Privacy Policy

This Privacy Policy explains how Varmeli ("Varmeli", "we", "us", or "our") handles personal data when you use the WorthAI mobile application, website, support channels, and related services (collectively, the "Service"). Varmeli is the controller for the processing described here unless stated otherwise.

WorthAI helps users identify items from images and obtain estimated market and expected resale values. These outputs are estimates, not guaranteed sale prices.

1. Information we collect

Information you provide

• Account information, such as your email address, display name, authentication identifiers, and profile settings.
• Images and scan content you choose to submit, plus item details, condition notes, corrections, saved items, and collection data.
• Support communications, feedback, survey responses, and information you provide when reporting a problem.
• Subscription and entitlement information. Payments are processed by Google Play; we do not receive your complete payment-card details.

Information collected automatically

• Device and app information, including operating system, app version, language, country or region, device identifiers, and diagnostic data.
• Usage information, such as feature interactions, scan outcomes, timestamps, subscription status, crashes, and performance events.
• Security and network information, such as IP address, authentication events, and signals used to prevent fraud, abuse, and unauthorized access.

Information from other sources

We may receive authentication information from a sign-in provider, purchase and subscription status from Google Play and RevenueCat, and product or marketplace information from data providers and public sources. Marketplace information may include listing attributes, asking prices, and, when lawfully available, sold-comparable data.

Where WorthAI stores information

• On your device: saved collection items, scan photos, preferences, onboarding state, and local history are stored locally. On Android, photos may be written to WorthAI's private application files. Android backup is disabled in the current release.
• In WorthAI's Supabase backend: account and authentication records, subscription entitlements, scan-usage records, metadata-only recognition results, and feedback you deliberately submit. Recognition telemetry records photo counts and derived identity data, but is designed not to store the scan images themselves.
• During a scan: selected images are transmitted to WorthAI's backend and then to AI/vision providers for transient analysis. This transmission is necessary to return the requested result; it is different from saving the image in your collection or improvement dataset.
• Marketplace connections: if you connect eBay, WorthAI stores an encrypted refresh token, marketplace identifier, connection metadata, and an eBay user identifier required for connection management and deletion compliance.

2. How we use information

• Provide, operate, personalize, and secure the Service.
• Analyze submitted images, identify items, estimate condition and value, and display comparable market information.
• Maintain collections, scan history, account settings, subscription access, and cross-device synchronization.
• Improve recognition and pricing quality by evaluating errors, user corrections, aggregate outcomes, and service performance. Where practical, we use de-identified or aggregated data for improvement.
• Process support requests and communicate important service, security, billing, or policy information.
• Detect fraud, misuse, technical failures, and violations of our Terms of Use; comply with law and enforce legal rights.

3. Legal bases under the GDPR

Where the GDPR or similar law applies, we rely on: (a) performance of our contract to provide requested features and manage subscriptions; (b) legitimate interests in securing, maintaining, and improving WorthAI, balanced against your rights; (c) consent where required, including for optional permissions or uses; and (d) compliance with legal obligations. You may withdraw consent at any time without affecting earlier lawful processing.

4. How we share information

We do not sell your personal data. We may disclose limited information to:

• Cloud hosting, database, authentication, AI processing, analytics, security, customer-support, and communications providers acting for us.
• Google Play and RevenueCat to process purchases, confirm subscription status, prevent fraud, and provide paid access.
• Marketplace and product-data providers when needed to perform a search or valuation request. We seek to avoid sending direct account identifiers unless necessary.
• Professional advisers, authorities, courts, or counterparties where required by law, necessary to protect rights and safety, or connected with a merger, financing, reorganization, or sale of the business.

Our providers may process data under their own terms where they act as independent controllers. Their services are subject to their respective privacy notices.

Current production provider categories

• Supabase: authentication, database, Edge Functions, and selected storage.
• OpenAI: image and text analysis used for recognition, research, and marketplace-quality checks.
• Google Cloud Vision: optional image annotation and identity evidence; Google Sign-In and Google Play may also process authentication and purchase data.
• RevenueCat: subscription entitlement and purchase-event processing for Google Play and, if enabled, Apple App Store.
• eBay: marketplace search, connected-account authorization, listing workflows, and marketplace-account deletion notifications.

How we handle eBay data

WorthAI uses eBay content only for user-requested features and other use cases expressly permitted by eBay, such as marketplace searches, displaying relevant comparable listings, connected-account workflows, and preparing listing information. We do not use eBay content to train algorithms, machine-learning models, large language models, artificial-intelligence systems, or synthetic datasets. We do not sell eBay content or use it to build unrelated market datasets.

We request only the eBay data needed for the feature being used. Any intermediate copies or caches are retained only while reasonably necessary for the permitted purpose and are deleted or allowed to expire when no longer required, subject to legal obligations and eBay's applicable terms. If eBay notifies us that a marketplace account has been deleted or closed, we delete or de-identify associated eBay user data as required by eBay's account-deletion rules and applicable law.

5. Images, camera access, and AI processing

WorthAI accesses the camera or photo library only after you choose to grant the relevant permission. Submitted images may contain personal information in the background. Review images before uploading and do not submit confidential material or images of people who have not consented.

Images and related descriptions may be processed by automated systems to recognize products, infer attributes, find comparables, and produce estimates. Automated outputs can be wrong. WorthAI does not make decisions that produce legal or similarly significant effects about you.

6. Retention

Retention is tied to the data's purpose. Local collections and photos remain until you remove them, clear app data, or uninstall the app. Cloud account, entitlement, scan-usage, recognition, feedback, and connected-marketplace rows generally remain while the account exists unless deleted earlier. OAuth state records expire by design. Marketplace caches expire according to their stored expiry time and the applicable provider terms. Billing-event and security records may be retained longer where necessary for accounting, fraud prevention, dispute handling, or legal compliance. Backups age out under provider backup schedules. De-identified evidence derived solely from user-provided content may be retained where it no longer identifies an account; this does not permit us to retain or reuse eBay content beyond eBay's authorized purposes.

7. Security

We use administrative, technical, and organizational safeguards designed to protect data, including access controls, encrypted transport, service monitoring, and restricted production access. No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your login credentials and device.

8. International transfers

Our providers may process information outside Sweden or the European Economic Area. Where required, we use recognized transfer mechanisms such as adequacy decisions, the European Commission's Standard Contractual Clauses, and supplementary safeguards.

9. Your choices and rights

• Access, correct, export, or delete eligible account information.
• Object to or restrict certain processing, and withdraw consent where processing relies on consent.
• Disable camera, photo, or notification permissions in device settings, understanding that related features may stop working.
• Cancel a subscription through Google Play. Deleting WorthAI does not automatically cancel a subscription.
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

To exercise privacy rights or request account deletion, use the in-app controls when available or email contact@varmeli.com. We may verify your identity before completing a request.

10. Children

WorthAI is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.

11. Changes to this policy

We may update this Privacy Policy to reflect product, legal, or operational changes. We will post the revised version with a new effective date and provide additional notice when required by law.

12. Contact

Varmeli
Email: contact@varmeli.com
Website: https://worthaiapp.com
Sweden

Reference framework

This policy is designed to support transparency obligations under the EU General Data Protection Regulation and Google Play's User Data requirements. Actual disclosures must remain consistent with WorthAI's implemented data flows and Google Play Data safety form.