Privacy Policy

§ 01Overview

Vialo ("the App", "we", "us", "our") is a hyperlocal secondhand marketplace and community application operated by VIA HOUSE LTD (Company number: 16456480), a company registered in England and Wales. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services.

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This Policy applies to users aged 16 and over. Vialo is not intended for use by anyone under 16 years of age.

§ 02Data Controller

VIA HOUSE LTD is the Data Controller responsible for your personal data.

§ 03What Data We Collect

We collect and process the following categories of personal data:

3.1 Account information

• Full name or display name
• Phone number (for SMS OTP authentication)
• Date of birth (for age verification — UK GDPR Article 8, 16+ minimum)
• Profile photograph (optional)

3.2 Location data

• Approximate location at the borough level (any of London's boroughs)
• Derived from device GPS with your permission, or entered manually

3.3 Transaction and marketplace data

• Listings you create (title, description, photos, price, category)
• Purchase and sale history
• Payment method references (processed by Stripe; we do not store full payment card details)
• Bank payee name for transfer-based transactions

3.4 Communication data

• Chat messages exchanged with other users
• In-app notifications you receive
• Read receipts and message metadata (timestamps, delivery status)

3.5 Ratings and reviews

• Reviews you post about other users
• Reviews other users post about you

3.6 Device and technical data

• Device type, operating system, app version
• IP address
• Crash reports and error diagnostics
• App usage analytics

3.7 Verification data

• SMS verification codes (processed by Twilio)
• Confirmation of successful verification

§ 04How We Collect Data

• Directly from you: when you create an account, update your profile, list items, send messages, or make transactions
• Automatically: through your use of the App (technical data, usage analytics, location with permission)
• From third parties: payment confirmation from Stripe, SMS verification status from Twilio

§ 05Legal Basis for Processing

Under UK GDPR, we process your data under the following legal bases:

§ 06How We Use Your Data

We use your personal data to:

• Create and manage your account
• Verify your identity (SMS OTP)
• Display listings to nearby users in accordance with your neighbourhood
• Facilitate messaging between buyers and sellers
• Process transactions and payments via Stripe
• Send transactional notifications (new messages, transaction status)
• Protect the platform from fraud, abuse, and illegal activity
• Respond to your customer support enquiries
• Improve our services through aggregated analytics
• Comply with legal obligations and respond to lawful requests

§ 07Who We Share Data With

We share data only with the following categories of third parties, each bound by contractual data protection obligations:

We never sell your personal data to third parties. We may disclose your data if required by law, court order, or to protect the rights and safety of Vialo, our users, or the public.

§ 08International Data Transfers

Some of our service providers are located outside the UK (primarily the United States). Where data is transferred internationally:

• We rely on adequacy decisions where they exist
• Otherwise, we use Standard Contractual Clauses (SCCs) and, where applicable, UK International Data Transfer Addendums
• For US-based providers, we rely on their participation in the EU-US Data Privacy Framework where applicable

Our primary database (Supabase) is hosted within the UK/EU region (eu-west-2, London) to minimise cross-border transfers.

§ 09How Long We Keep Your Data

After these periods, data is deleted or anonymised. Backups are purged within 90 days on a rolling schedule.

You can delete your account at any time via Me → Settings → Delete Account in the app, or by emailing privacy@vialo.uk.

§ 10Your Rights

Under UK GDPR, you have the following rights:

1. Right of access — you can request a copy of the personal data we hold about you
2. Right to rectification — you can ask us to correct inaccurate or incomplete data
3. Right to erasure — you can request deletion of your data ("right to be forgotten")
4. Right to restrict processing — you can ask us to pause or limit processing in certain circumstances
5. Right to data portability — you can request a machine-readable copy of your data
6. Right to object — you can object to processing based on legitimate interests or for direct marketing
7. Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at privacy@vialo.uk. We will respond within one month.

§ 11Children's Privacy

Vialo is not intended for use by anyone under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it.

§ 12Cookies and Similar Technologies

Vialo is a mobile application and does not use browser cookies. However, we use:

• Device identifiers — for crash reporting and push notifications
• Session tokens — for authentication
• Local storage — for app preferences and offline functionality

You can reset device identifiers and revoke notification permissions through your device settings.

§ 13Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256 via Supabase)
• Row-level security policies on our database
• Regular security reviews
• Access controls and authentication
• Incident response procedures

However, no system is 100% secure. If you suspect unauthorised access to your account, contact us immediately.

§ 14Automated Decision-Making and Third-Party AI

Vialo uses three third-party AI services to provide core features. In compliance with UK GDPR Article 22 and App Store Review Guideline 5.1.2(i), we disclose all third-party AI usage transparently below.

14.1 Hive AI — Image moderation (mandatory)

When you upload photos to your listings, they are analysed by Hive AI (US) for prohibited content: nudity and sexually explicit imagery, weapons, drugs and drug paraphernalia, hate symbols, graphic violence, and self-harm content.

Decision impact: photos failing moderation prevent listing publication. This is a fail-closed automated decision essential to community safety on a user-generated content platform.

Data sent to Hive: the listing photo file. No personal identifiers (your phone number, name, etc.) are transmitted. Hive does not retain photos beyond returning the moderation result.

Right to object: under UK GDPR Article 21, you may object to Hive moderation. Because moderation is essential to safe operation of the Service, opting out requires account deletion. Email privacy@vialo.uk with "Moderation Objection" in the subject line.

14.2 Anthropic Claude — Text translation (optional)

When you tap the Translate button on a chat message or community post, the text is sent to Anthropic PBC (US) for translation into your preferred language.

User-initiated: translation only happens when you actively tap the button. You can disable Translate in app settings.

Data sent to Anthropic: the message or post text only. No metadata, sender identity, or context. Anthropic does not retain text beyond the translation request.

14.3 Anthropic Claude Vision — BYI listing assist (optional)

When you create a listing using the BYI ("Bring Your Item") flow, your uploaded photo and any text you have written may be sent to Anthropic PBC (US) to generate suggestions for title, description, category, hashtags, and condition.

User-initiated: you can review and edit all AI-generated suggestions before publishing. You can opt to skip BYI and create listings manually.

Data sent to Anthropic: the listing photo and any text fields you have populated. No personal identifiers. Anthropic does not retain photos or text beyond returning suggestions.

14.4 Your rights regarding automated decisions

Under UK GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.

• Translation and BYI assist: human-in-the-loop by design — you review and approve before publishing. Article 22 does not apply.
• Image moderation: fail-closed automation. If you believe a moderation decision was incorrect, you may request human review by emailing privacy@vialo.uk with "Moderation Review" in the subject line.

We do not use AI to make decisions about pricing, account standing, or other matters affecting your platform access without human review.

§ 15Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• In-app notification
• Email to your registered address
• Updated "Last updated" date at the top of this document

Your continued use of Vialo after changes take effect constitutes acceptance of the updated Policy.

§ 16Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data:

This Privacy Policy is governed by the laws of England and Wales. Any disputes arising from or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.