Last updated: April 2026
The JustSell platform is operated by Cubus Arts S.R.L. (cubus.ro), acting as data controller within the meaning of EU Regulation 2016/679 (GDPR). Contact us at: suport@justsell.ro.
When you create an account we collect: your email address, name and profile photo (if you sign in via Google or Facebook). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Photos and product descriptions you upload are stored to provide the automated listing creation service. Photos are transmitted to a third-party AI analysis provider for processing (see section 4). Legal basis: performance of a contract.
We collect technical data (IP address, browser type, pages visited) for security and diagnostic purposes. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
We store your language preference and other account settings. Legal basis: performance of a contract.
Servers and object storage (images) are hosted by Hetzner Online GmbH, based in Germany, in compliance with GDPR. Data remains within the European Union.
Product photos are transmitted to a third-party AI analysis provider to generate automated descriptions, titles, and price estimates. The provider acts as a data processor. Where the provider is located outside the European Economic Area, the transfer is made under Standard Contractual Clauses (SCCs) approved by the European Commission. Your data is not used for AI model training. The current provider's identity can be obtained on request via suport@justsell.ro.
If you use OAuth sign-in, profile data (email, name, avatar) is provided by those platforms according to their own policies. We do not store OAuth passwords.
Under GDPR you have the right to:
To exercise your rights, email suport@justsell.ro. We will respond within 30 days.
You can delete your account at any time, instantly and automatically, from Settings → Danger zone or via this page. The deletion is immediate and permanent: your account, every listing, every photo, and any OAuth connection (Google, Facebook) are removed from our databases. We retain only a non-personal confirmation code as proof the deletion happened.
Facebook users: if you remove the app from your Facebook settings, Facebook automatically sends us a deletion request and your data is removed based on the signed confirmation received from Facebook — no further action required on your side.
If you believe your rights have not been respected, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):
All communications are encrypted via HTTPS/TLS. Passwords are hashed with bcrypt. Data access is restricted through role-based access control (RBAC). We conduct periodic security audits.
We reserve the right to update this policy. Significant changes will be communicated by email at least 14 days before they take effect. The date of last update is shown at the top of this page.