QYRONY Privacy Policy
Version: 1.0.3 Last updated: 5 September 2026 Effective from: 31 March 2025
This Privacy Policy explains how QYRONY (“we”, “us”, “our”) processes Personal Data when you use the QYRONY Hub platform under applicable data-protection laws.
1. Who we are and how to contact us
1.1. Data controller
For the core platform services (account, listings, orders, payments, wallet, support), the data controller is:
Qyrony LLC (trading as Qyrony)
A limited liability company registered in Wyoming, United States. Wyoming Entity ID 2025-001646695, Wyoming Secretary of State.
312 W 2nd St, Unit #A794, Casper, WY 82601, United States
Website: qyrony.com
Email:
contact@qyrony.comTelephone: +1 (303) 591-7075
1.2. Joint controllers (channels)
When a User or Vendor hosts a Channel that aggregates content and interactions, they are responsible for the content they publish and for complying with any privacy obligations that apply to their own activity.
1.3. Privacy contact
Email:
contact@qyrony.com
Contact us at this address with any question about this Policy, your rights, or our processing, and to exercise any of the rights described in section 8.
2. Personal data we collect
We collect Personal Data directly from you, automatically from your device, and from third parties. The principal categories are summarised below.
For approximate catalogue prices, we use a country hint from our hosting edge or estimate the connection’s country using a database held on our server. This lookup does not send your IP address to an external geolocation provider or save a location profile. VPNs and travel may change the displayed currency. This is not verification of residence and does not change wallet balances, checkout currency, tax evidence or identity requirements. Where a local quote is unavailable, we show the product’s original currency. This limited display personalisation serves our legitimate interest in making prices understandable; you may contact us to object to this processing.
| Category | Examples | Source |
|---|---|---|
| Identity & account | name, display name, email, phone, profile photo, language, time zone, hashed password | You (registration, profile, vendor verification) |
| KYC & vendor verification | verification status and requirements, provider account identifier, and information required for your country and seller type. Identity documents and payout details are entered in the payment provider’s hosted flow where available | You, payment and verification providers |
| Authentication & security | hashed passwords, 2FA secrets, device fingerprints, login timestamps, IP address, security-event logs | You (login), automatically |
| Transaction & wallet | order history, invoices, refunds, dispute records, separate top-up and seller-earnings balances, payment-provider identifiers, and masked method details returned by the provider. PAN, CVV, full bank details, and raw identity documents are not stored by QYRONY through the normal hosted flow | You, payment processors |
| Listings & content | product data, images, descriptions, prices, auction bids, reviews, channel posts, messages, support tickets | You |
| Behavioural & usage | pages viewed, search queries, click events required for product functions, referrer, and items added to cart or watched | Automatically through application requests and necessary storage (see §5) |
| Device & connection | IP address, user agent, OS, language, screen size, and security-event metadata | Automatically |
| Marketing | email engagement, in-app notifications, marketing preferences, attribution data for our own ads | You, automatically |
| Customer support | support messages and attachments you choose to provide | You |
| Public third-party data | sanctions and PEP lists, public company registries | Third parties |
We do not intentionally request Special Categories of Data (Article 9 GDPR) for ordinary Platform use. Do not place such information in public Listings, posts, or messages. If we encounter it, we may restrict access, delete it, or request a lawful basis appropriate to the specific purpose rather than relying on this Policy as blanket consent.
3. Why we use your data (purposes and lawful bases)
GDPR requires us to have a lawful basis for each processing activity. The table below sets out the purposes for which we process Personal Data and the corresponding legal ground under Article 6(1) GDPR. Legitimate interests are balanced against your rights and freedoms at the time of the legitimate-interest assessment (LIA); you can request a copy of any LIA.
| # | Purpose | Lawful basis (Art. 6 GDPR) | Categories of data |
|---|---|---|---|
| 1 | Provide the Platform, including account creation, login, listings, auctions, channels, and messaging | (b) Performance of a contract | Identity, authentication, listings, content, device |
| 2 | Process payments, manage the Wallet, issue refunds, prevent fraud | (b) Contract, (c) Legal obligation (tax, AML), (f) Legitimate interests (fraud prevention) | Transaction, KYC, device, behaviour |
| 3 | Vendor verification (KYC, sanctions screening) | (c) Legal obligation (AML, sanctions), (b) Contract | KYC, identity |
| 4 | Digital delivery, local-listing communication, refunds, disputes, and customer support | (b) Contract | Identity, transaction, content, support |
| 5 | Safety, security, fraud and abuse prevention, dispute resolution | (f) Legitimate interests (security of service and Users) | All categories; specifically authentication, device, behaviour, transaction |
| 6 | Product analytics and improvement, A/B testing, debugging | (f) Legitimate interests, (a) Consent for non-essential cookies | Behaviour, device |
| 7 | Personalisation of search, recommendations, and homepage | (f) Legitimate interests (within the strict necessity test), with right to opt out | Behaviour, listings, content |
| 8 | Marketing communications (email, push, in-app) | (a) Consent (Article 7 + ePrivacy), or (f) for existing customers with right to opt out | Identity, behaviour |
| 9 | Consent-based first-party product-view measurement; optional advertising only if introduced in the future | (a) Consent obtained before the optional technology is activated | Behaviour and device data described at consent time |
| 10 | Tax accounting, financial reporting, regulatory record-keeping | (c) Legal obligation | Transaction, KYC |
| 11 | Comply with law enforcement and lawful government requests | (c) Legal obligation | All categories, as required by the request |
| 12 | Establish, exercise, defend legal claims | (f) Legitimate interests | All relevant categories |
| 13 | Reorganisations, M&A, asset sales | (f) Legitimate interests, (a) Consent for material changes | All categories, as transferred |
Automated decision-making and profiling (Art. 22). We use automated systems to: (a) detect fraud and abuse (with human review for adverse effects); (b) rank search and recommendations; (c) decide whether a Listing complies with the Acceptable Use Policy (with a human review on objection); (d) decide initial eligibility for promotional credit (with the right to contest). We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (such as refusing service, without human review), unless required or authorised by law (e.g. sanctions screening).
4. Who we share your data with
We do not sell Personal Data. We share data only as set out below.
4.1. Other Users
- Buyers see the Vendor’s public profile and Listing details.
- Vendors see the Buyer’s identity and messages needed for an eligible digital order. For local physical coordination, each participant sees only public profile information and details the other participant voluntarily shares in private chat.
- Channel members see the content the host publishes and may see your public profile if you post.
4.2. Service providers (processors)
We engage carefully vetted processors under Article 28 GDPR contracts. The current sub-processors include cloud infrastructure, payment processors, KYC/sanctions providers, and customer support tooling. Changes are notified at least 30 days in advance.
Categories include cloud hosting, database and object storage, payment processing, email delivery, content moderation, and security tooling. We publish provider names only after confirming the active production service and the disclosure is useful to customers.
4.3. Payment and banking partners
Payment data is shared with licensed payment-service providers and, where required, card networks. We share the minimum data needed to authorise, settle, and reconcile a transaction. We do not store full card numbers or CVV.
4.4. Local physical coordination
QYRONY does not provide shipping or share local-listing data with a carrier. Users choose what meetup information to share in private chat. Do not publish an exact home address in a Listing or public post.
4.5. Professional advisors and authorities
Auditors, lawyers, tax advisors, banks, and regulators where necessary for the purposes in §3.
4.6. Law enforcement and courts
Where we receive a binding legal request or have reasonable grounds to believe disclosure is necessary to prevent imminent harm, illegal activity, or to enforce our Terms. We assess each request for legal validity, publish aggregate statistics, and challenge over-broad requests where appropriate.
4.7. Corporate transactions
If QYRONY is acquired, merged, or sells assets, your data may be transferred to the acquirer under a written undertaking to honour this Policy.
5. Cookies, SDKs, and similar technologies
We use cookies or equivalent storage for authentication, security, and user-requested persistent settings. The optional recently viewed shelf and first-party product-view measurement activate only after the corresponding consent. Advertising technologies are not currently active.
| Category | Strictly necessary? | Consent required? | Examples |
|---|---|---|---|
| Authentication, security, fraud | Yes — required for the service to work | No (Article 6(1)(f) and Recital 32) | session, csrf, device fingerprint |
| Functional preferences | No | No (legitimate interests for non-intrusive UX preferences) | language, dark mode |
| Analytics (optional) | No | Yes before activation | consent-gated anonymous product-view measurement |
| Marketing / advertising (optional; not currently active) | No | Yes before activation | pixels or retargeting described at consent time |
You can revisit your choices at any time via the /legal/cookies page or the banner preferences link.
If an optional mobile SDK is introduced, its controls and purpose will be disclosed before activation and reflected in this Policy.
6. International data transfers
Our service providers may process Personal Data outside your country. Where data-protection law requires a transfer safeguard, we use an applicable legal mechanism and contractual or technical protections appropriate to the transfer.
Contact contact@qyrony.com if you have a question about a transfer that affects your data.
7. How long we keep your data
We retain Personal Data only for as long as needed to provide the service, meet legal obligations, resolve disputes, enforce agreements, and maintain security. The period depends on the data, the reason it was collected, account status, and any mandatory record-keeping requirement. We delete or anonymise data when it is no longer needed, subject to backup cycles and legal holds.
Where a legal hold or ongoing dispute requires longer retention, we preserve the data for the duration of the hold and delete it afterwards.
8. Your rights under GDPR
Subject to the conditions and exceptions in GDPR, you have the following rights. They are free of charge, normally answered within one month, and extendable by two further months for complex requests (we will tell you within one month if an extension is needed).
| Right | What it means | How to exercise it |
|---|---|---|
| (a) Access (Art. 15) | Confirm whether we process your data and obtain a copy | Contact contact@qyrony.com |
| (b) Rectification (Art. 16) | Correct inaccurate or incomplete data | Edit your profile, or write to us |
| (c) Erasure (Art. 17) | “Right to be forgotten” — delete data we are not required to keep | Contact contact@qyrony.com |
| (d) Restriction (Art. 18) | Pause processing while a dispute is resolved | Write to contact@qyrony.com |
| (e) Portability (Art. 20) | Receive your data in a structured, machine-readable format (JSON or CSV) and transmit it to another controller | Contact contact@qyrony.com |
| (f) Objection (Art. 21) | Object to processing based on legitimate interests, including profiling | Opt-out controls in product, or write to us |
| (g) Automated decisions (Art. 22) | Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, and to obtain human review | Write to contact@qyrony.com |
| (h) Withdraw consent (Art. 7(3)) | Withdraw any consent at any time — the withdrawal does not affect the lawfulness of prior processing | Cookie preferences, marketing unsubscribe, account settings |
| (i) Lodge a complaint (Art. 77) | Lodge a complaint with your local supervisory authority | See §8.2 below |
We will not retaliate against you for exercising your rights.
8.1. Identity verification
To prevent unauthorised disclosure, we may need to verify your identity before responding. We use a risk-based approach — the more sensitive the request, the stronger the verification.
8.2. Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with the data-protection authority in your habitual residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available at edpb.europa.eu. UK residents may complain to the ICO (ico.org.uk); Swiss residents to the FDPIC (edoeb.admin.ch).
9. Children
The Platform is not directed at children under 18. We do not knowingly collect data from children under 18. If you believe a child has provided data to us, contact contact@qyrony.com and we will delete it promptly.
10. Security
We use administrative, technical, and organisational safeguards designed to protect Personal Data. These include access controls, secure transport, monitoring, and review of sensitive operations. No service can guarantee absolute security.
You can read more at /trust-and-safety and review our latest security measures.
11. Marketing communications
- We send marketing communications only with your consent (or, for existing customers, on a soft-opt-in basis where the law allows, with a clear unsubscribe in every message).
- Every email contains an unsubscribe link and a preference centre link.
- Push notifications can be turned off in your device or in-app settings.
- We do not pass your email to third parties for their own marketing.
12. Third-party links and embedded content
The Platform may link to a third-party site or open a provider-hosted payment, verification, or account-management page. That provider processes data under its own policy. We do not currently load third-party advertising widgets on ordinary Platform pages.
13. Changes to this Policy
We will update this Policy when our practices change or when the law requires it. The current version is always at this URL with an updated “Last updated” date. Material changes are notified by email and an in-product banner at least 30 days in advance.
14. Contact
For privacy matters:
Qyrony
Website: qyrony.com
Privacy Email:
contact@qyrony.com
For a Subject Access Request or any other data-subject request, email contact@qyrony.com.
Defined terms
- “Personal Data” — any information relating to an identified or identifiable natural person.
- “Processing” — any operation performed on Personal Data (collection, storage, use, disclosure, deletion).
- “Special Category Data” — data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data, health data, sex life, or sexual orientation.
- “Profiling” — automated processing of Personal Data to evaluate certain personal aspects, in particular to analyse or predict performance, economic situation, preferences, interests, reliability, behaviour, location, or movements.
- “Consent” — freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
End of Privacy Policy.