Privacy Policy

1. Who is the data controller

The controller of your data is José Miguel da Silva Dias, tax number (NIF) 230935320, 4750-106 Barcelos, Portugal. For any privacy question or to exercise your rights, contact hello@valora-watches.app.

2. What Valora does (technical summary)

Valora is a browser extension and a website. When you request an analysis, the extension extracts the data from the listing/auction page you are viewing and sends it to the Valora server (hosted on Cloudflare). That server uses an AI provider with web search (Perplexity) to produce the analysis and returns it. Results may be cached to avoid repeating identical requests. If you create an account, we store your profile, your usage and the items you choose to save.

3. What data we collect

• Data from the listing you analyse: the address (URL) and the text content of the page, plus anything you type in the request. They are sent to the Valora server and to Perplexity to generate the analysis.
• Account data: your email (and, if you use Google, the basic data Google shares at sign-in).
• Usage data: number of analyses per month (for the plan limits) and the items you save (favourites).
• Payment data: if you subscribe to the Pro plan, the payment is processed by Stripe. Valora does not see or store your card number.
• Minimal technical data: for users without an account, we count usage by IP address in an anonymised way (the IP is converted into an irreversible code, not stored in the clear).
• Diagnostic and product data: technical errors (error message and context, without the page content) and usage events (extension install, analyses, sign-up, payment) — including, in the analysis event, the domain of the listing's marketplace (e.g. catawiki.com), never the full address, the title or the listing's price — tied to a random device identifier or to the account identifier — never to your email or to the IP in the clear.
• Market data: for every analysis, we store the comparable prices found (closed sale, asking price, or new-item price, with date and source), tied only to the item's reference — never to your account or your device — to improve the reliability of valuations over time.

4. Why we use the data and the legal basis

• Provide the service (generate and show analyses, maintain your account and favourites) — performance of the contract with you.
• Apply the plan limits and prevent abuse — legitimate interest.
• Process payments — performance of the contract and legal obligations (invoicing).
• Detect technical errors and measure product usage in aggregate, to improve it — legitimate interest.

5. Who we share with (subprocessors)

We do not sell your data nor use it for advertising. We share it only with the providers necessary for the service to work:

• Cloudflare — server hosting and analysis cache.
• Perplexity AI — generates the analysis from the listing data sent.
• Supabase — authentication and database (account, usage, favourites).
• Vercel — website hosting.
• Upstash — analysis cache.
• Stripe — Pro plan payment processing.
• Sentry — technical error monitoring.
• PostHog — product metrics (usage events, hosted in the European Union).

Some of these providers are based outside the European Economic Area (for example, in the US). In those cases, the transfer is made under appropriate safeguards (such as the EU Standard Contractual Clauses).

6. How long we keep it

• Analysis cache: up to 30 days.
• Account and favourites: as long as you have an account. If you delete your account, they are deleted.
• Anonymous usage counters: expire automatically within a few weeks.
• Market data (comparable prices per reference): kept indefinitely, because it describes the item, not the person — retained to improve the reliability of valuations over time.

7. Your rights (GDPR)

You have the right to access, rectify, erase, restrict and object to processing, and to data portability. You can delete your account and your history at any time — this erases your account data and favourites. To exercise any of these rights, contact us at the email above. You also have the right to lodge a complaint with the supervisory authority (in Portugal, the CNPD).

8. Security

The connection is encrypted (HTTPS) and the access keys to the providers are protected on the server, never in your browser. Even so, no system is 100% infallible.

9. Changes to this policy

If we change this policy, we update the date at the top and, for significant changes, we notify you.