, so buyers see the measured specifications;
To review device requests and reply to the people who sent them;
To answer messages sent through the contact page;
To count downloads and scans of the Coyl app;
To detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service;
To comply with legal obligations, including tax, accounting, and consumer protection law; and
To improve and secure the Platform.

4. Legal bases for processing

Depending on the purpose, we rely on one or more of the following legal bases under Article 6 GDPR:

Performance of a contract (Art. 6(1)(b)): to provide the Platform, process listings and scan reports, facilitate orders, and answer device requests;
Legitimate interests (Art. 6(1)(f)): to secure the Platform, prevent fraud, decide disputes, and count app downloads and scans to improve our services, balanced against your rights and interests;
Legal obligation (Art. 6(1)(c)): to comply with accounting, tax, and regulatory requirements; and
Consent (Art. 6(1)(a)): for the optional browser storage in the cookie settings (Preferences, Statistics and External media), which you may withdraw at any time.

5. Who we share data with

We do not sell your personal data. We share personal data only with:

Other users, to the extent necessary to complete a transaction: a seller's display name, location, ratings and listing are visible to buyers, and when you buy, the seller receives your name, shipping address and phone number so they can send the item;
Infrastructure and processors engaged to operate the Platform on our behalf, under data processing agreements consistent with Art. 28 GDPR:
- Supabase Inc., our database, authentication and file storage provider;
- Resend, which delivers the emails we send you;
- Ship24, which receives an order's carrier and tracking number so we can see when the parcel is delivered;
- GitHub, which hosts the website's pages;
Services your browser contacts directly: Google, if you sign in with Google, and for the fonts the pages use; YouTube, only when you play a review video; and the Frankfurter exchange-rate service. Each sees your IP address when your browser loads from it;
Professional advisers and authorities, where required by law, court order, or to protect our legal rights.

Payments are currently simulated. No live payment processor is integrated at this time; once real payments are enabled, this section will be updated to name the payment processor and describe how card data is handled. Coyl itself will never store full card numbers.

6. International transfers

Where personal data is transferred outside the European Economic Area ("EEA"), we ensure an adequate level of protection through mechanisms recognised under GDPR, such as the European Commission's Standard Contractual Clauses, or by relying on a provider's adequacy decision. You may request a copy of the relevant safeguards by contacting us at the address in §13.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including to satisfy legal, accounting, or reporting obligations. As a general rule:

Account data is retained for the life of your account and deleted upon account closure, subject to §7.1;
Transaction records are retained for up to 10 years to comply with applicable accounting and tax law;
Listing photographs and Coyl scan reports are retained for as long as the associated listing remains published, plus a reasonable period thereafter for dispute-resolution purposes. A scan's listing code stops working after 15 minutes unless you've used it for a listing;
Dispute reports and their photos are kept with the order record;
Device requests are kept so we can reply and see which devices people want, and are deleted on request;
Contact messages are kept so we can answer and follow up, and are deleted on request;
App download and scan records are kept to compile our statistics.

7.1 Account deletion

When you delete your account, your authentication credentials and profile are permanently removed. Records relating to completed transactions may be retained in anonymised or aggregated form as required by law.

8. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

Access the personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase your personal data ("right to be forgotten");
Restrict or object to certain processing;
Data portability, i.e. to receive your data in a structured, commonly used, machine-readable format;
Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and
Lodge a complaint with a supervisory authority: in Latvia, the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv.

Many of these rights can be exercised directly from your account settings. For anything else, contact us using the details in §13.

9. Cookies

We use browser storage (local and session storage) that the Platform needs: to keep you signed in, remember your cart and your cookie choice, and keep a listing while you sign in with Google. Everything else is optional and only stored after you say yes in the cookie banner or the cookie settings: Preferences (your display currency and cached exchange rates), Statistics (a random ID for counting app downloads) and External media (YouTube review videos). You can change your choice at any time with the "Cookie settings" link at the bottom of every page. Every item is listed in our Cookie Policy.

10. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption in transit, access controls, and row-level security policies on our database. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Children's privacy

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. We will indicate the "Last updated" date at the top of this page and, where changes are material, provide additional notice.