Privacy Policy

Last updated: 6 November 2026

The data controller is the owner of stuff.market, a sole proprietor based in Cyprus, support@stuff.market. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Users of the site and the bot

When you press Start in our bot, Telegram shares only public details with us: your name, username, photo and numeric ID. We have no access to your account, messages or contacts. We use these details and your subscriptions to recognise you on the site and send notifications (legal basis: performance of a contract, Art. 6(1)(b) GDPR).

2. Payments

Payments are processed by Stripe. Card details are entered on Stripe's side and we never see them. We receive your Stripe customer ID, your email if you provide it, and the amount, status and date of payments. We keep payment records for as long as Cyprus tax law requires (legal bases: contract and legal obligation, Art. 6(1)(b) and (c)).

3. Listings from Telegram

We show listings that their authors themselves published in public Telegram groups: text, photos, the author's Telegram name and username, and a link to the original message. The purpose is to help buyers find these items (legal basis: legitimate interest, Art. 6(1)(f)). We regularly re-check the groups: listings deleted there are hidden on the site and edits are picked up.

If you are the author of a listing and do not want your listings on the site, send the command /hide to the bot @StuffMarketApp: we will immediately delete all listings posted from your Telegram account and stop showing new ones. To undo, send /show. You can also email support@stuff.market with a link to the listing.

4. Technical data and cookies

We use only strictly necessary cookies: cs_session (sign-in, 30 days) and cs_pending (unfinished sign-in, 15 minutes). There are no advertising or analytics cookies. Your IP address is used to protect the site from overload and scraping and appears in the hosting provider's technical logs, which are kept for a limited time.

5. Who receives data

Only providers the service cannot work without: hosting and data storage, Telegram for sign-in and notifications, a payment processor and an AI service that analyses listings (it receives listing content only). Some of them are located outside the EU; such transfers rely on the safeguards provided for by the GDPR. We do not sell personal data.

6. Retention

We keep account data and subscriptions while you use the service or until you ask us to delete them. Listings are shown while they exist in Telegram; on request we delete them completely.

7. Your rights

You can request access to your data, rectification, erasure, restriction of processing and data portability, and you can object to processing. Email support@stuff.market and we will respond within one month. You also have the right to complain to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or to the supervisory authority in your country.

8. Changes

We publish new versions of this policy on this page with the date of the update.