Privacy Policy

KeenFind is a European secondhand marketplace aggregator, run as an independent project from Belgium. Its operator is the data controller for personal data processed through KeenFind and can be reached at the address above for any request under this policy.

By using KeenFind at keenfind.io, you acknowledge this privacy policy. If you do not agree with our practices, please do not use the service.

This policy explains what personal data we collect, why we collect it, how we process it, and what rights you have under the General Data Protection Regulation (GDPR) and applicable Belgian law.

2.1 Account data

When you create an account, we collect your email address, first name, last name, and (for email-based registration) a password. Passwords are hashed using scrypt before storage; we never store plaintext passwords. If you sign in with Google, we receive your name and email from Google OAuth but do not store your Google password.

2.2 Search data

We log search queries, timestamps, and platform selections. IP addresses are masked at the point of collection (IPv4 to /24, IPv6 to /48) and are never stored in full. For authenticated users, searches are associated with your user ID for quota tracking.

Search terms are also used in aggregate to show a "most searched" list and a total listings-searched counter on our home page. A term only appears there once several separate searches have used it, so a one-off search is never surfaced, and the list carries no information about who searched for what.

2.3 Alert data

Product alerts store the product name you are searching for, your postcode, approximate geographic coordinates (latitude/longitude), search radius, price range preferences, and selected marketplace platforms. This data is necessary to run automated searches on your behalf.

2.4 Telegram data

If you choose to link your Telegram account for alert notifications, we store your Telegram chat ID. This is used solely to deliver notifications you have opted into.

2.5 Payment data

Paid subscriptions are handled entirely by Stripe. We store only your Stripe customer ID and subscription ID for reference. We do not process or store credit card numbers, bank details, or other payment credentials. Stripe's own privacy policy governs how they handle your payment information.

2.6 Cookies

We use two cookies:

• bh_session (authenticated users): a session cookie with a 30-day expiry, used to keep you logged in. This is strictly necessary for the service to function for registered users.
• bh_anon (anonymous visitors): a tracking cookie with a 30-day expiry, used to enforce daily search quotas for unauthenticated users. This cookie is set only with your consent.
• bh_locale: records the language you chose, so the site and your emails arrive in it. Strictly necessary for the service you asked for.

We do not use any third-party advertising or analytics cookies.

2.7 Local storage

We store your theme preference and view mode preference in your browser's localStorage. These are strictly functional and contain no personal data.

We process your personal data under the following GDPR legal bases:

3.1 Contract performance (Article 6(1)(b))

Processing necessary to provide the service you signed up for: account management, executing searches, processing alerts, and managing subscriptions.

3.2 Legitimate interest (Article 6(1)(f))

We rely on legitimate interest for anonymous quota enforcement (preventing abuse of free search limits), rate limiting to protect the service from misuse, IP masking for security logging, and aggregate analytics to improve the service. We have assessed that these interests do not override your rights, particularly given the privacy-preserving measures in place (IP masking, minimal data collection).

3.3 Consent (Article 6(1)(a))

The bh_anon tracking cookie (used for anonymous quota enforcement) is set only with your consent, which you can withdraw at any time through your browser's cookie settings or our cookie consent mechanism.

We share personal data with the following third parties, each acting as a data processor or independent controller as noted:

Where data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards as required by Chapter V of the GDPR.

• Account data: retained until you delete your account.
• Search logs: IP addresses are masked at collection. On account deletion, the user ID is nullified from search logs, which are then retained in anonymized form for aggregate analytics.
• Sessions: expire after 30 days and are purged on account deletion.
• Alert data: all alerts, seen listings, and notification history are purged when you delete your account.
• Subscription data: Stripe customer and subscription IDs are anonymized on account deletion. Stripe retains its own records per its data retention policy.

Under the GDPR, you have the following rights regarding your personal data:

• Access and portability: you can export your data from your account settings page.
• Erasure: you can delete your account and all associated personal data from your account settings. Deletion is immediate and irreversible.
• Rectification: you can update your email address and name in your account settings.
• Object or restrict processing: you can pause or delete individual alerts. For broader objections, contact us at the address above.
• Withdraw consent: you can withdraw cookie consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
• Lodge a complaint: you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) or your local supervisory authority.

To exercise any of these rights, contact hello@keenfind.io. We will respond within 30 days.

We implement the following technical measures to protect your data:

• TLS encryption for all data in transit
• Password hashing with scrypt
• Session tokens hashed with SHA-256 before storage
• Rate limiting on authentication, search, and account endpoints
• httpOnly, Secure, and SameSite attributes on all cookies
• IP address masking at collection (never stored in full)

KeenFind is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this privacy policy from time to time. Material changes will be communicated via email to registered users. The "Last updated" date at the top of this page indicates when the policy was last revised.