Privacy Policy

This policy applies to protoselleg.com, ProtoSell accounts, listings, previews, reports, and related support interactions. ProtoSell is the controller for personal data used to operate this service. Buyers and sellers may separately process information they exchange on WhatsApp or elsewhere; their independent processing is outside this policy.

This policy is intended to support compliance with Egypt's Personal Data Protection Law No. 151 of 2020 and Executive Regulations No. 816 of 2025, together with other mandatory law that applies to a specific user or processing activity.

ProtoSell is an early-stage service operating from Egypt. Privacy questions and rights requests can be submitted through our Support page. Account export and deletion controls are also available under Account settings.

• Account data: email, authentication provider, display name, avatar, account status, and sign-in timestamps.
• Optional academic data: an eligible academic email, verification status, and short-lived verification challenge records. The public badge does not reveal the academic email address.
• Seller and listing data: profile text, encrypted WhatsApp number, project descriptions, prices, rights attestations, uploaded packages or hardware photos, preview metadata, and file fingerprints.
• Marketplace activity: favorites, protected preview access, contact reveals, listing reports, moderation outcomes, and account changes.
• Technical and security data: request identifiers, approximate network information, device or browser details, security challenge results, error diagnostics, rate-limit records, and audit logs. We do not intentionally place passwords, message contents, private filenames, phone numbers, or package contents in analytics or application logs.
• Optional analytics: limited marketplace events and coarse properties only after you allow analytics. We disable autocapture, session replay, automatic page views, and person profiles.

• Create and secure accounts, authenticate users, and recover access.
• Publish listings and provide authorized previews and contact reveals.
• Process packages safely, generate previews, and detect malicious or exposed secret material.
• Prevent abuse, enforce policies, investigate reports, and maintain audit evidence.
• Send transactional authentication, verification, and moderation messages.
• Maintain reliability, diagnose faults, and understand aggregate marketplace use.
• Comply with lawful obligations and protect users, ProtoSell, and third parties.

Depending on the processing and applicable law, these activities rely on providing the service you request, consent, legitimate operational and security interests that do not override your rights, or compliance with legal obligations. Optional analytics relies on your choice and can be disabled at any time.

We use service providers only for defined operational purposes:

• Supabase for authentication, database, and private preview storage.
• Railway for the web application and package-processing worker.
• Backblaze B2 for private packages and Cloudflare Turnstile for abuse prevention.
• Upstash for rate limiting, Resend for transactional email, and Sentry for error monitoring.
• PostHog for optional privacy-minimized analytics after consent.
• Google when you choose Google OAuth, and WhatsApp when you choose to contact a seller.

Providers may process data in other countries under their contractual safeguards and applicable transfer requirements. We may also disclose information when legally required, to protect rights or safety, or as part of a genuine business reorganization subject to appropriate confidentiality and notice requirements. We do not sell personal data or share it for third-party behavioral advertising.

Published listing titles, descriptions, prices, tags, media, seller display names, and badge status are public and may be indexed by search engines. Seller phone numbers remain encrypted and are revealed only through the protected contact flow to an eligible signed-in user.

Once you choose to open WhatsApp, WhatsApp and the other participant control the information exchanged there. Do not send identity documents, passwords, one-time codes, unnecessary financial details, or other sensitive data through marketplace conversations.

We keep account and listing data while the account or listing remains active and as reasonably needed for the purposes above. Current operational limits include three hours for temporary hardware uploads, one day for abandoned previews and academic challenges, 30 days for processing logs, 90 days for notification logs, 180 days for contact reveal logs, and 365 days for administrator audit logs. Private package sources are scheduled for deletion after the required processing and provider-lock period. Backups may retain deleted data for a limited recovery cycle before replacement.

We may preserve specific records longer when reasonably necessary for security, fraud prevention, a legal claim, a takedown request, or a binding legal obligation. Retention does not authorize unrelated reuse.

Subject to applicable law and valid limitations, you may request access, correction, a copy, deletion, restriction, objection, or withdrawal of consent. You can update profile information, export account data, and request permanent account deletion from Account settings. Analytics preferences can be changed on the Cookies and analytics page. Withdrawal does not invalidate processing that was lawful before it.

We may need to verify that a requester controls the relevant account. If a request cannot be completed, we will explain the applicable reason where required. You may also complain to Egypt's Personal Data Protection Center or another competent authority.

ProtoSell uses access controls, row-level database policies, encryption for seller contact data, private object storage, short-lived signed URLs, malware and secret scanning, rate limits, audit logs, and monitoring. No online system is risk-free, and these measures are not a guarantee against every incident. If a qualifying breach occurs, we will investigate, contain it, and notify affected people and competent authorities as required by applicable law.

ProtoSell is not directed to children under 18. A person who lacks legal capacity to accept these terms or transact independently must use the service only with a parent or legal guardian's valid involvement and as permitted by law.

We may update this policy when the service, providers, or law changes. Material changes will receive reasonable notice, and the effective date above will be updated. We will request fresh consent where the law requires it.