Privacy policy

BeastVault Shop (beastvault.shop) is a platform by BeastVault. BeastVault is a project by WebSloth. WebSloth is the controller for personal data processed through BeastVault Shop (KVK 89595157, Netherlands). More about the company: websloth.com.

Questions: contact@beastvault.app.

The BeastVault mobile app is a separate product. App privacy is described at beastvault.app/legal/privacy.

What we collect

• Account data: if you sign in with BeastVault, BeastVault Shop uses a limited session token to retrieve the account information needed for the Shop, such as your user identifier, display name, profile image and wishlist information. The token is stored in a browser session cookie and is used only to access that limited BeastVault account functionality.
• Wishlist information remains part of the BeastVault service and is retrieved through the BeastVault API; BeastVault Shop does not maintain a separate copy of your wishlist.
• Reviews shown on BeastVault Shop are retrieved from BeastVault. Visitors can read these reviews through the Shop, but reviews are not submitted or edited through BeastVault Shop. When you choose to translate a review, the review text is sent to Google Translate to produce a translation.
• Market preference: the country/market you select so we can show partner offers that ship to you. If your preferred market is not set, we may look up a country from your IP address (via CDN headers or a lookup service such as ipwho.is) only to suggest a market. We do not store visitor IP addresses in referral analytics records.
• Referral information: when a visitor opens a partner offer, we may record that a referral occurred, including information such as the partner, destination link, selected country/market, time of the referral, browser user agent, and if the visitor is signed in, their BeastVault user identifier.
• Usage analytics: Google Analytics is enabled on BeastVault Shop and sets cookies such as _ga to measure page views, traffic sources and how the Shop is used. Google Analytics does not receive BeastVault account IDs, usernames, email addresses or profile information from the Shop. You can limit Google Analytics with Google's browser opt-out add-on. We also use privacy-focused, cookieless analytics (Plausible) operated on our own infrastructure.
• Technical operation: our infrastructure and service providers may temporarily process technical data such as IP addresses as needed to host, secure and operate the site.

Why we use it

• show relevant partner offers for your country;
• sign you in and show wishlist flavors;
• measure partner traffic, understand which offers and markets are useful, improve BeastVault Shop and optimize how partner offers are displayed;
• understand how the Shop is used;
• translate review text when you request a translation;
• prevent abuse and keep the service working.

Legal bases under the GDPR include: legitimate interest for security, operating the service, referral measurement where appropriate, and improving the service using limited data; and performance of the signed-in Shop features when you use a BeastVault account. We do not process payments on this site.

Who we share it with

• independent partner retailers when you follow their link (their own privacy policies then apply);
• Google for Google Analytics, Google Fonts and Google Translate;
• BeastVault services hosted on Supabase for reviews, profiles and wishlist access;
• PocketBase and related hosting for the Shop catalog, partners and referral logs;
• CDN and asset hosts (including our image CDN and jsDelivr for a small cookie-notice icon);
• providers that support hosting, security and operation of BeastVault Shop;
• BeastVault authentication services for sign-in;
• ipwho.is when a country cannot be determined from CDN headers alone;
• authorities where legally required.

Some service providers may process information outside the EEA. Where required, appropriate safeguards are used for such transfers. We do not sell your personal data. We do not run third-party advertising on BeastVault Shop.

How long we keep it

• Sign-in session: until the session expires or you sign out.
• Temporary authentication data: only as required to complete sign-in.
• Market preference: kept so the Shop can remember your chosen market for a reasonable period of functional use.
• Referral click records (including optional signed-in user id and browser user agent) are retained for up to 24 months, then deleted or aggregated. Non-identifying aggregated referral statistics may be retained indefinitely for long-term trends.
• Server and security data: only as long as reasonably necessary.
• Google Analytics retention follows the retention setting configured in Google Analytics (typically 14 months unless changed).

Cookies

See the Cookie policy for cookies and similar storage used for sign-in, market preference and analytics. You can also use your browser controls to block or clear cookies.

Your rights

Under the GDPR you can ask for access, correction, deletion, restriction, or portability of your data where applicable, and you can object to processing based on legitimate interest. Contact contact@beastvault.app.

BeastVault Shop does not host a separate account database. To delete or manage your BeastVault account (including wishlist and reviews), use the BeastVault app or contact contact@beastvault.app. You can also complain to Autoriteit Persoonsgegevens (Netherlands) or your local supervisory authority.