Privacy Policy

This page outlines how HW Market collects, uses, and protects member information.

Last updated: January 25, 2026

Information we collect

What data is stored when you use the marketplace.

Account details such as email, username, and profile data.
Listings, messages, and rating history you create on the platform.
Basic analytics for marketplace performance and safety.

How we use your data

Keeping the community safe and informed.

To operate listings, messages, and notifications.
To protect users from fraud, spam, or policy violations.
To improve product features and performance.

Cookies and local storage

What gets stored in your browser and why.

Cookie preference: stores your selected consent categories (essential, analytics, functionality, and optional marketing).
Authentication cookies: required to keep you signed in and secure your session.
Activity tracking (last seen): only set after you accept non-essential cookies, used to update your last seen status.
Google Consent Mode v2 + CMP signals: stores and syncs ad_storage, ad_user_data, ad_personalization, and analytics_storage preferences for Google services.

Your choices

Control your privacy settings.

You can update your profile details and notification preferences from the settings page. Requests to delete your account will remove public listings and profile data.

Account settings Contact support Terms of Service

Privacy contact

How to reach us for GDPR and privacy questions.

For privacy requests, lawful-basis questions, or data-subject rights inquiries, contact our privacy team.

contact@salla.lol

Lawful basis for processing

How key data categories map to GDPR legal bases.

Account, authentication, and security data: Contract performance and legal obligation (account integrity and security records).
Listings, messages, ratings, and transaction coordination: Contract performance and legitimate interest (marketplace operation and dispute handling).
Moderation, abuse reports, rate-limit events, and fraud indicators: Legitimate interest and legal obligation (platform safety and compliance).
Diagnostics, performance telemetry, and replay data: Consent for non-essential tracking, plus legitimate interest for strictly necessary reliability telemetry.

Supervisory authority and complaints

Your right to lodge a complaint under GDPR Art. 13(1)(d).

If you believe your data protection rights were violated, you may contact your local supervisory authority or our lead authority below.

National Commission for Data Protection (CNPD): https://cnpd.public.lu/en.html

You can also contact us first at contact@salla.lol so we can investigate and resolve the issue quickly.

Third-party service providers

These providers process specific categories of personal data on our behalf.

Supabase: Database hosting, authentication, storage, and realtime infrastructure for core account and marketplace data.
Vercel: Application hosting, edge routing, and deployment infrastructure processing request and performance metadata.
Stripe: Payment processing for paid marketplace features and related transaction metadata.
Google AdSense: Advertising delivery and consent signaling. Google may operate as an independent controller for ad data under Google policies.
Sentry: Error and performance monitoring to detect incidents and improve service reliability.
Cloudflare: Turnstile CAPTCHA and traffic/security edge services to reduce abuse and automated attacks.

Data retention

How long we keep operational and safety-related records.

Profile and account data is retained while your account is active. On verified account deletion, your profile is anonymised (username, email, name, and avatar are removed) and your listings, sent messages, ratings, favourites, and notifications are permanently deleted.
Conversations you participated in and messages sent to you by other users may remain visible to those other participants after your account is deleted.
Contact messages are retained for up to 12 months for support follow-up and abuse prevention, then automatically deleted.
Security records such as login attempts and rate-limit events are retained for 30 days, then automatically deleted.
Audit logs (including account-deletion records) are retained for 90 days, then automatically deleted.
Message attachments automatically expire and are deleted after 7 days.

Loading...

Fetching the latest listings from HW Market.