QYRONY Privacy Policy
Version: 1.1.0 Last updated: 22 September 2026 Effective from: 31 March 2025
This Privacy Policy explains how QYRONY (“we”, “us”, “our”) processes Personal Data when you use the QYRONY Hub platform under applicable data-protection laws.
1. Who we are and how to contact us
1.1. Data controller
For the core platform services (account, listings, orders, payments, wallet, support), the data controller is:
Qyrony LLC (trading as Qyrony)
A limited liability company registered in Wyoming, United States. Wyoming Entity ID 2025-001646695, Wyoming Secretary of State.
312 W 2nd St, Unit #A794, Casper, WY 82601, United States
Website: qyrony.com
Email:
contact@qyrony.comTelephone: +1 (303) 591-7075
1.2. Joint controllers (channels)
When a User or Vendor hosts a Channel that aggregates content and interactions, they are responsible for the content they publish and for complying with any privacy obligations that apply to their own activity.
1.3. Privacy contact
Email:
contact@qyrony.com
Contact us at this address with any question about this Policy, your rights, or our processing, and to exercise any of the rights described in section 8.
2. Personal data we collect
We collect Personal Data directly from you, automatically from your device, and from third parties. The principal categories are summarised below.
For approximate catalogue prices, we use a country hint from our hosting edge or estimate the connection’s country using a database held on our server. This lookup does not send your IP address to an external geolocation provider or save a location profile. VPNs and travel may change the displayed currency. This is not verification of residence and does not change wallet balances, checkout currency, tax evidence or identity requirements. Where a local quote is unavailable, we show the product’s original currency. This limited display personalisation serves our legitimate interest in making prices understandable; you may contact us to object to this processing.
| Category | Examples | Source |
|---|---|---|
| Identity & account | name, display name, email, phone, profile photo, language, time zone, hashed password | You (registration, profile, vendor verification) |
| KYC & vendor verification | verification status and requirements, provider account identifier, and information required for your country and seller type. Identity documents and payout details are entered in the payment provider’s hosted flow where available | You, payment and verification providers |
| Authentication & security | hashed passwords, sign-in token metadata, short-lived sign-in state for social login, login timestamps, IP address, security-event logs | You (login), automatically |
| Transaction & wallet | order history, invoices, refunds, dispute records, separate top-up and seller-earnings balances, payment-provider identifiers, and masked method details returned by the provider. PAN, CVV, full bank details, and raw identity documents are not stored by QYRONY through the normal hosted flow | You, payment processors |
| Listings & content | product data, images, descriptions, prices, auction bids, reviews, channel posts, messages, support tickets | You |
| Behavioural & usage | pages viewed, search queries, click events required for product functions, referrer, and items added to cart or watched | Automatically through application requests and necessary storage (see §5) |
| Device & connection | IP address, user agent, OS, language, screen size, and security-event metadata | Automatically |
| Marketing | email engagement, in-app notifications, marketing preferences, attribution data for our own ads | You, automatically |
| Customer support | support messages and attachments you choose to provide | You |
| Public third-party data | sanctions and PEP lists, public company registries | Third parties |
We do not intentionally request Special Categories of Data (Article 9 GDPR) for ordinary Platform use. Do not place such information in public Listings, posts, or messages. If we encounter it, we may restrict access, delete it, or request a lawful basis appropriate to the specific purpose rather than relying on this Policy as blanket consent.
3. Why we use your data (purposes and lawful bases)
GDPR requires us to have a lawful basis for each processing activity. The table below sets out the purposes for which we process Personal Data and the corresponding legal ground under Article 6(1) GDPR. Legitimate interests are balanced against your rights and freedoms at the time of the legitimate-interest assessment (LIA); you can request a copy of any LIA.
| # | Purpose | Lawful basis (Art. 6 GDPR) | Categories of data |
|---|---|---|---|
| 1 | Provide the Platform, including account creation, login, listings, auctions, channels, and messaging | (b) Performance of a contract | Identity, authentication, listings, content, device |
| 2 | Process payments, manage the Wallet, issue refunds, prevent fraud | (b) Contract, (c) Legal obligation (tax, AML), (f) Legitimate interests (fraud prevention) | Transaction, KYC, device, behaviour |
| 3 | Vendor verification (KYC, sanctions screening) | (c) Legal obligation (AML, sanctions), (b) Contract | KYC, identity |
| 4 | Digital delivery, local-listing communication, refunds, disputes, and customer support | (b) Contract | Identity, transaction, content, support |
| 5 | Safety, security, fraud and abuse prevention, dispute resolution | (f) Legitimate interests (security of service and Users) | All categories; specifically authentication, device, behaviour, transaction |
| 6 | Product analytics and improvement, A/B testing, debugging | (f) Legitimate interests, (a) Consent for non-essential cookies | Behaviour, device |
| 7 | Personalisation of search, recommendations, and homepage | (f) Legitimate interests (within the strict necessity test), with right to opt out | Behaviour, listings, content |
| 8 | Marketing communications (email, push, in-app) | (a) Consent (Article 7 + ePrivacy), or (f) for existing customers with right to opt out | Identity, behaviour |
| 9 | Consent-based first-party product-view measurement; optional advertising only if introduced in the future | (a) Consent obtained before the optional technology is activated | Behaviour and device data described at consent time |
| 10 | Tax accounting, financial reporting, regulatory record-keeping | (c) Legal obligation | Transaction, KYC |
| 11 | Comply with law enforcement and lawful government requests | (c) Legal obligation | All categories, as required by the request |
| 12 | Establish, exercise, defend legal claims | (f) Legitimate interests | All relevant categories |
| 13 | Reorganisations, M&A, asset sales | (f) Legitimate interests, (a) Consent for material changes | All categories, as transferred |
Automated decision-making and profiling (Art. 22). We use automated systems to: (a) detect fraud and abuse (with human review for adverse effects); (b) rank search and recommendations; (c) decide whether a Listing complies with the Acceptable Use Policy (with a human review on objection); (d) decide initial eligibility for promotional credit (with the right to contest). We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (such as refusing service, without human review), unless required or authorised by law (e.g. sanctions screening).
4. Who we share your data with
We do not sell Personal Data. We share data only as set out below.
4.1. Other Users
- Buyers see the Vendor’s public profile and Listing details.
- Vendors see the Buyer’s identity and messages needed for an eligible digital order. For local physical coordination, each participant sees only public profile information and details the other participant voluntarily shares in private chat.
- Channel members see the content the host publishes and may see your public profile if you post.
4.2. Service providers (processors)
We engage carefully vetted processors under Article 28 GDPR contracts. The current sub-processors include cloud infrastructure, payment processors, KYC/sanctions providers, and customer support tooling. Changes are notified at least 30 days in advance.
Categories include cloud hosting, database and object storage, payment processing, email delivery, content moderation, AI model gateways, and security tooling. We publish provider names only after confirming the active production service and the disclosure is useful to customers.
AI model gateways. Some Platform features send content to a third-party AI model gateway, which routes the request to a model provider. This happens when you ask for help writing or improving a Listing, and when a Listing image or description is checked against our Acceptable Use Policy.
What is sent is the content you submitted for that feature — Listing text, titles, descriptions and images — together with the instruction for the task. We do not send your name, email address, postal address, payment details or order history to these providers.
The gateway and the model provider process that content under their own terms, which may permit them to retain it or to use it to improve their models. Treat anything you put into a Listing or an AI-assisted field as leaving the Platform. Do not place Personal Data, confidential material, or unpublished work you are not ready to disclose into those fields. A Listing decision made this way can be contested under §8 (g).
4.3. Payment and banking partners
Payment data is shared with licensed payment-service providers and, where required, card networks. We share the minimum data needed to authorise, settle, and reconcile a transaction. We do not store full card numbers or CVV.
4.4. Local physical coordination
QYRONY does not provide shipping or share local-listing data with a carrier. Users choose what meetup information to share in private chat. Do not publish an exact home address in a Listing or public post.
4.5. Professional advisors and authorities
Auditors, lawyers, tax advisors, banks, and regulators where necessary for the purposes in §3.
4.6. Law enforcement and courts
Where we receive a binding legal request or have reasonable grounds to believe disclosure is necessary to prevent imminent harm, illegal activity, or to enforce our Terms. We assess each request for legal validity, publish aggregate statistics, and challenge over-broad requests where appropriate.
4.7. Corporate transactions
If QYRONY is acquired, merged, or sells assets, your data may be transferred to the acquirer under a written undertaking to honour this Policy.
5. Cookies, SDKs, and similar technologies
We use cookies or equivalent storage for authentication, security, and user-requested persistent settings. The optional recently viewed shelf and first-party product-view measurement activate only after the corresponding consent. Advertising technologies are not currently active.
| Category | Strictly necessary? | Consent required? | Examples |
|---|---|---|---|
| Authentication, security, fraud | Yes — required for the service to work | No (Article 6(1)(f) and Recital 32) | sign-in token, social sign-in state, your stored consent choice |
| Preferences you set | No | No — they only record a setting you actively chose | language, display currency, light or dark mode |
| Analytics (optional) | No | Yes before activation | consent-gated anonymous product-view measurement |
| Marketing / advertising (optional; not currently active) | No | Yes before activation | pixels or retargeting described at consent time |
You can revisit your choices at any time via the /legal/cookies page or the banner preferences link.
If an optional mobile SDK is introduced, its controls and purpose will be disclosed before activation and reflected in this Policy.
6. International data transfers
Our service providers may process Personal Data outside your country. Where data-protection law requires a transfer safeguard, we use an applicable legal mechanism and contractual or technical protections appropriate to the transfer.
Contact contact@qyrony.com if you have a question about a transfer that affects your data.
7. How long we keep your data
We retain Personal Data only for as long as needed to provide the service, meet legal obligations, resolve disputes, enforce agreements, and maintain security. The period depends on the data, the reason it was collected, account status, and any mandatory record-keeping requirement. We delete or anonymise data when it is no longer needed, subject to backup cycles and legal holds.
Where a legal hold or ongoing dispute requires longer retention, we preserve the data for the duration of the hold and delete it afterwards.
8. Your rights under GDPR
Subject to the conditions and exceptions in GDPR, you have the following rights. They are free of charge, normally answered within one month, and extendable by two further months for complex requests (we will tell you within one month if an extension is needed).
| Right | What it means | How to exercise it |
|---|---|---|
| (a) Access (Art. 15) | Confirm whether we process your data and obtain a copy | Contact contact@qyrony.com |
| (b) Rectification (Art. 16) | Correct inaccurate or incomplete data | Edit your profile, or write to us |
| (c) Erasure (Art. 17) | “Right to be forgotten” — delete data we are not required to keep | Contact contact@qyrony.com |
| (d) Restriction (Art. 18) | Pause processing while a dispute is resolved | Write to contact@qyrony.com |
| (e) Portability (Art. 20) | Receive your data in a structured, machine-readable format (JSON or CSV) and transmit it to another controller | Contact contact@qyrony.com |
| (f) Objection (Art. 21) | Object to processing based on legitimate interests, including profiling | Opt-out controls in product, or write to us |
| (g) Automated decisions (Art. 22) | Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, and to obtain human review | Write to contact@qyrony.com |
| (h) Withdraw consent (Art. 7(3)) | Withdraw any consent at any time — the withdrawal does not affect the lawfulness of prior processing | Cookie preferences, marketing unsubscribe, account settings |
| (i) Lodge a complaint (Art. 77) | Lodge a complaint with your local supervisory authority | See §8.2 below |
We will not retaliate against you for exercising your rights.
8.1. Identity verification
To prevent unauthorised disclosure, we may need to verify your identity before responding. We use a risk-based approach — the more sensitive the request, the stronger the verification.
8.2. Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with the data-protection authority in your habitual residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available at edpb.europa.eu. UK residents may complain to the ICO (ico.org.uk); Swiss residents to the FDPIC (edoeb.admin.ch).
9. Children
The Platform is not directed at children under 18. We do not knowingly collect data from children under 18. If you believe a child has provided data to us, contact contact@qyrony.com and we will delete it promptly.
10. Security
We use administrative, technical, and organisational safeguards designed to protect Personal Data. These include access controls, secure transport, monitoring, and review of sensitive operations. No service can guarantee absolute security.
You can read more at /trust-and-safety and review our latest security measures.
11. Marketing communications
- We send marketing communications only with your consent (or, for existing customers, on a soft-opt-in basis where the law allows, with a clear unsubscribe in every message).
- Every email contains an unsubscribe link and a preference centre link.
- Push notifications can be turned off in your device or in-app settings.
- We do not pass your email to third parties for their own marketing.
12. Third-party links and embedded content
The Platform may link to a third-party site or open a provider-hosted payment, verification, or account-management page. That provider processes data under its own policy. We do not currently load third-party advertising widgets on ordinary Platform pages.
13. Changes to this Policy
We will update this Policy when our practices change or when the law requires it. The current version is always at this URL with an updated “Last updated” date. Material changes are notified by email and an in-product banner at least 30 days in advance.
14. Contact
For privacy matters:
Qyrony
Website: qyrony.com
Privacy Email:
contact@qyrony.com
For a Subject Access Request or any other data-subject request, email contact@qyrony.com.
15. Additional information for California residents
This section supplements the rest of this Policy for residents of California, under the California Consumer Privacy Act as amended by the CPRA. It applies to the extent that Act applies to us.
What we collect and why. The categories of Personal Data we collect, the sources we collect them from, and the purposes we use them for are set out in §2 and §3. In CCPA terms these include identifiers, customer records, commercial information, internet and network activity, approximate location inferred from a connection, and inferences drawn from your use of the Platform. We collect the Personal Data described in §2 for the business purposes described in §3, and we keep it for the periods described in §7.
Disclosure. We disclose Personal Data for business purposes to the categories of recipients listed in §4 — other Users, service providers and processors, payment and banking partners, professional advisors and authorities, and an acquirer in a corporate transaction.
No sale and no cross-context behavioural advertising. We do not sell Personal Data and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We do not knowingly sell or share the Personal Data of consumers under 16. The Platform is not directed at anyone under 18 (§9).
Sensitive Personal Information. We do not use or disclose Sensitive Personal Information for purposes beyond those permitted under CCPA §1798.121, so the right to limit its use does not arise.
Your California rights. You have the right to know what we collect and how we use and disclose it, the right to access a copy, the right to correct inaccurate Personal Data, the right to delete, and the right not to receive discriminatory treatment for exercising any of them.
How to exercise them. Email contact@qyrony.com. We verify a request against the details already on your account, in proportion to the sensitivity of what is asked for (§8.1). An authorised agent may act for you with your written permission and their own proof of identity. We respond within 45 days, and may extend once by a further 45 days where the Act permits, telling you before the first period ends.
Appeals and complaints. If we refuse a request, our response explains why and how to ask us to reconsider. You may also contact the California Privacy Protection Agency or the California Attorney General.
Other US state privacy laws grant similar rights. Where one applies to you, we honour the equivalent rights on the same basis and through the same contact address.
Defined terms
- “Personal Data” — any information relating to an identified or identifiable natural person.
- “Processing” — any operation performed on Personal Data (collection, storage, use, disclosure, deletion).
- “Special Category Data” — data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data, health data, sex life, or sexual orientation.
- “Profiling” — automated processing of Personal Data to evaluate certain personal aspects, in particular to analyse or predict performance, economic situation, preferences, interests, reliability, behaviour, location, or movements.
- “Consent” — freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
End of Privacy Policy.