On this page
1. Data controller
The data controller is Vrymart, Inc., a corporation organized in Delaware, USA, managed from Argentina.
- Privacy officer: the President of Vrymart, Inc., who is also the person in charge of the protection of personal information for the purposes of Quebec's Law 25 and the Data Protection Officer for the purposes of Singapore's PDPA.
- Privacy contact: privacy@vrymart.com
2. Scope
This Policy explains what personal data we process, for what purpose and on what legal basis, who we share it with, how long we keep it, and what rights you have. It applies to Buyers, Partners, Affiliates, and visitors. It also serves as the Notice at Collection for the purposes of California law.
3. What data we collect and categories (CCPA)
3.1. Data you provide
- Account: name, email, password (encrypted/hashed), country where you live (to know whether you can buy from there), language and, if you register with email, date of birth (to check that you are of age).
- Public profile (Partners/Affiliates): public name, identifier (slug), description, profile photo.
- Federated sign-in: if you register with Google, we receive your name, email, and a provider identifier.
- Order data: the information you enter in each Service's form ("input data"), which may include text, URLs, emails, and files you choose to upload.
- Disputes and support: message content and evidence files, and the emails you send us.
- Withdrawal button: the order number, email, and reason you write.
- Messages to a Partner: if you write to one from their profile, your name, email, and message.
- Reviews: the rating and comment you publish (public content).
- Legal consent: date and version of the terms you accepted (proof of acceptance).
3.2. Data generated by your use
- Security: 2FA secret and codes (encrypted), session and API tokens (protected), and "remembered device" records with IP and user agent.
- Technical and session: IP, user agent, activity date/time, and information in cookies (see Cookie Policy).
- Affiliation: campaigns, clicks, and conversions from Affiliate links.
- Logs: technical data that may include order identifiers and emails.
3.3. Payment data
Vrymart does not see or store your card details: you enter them on Stripe's payment page. We keep non-sensitive identifiers needed to operate (Stripe customer, connected account, or transaction) and the accounting record of amounts, taxes, fees, and refunds.
3.4. Identity verification (KYC) of Partners and Affiliates
Verification and the banking/tax details needed to get paid are handled directly by Stripe (Stripe Connect). Vrymart does not collect or store identity documents or bank details; it only keeps the connected-account identifier and verification status.
3.5. Categories of personal information (CCPA/CPRA)
For the purposes of California law, in the last 12 months we processed these categories: identifiers (name, email, IP, account identifiers); limited protected characteristics (date of birth, only to check age); commercial information (order and transaction history); internet activity information (usage data, logs); approximate geolocation data (the country you state and the one inferred from your IP); and limited sensitive information: login credentials (password, 2FA secret/codes). We do not use sensitive information to infer characteristics or for purposes other than providing and securing the service. We do not knowingly collect health or biometric data, or data from minors.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account | Account, authentication | Performance of a contract |
| Check the minimum age and the countries you can buy from | Date of birth, country | Performance of a contract / Legal obligation |
| Process purchases, hold payments, and refund | Order, payment, transactions | Performance of a contract |
| Transmit the order to the Partner | Buyer's name and input data (email only if entered in the form) | Performance of a contract |
| Forward to the Partner the messages you write to them | Name, email, and message | Performance of a contract / Consent |
| Release funds and pay commissions | Transaction data, Stripe account | Performance of a contract |
| Calculate and collect taxes; tax reporting | Location, amount, seller data | Legal obligation |
| Security, fraud and abuse prevention | Technical data, IP, 2FA | Legitimate interest / Legal obligation |
| Proof of acceptance of the terms | Date and version accepted | Legal obligation / Legitimate interest |
| Support, disputes, and withdrawal requests | Messages, evidence, requests | Performance of a contract / Legal obligation |
| Transactional notifications (email) | Email, preferences | Performance of a contract |
| Affiliate attribution | Cookie with the campaign | Legitimate interest |
| Legal and accounting compliance | Transactions, identifiers | Legal obligation |
When we rely on legitimate interest, we have assessed that your rights and freedoms do not override it; you may object (Section 8). We do not send marketing emails today (Section 10).
5. Who we share your data with
We do not sell or "share" (in the CPRA sense, for cross-context behavioral advertising) your personal data. We disclose it only to:
5.1. Partners (Service providers) — key point
So the Partner can provide the Service to you, we transmit to their system (via webhook to a URL the Partner controls) your name, the form input data, and any files you uploaded. We do not send your account email to the Partner's automated system; an email will only be shared if you enter it as part of the Service's form (e.g., a contact-email field). From that point, the Partner acts as an independent controller: the Vrymart→Partner relationship is a disclosure between independent controllers, not processing on our behalf. The Partner is contractually bound (see Annex I of the Partner Agreement) to process the data only for that purpose, protect it, honor your rights, and comply with the law. Do not include in the form data that is not necessary for the Service.
If you write to a Partner from their profile, we forward your name, email, and message to them by email so they can reply.
5.2. Providers that work for Vrymart
They process data on Vrymart's behalf, only to provide their service to us:
- Stripe — payments, identity verification (KYC) and payouts to Partners and Affiliates, refunds, and taxes (Stripe Tax). Stripe also processes certain data as an independent controller, for its own legal obligations (e.g., fraud and money-laundering prevention), under its privacy policy.
- Amazon Web Services (AWS) — the Platform's servers, database, and file storage, in the U.S., and delivery of transactional emails (Amazon SES).
- Google — only if you choose to sign in with Google.
- Porkbun — Vrymart's mailboxes (legal@, privacy@, and support@): if you write to us, your message is stored there.
Stripe and AWS include in their terms a data processing agreement (DPA) that applies to Vrymart; Google and Porkbun process data under their own terms and privacy policies. If we add or change a provider, we will update this list. No one else at Vrymart, other than the people who operate the Platform, accesses your data.
5.3. Authorities and legal third parties
When necessary to comply with the law, respond to valid requests, establish or defend claims, or protect rights, safety, or property.
5.4. Corporate transactions
In a merger, acquisition, or sale of assets, your data may be transferred to the successor, keeping the protections of this Policy.
6. International transfers
Vrymart, Inc. is a U.S. company managed from Argentina: your data is hosted on AWS servers in the U.S., and the Vrymart staff who need it to operate the Platform may access it from Argentina. Stripe, Google, and Porkbun may process it in the U.S. and other countries, and the Partners who receive your order data reside in the United States or Canada.
Your data may therefore be processed outside your country, under data protection laws different from yours, and be accessible to the authorities of those countries under their law. We apply the measures in this Policy wherever it is processed, and we require Partners to protect it (Annex I of the Partner Agreement). If you live in Argentina, by accepting this Policy you give your express consent to these transfers (Law 25,326, art. 12).
7. Retention periods
| Category | Period |
|---|---|
| Order deliverable files and files you upload in the purchase form | 90 days from order closure; then deleted, keeping a minimal record of the order. |
| Dispute evidence files | 1 year from the dispute's resolution (a chargeback can arrive months after the payment); the messages stay with the order record. |
| Financial and transaction data | 7 years (tax and corporate obligations; fraud prevention). |
| Withdrawal button requests | 7 years, with the order record. |
| Remembered devices (2FA) | 30 days. |
| Inactive accounts | Anonymized after 3 years of complete inactivity, unless a legal obligation requires longer retention. |
| Account and profile data | While the account is active and subject to the periods above. |
| Technical logs | As long as reasonably necessary for security and operations. |
When no longer needed, we securely delete or anonymize it.
8. Your rights
Depending on your country, you may: access your data, correct it, delete it (subject to legal limits, e.g., accounting retention), object to its use or ask us to restrict it, obtain a copy in a commonly used format, withdraw consent (without affecting prior processing), and complain to the data protection authority of your country: in Argentina, the Agency for Access to Public Information (AAIP); in Canada, the Office of the Privacy Commissioner (and, in Quebec, the Commission d'accès à l'information); in Australia, the OAIC; in New Zealand, the Privacy Commissioner; in Singapore, the PDPC.
To exercise them, write to privacy@vrymart.com. We may ask you to verify your identity, and we respond within the periods of your law; in general, within 30 days or less. In Argentina, access requests are answered within 10 calendar days and correction or deletion within 5 business days (Law 25,326, arts. 14 and 16). You can also delete your account from My account; if you have orders, services, or campaigns on record, support handles the closure, because there is data we must retain (Section 7).
Argentina. The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, under article 14, paragraph 3 of Law No. 25,326. The AGENCY FOR ACCESS TO PUBLIC INFORMATION, as the Supervisory Authority of Law No. 25,326, has the power to handle the complaints and claims filed by those whose rights are affected by non-compliance with the rules in force on personal data protection.
9. Your rights in the United States (CCPA/CPRA and other state laws)
If you reside in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with an applicable privacy law, you may have the right to:
- Know/Access the categories and specific pieces of personal information we process.
- Delete the personal information we hold about you.
- Correct inaccurate information.
- Portability (obtain a copy).
- Opt out of the "sale" or "sharing" of data and of cross-context behavioral advertising. Vrymart does not sell or share data in that sense, so no action is required, but we will honor opt-out signals.
- Limit the use of sensitive personal information (where applicable).
- Non-discrimination for exercising your rights.
How to exercise them: privacy@vrymart.com. You may use an authorized agent; we will verify your identity.
Right to appeal. If we deny your request, you may appeal by replying to that decision or writing to privacy@vrymart.com with the subject "Privacy appeal". We will respond within the applicable legal period (e.g., 45 days in several states) and, if we maintain the denial, we will tell you how to complain to your state Attorney General.
Browser privacy signals (GPC). We treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale/sharing. In practice, if your browser sends the GPC signal, we do not set the affiliate attribution cookie (see Cookie Policy).
California "Shine the Light" (Civ. Code §1798.83): we do not share personal information with third parties for their own direct marketing purposes.
10. Marketing communications
We do not send marketing emails today. If we ever do, it will be only with your consent, with an unsubscribe link in every email and Vrymart's postal address, under the CAN-SPAM Act, Canada's Anti-Spam Legislation (CASL), and equivalent rules. Transactional emails (confirmations, disputes, security) are not marketing and may be sent while you have an account.
11. Automated decisions
We do not make decisions based solely on automated processing that produce legal or similarly significant effects without human involvement. Operations such as releasing funds after inactivity or deactivating a Service after technical failures follow predefined rules; disputes are resolved by a person on the team.
12. Minors
The Platform is only for people aged 18 or over, in any role. We do not knowingly collect data from minors (including COPPA compliance for children under 13). If you believe a minor has given us data, write to privacy@vrymart.com: we will close the account and delete their data.
13. Security and breach notification
13.1. We apply reasonable technical and organizational measures: encryption of sensitive data (e.g., 2FA secrets), protected credential storage, two-factor authentication, role-based access control, and activity logs. No system is completely secure; we do not guarantee absolute security.
13.2. Breach notification. If a security breach affects your data, we will notify the authorities and the affected people when and as required by the law of your country (e.g., U.S. state laws, PIPEDA in Canada, Australia's Notifiable Data Breaches scheme, New Zealand's law, or Singapore's PDPA), without undue delay.
14. Cookies
We use cookies and similar technologies as described in the Cookie Policy.
15. Changes to this Policy
We may update it; we will publish the current version with its date and, for material changes, notify you by reasonable means.
16. Contact
Privacy and exercising your rights: privacy@vrymart.com.