Privacy notice
Effective from 01.08.2026 · version 1.1
This notice explains what personal data Kuulu processes, why, on what legal basis, how long we keep it, who processes it for us, and the rights the GDPR gives you. It is written to be read: plain language, no surprises.
The short version: we collect only what running a verified marketplace needs, your data is stored in the European Union, we sell nothing to anyone, and you can export or delete your data yourself at any time.
1. Who is responsible for your data
The controller of your personal data is Berryfoot Brewing Co. OÜ (trading as Kuulu; registry code 16905016, address Tornimäe tn 5, 10145 Tallinn, Harju maakond, Estonia) — the company operating Kuulu at kuulu.ee, kuulu.lv, and kuulu.lt.
For anything in this notice, write to legal@kuulu.ee (privacy and legal matters) or support@kuulu.ee (general support).
2. What data we have about you
Identity data from sign-in: when you sign in with Smart-ID or Mobile-ID (through the Authentigate service of SK ID Solutions AS), we receive your legal name, your national identification code, and the verification method used. We store the name, the method, and the time of verification — and instead of the ID code itself, only an irreversible check code computed from it (section 4).
Account and settings: display name, language, theme, notification settings, and — only if you add one yourself — a notification email address.
What you post: listings (title, description, price, and general location — city and county), listing photos (your browser strips camera metadata such as GPS location before upload), messages you exchange with other users, saved searches and saved listings, and unfinished drafts.
Technical data: a session cookie that keeps you signed in; the IP address seen during sign-in, kept briefly for rate-limiting; and, if you turn on notifications, your browser’s push subscription (its endpoint address and delivery keys).
We build no advertising profiles and we buy no data about you from anyone.
3. Why we use your data, and on what legal basis
Running the marketplace — your account, listings, search, messaging, and saved items: necessary to perform our contract with you (GDPR Article 6(1)(b)).
Verifying identity and keeping one account per person — the promise that every seller is a real, verified person, including keeping banned identities from registering again: performance of the contract and our legitimate interest in an honest marketplace (Article 6(1)(b) and 6(1)(f)).
Safety and moderation — automatic screening of new listings (photos and text), handling reports from users, and preserving evidence of confirmed fraud: legitimate interest (Article 6(1)(f)) and, for handling reports of illegal content, our obligations under the EU Digital Services Act.
Notifications — email only to an address you have added and confirmed through the confirmation link (double opt-in), with per-type switches; push notifications only after you allow them in your browser: consent (Article 6(1)(a)), withdrawable at any time.
AI listing assistant — when you choose to start a listing from photos, those photos are sent to an AI service to suggest a draft: performance of the contract, at your request (section 6 covers where the photos go).
Translations — showing listings and messages in your language can use a machine-translation service: our legitimate interest in a marketplace that works across three countries and five languages.
Error monitoring — when something breaks, a scrubbed technical error report (no IP address, no email address, no message content) helps us fix it: legitimate interest.
4. Your national ID code — what we actually store
Your national identification code identifies you uniquely for life, so we treat it with special care. During sign-in the code is immediately transformed with a keyed one-way function (HMAC-SHA256 with a secret key held only on our servers) into a 32-byte check code. Only that check code is stored; the raw ID code is never written to our database or our logs.
The check code is still personal data and is protected as such. We use it for exactly two things: recognising that the same person is signing in again (one account per person), and — if an account is banned for fraud — keeping that ban effective even after the account and its data have been deleted.
5. Who processes data for us
Kuulu runs on European infrastructure, with a short list of service providers processing data on our behalf under GDPR data-processing terms:
Hetzner Online GmbH (Germany) hosts the Kuulu application in Falkenstein, Germany. Nhost AB (Sweden) provides our database and file storage, running on AWS in Frankfurt, Germany. SK ID Solutions AS (Estonia) operates the Smart-ID and Mobile-ID sign-in (Authentigate). Scaleway SAS (France) delivers our emails. Mistral AI (France) processes photos for the AI listing assistant; for the minority of drafts it is unsure about, Google (Gemini) and Anthropic (Claude) can give a second opinion — see section 6. DeepL SE (Germany) machine-translates listings and messages when translation is enabled. Sentry receives scrubbed technical error reports, stored in its EU data centre.
Push notifications are delivered by your own browser’s push service (Google, Apple, Mozilla, or Microsoft, depending on the browser); their content is encrypted so the push service cannot read it.
Any visit statistics we collect come from our own self-hosted, cookieless counter, which stores no personal profiles and cannot follow you across sites. We also count search terms: each term is tallied only as an anonymous total, with no link to the person who searched. We never sell your data, and nobody receives it for advertising.
6. Where your data lives
Your data is stored and processed in the European Union: our servers are in Germany, and the providers in section 5 process data in the EU.
One narrow exception: if the EU-based AI model is unsure about a photo draft, the photos — and nothing else: no name, no account data — may be checked by Google’s or Anthropic’s AI service, which can involve processing outside the EU/EEA under the EU–US Data Privacy Framework safeguards. This happens only for the minority of drafts that need it, and only when you use the photo assistant.
7. How long we keep things
Your account, settings, listings, messages, and saved items: for as long as your account exists. Deleting the account removes or anonymises them (section 8).
Listings expire from public view 30 days after publishing, but stay in your account until you delete them or the account.
Messages: when an account is deleted, its name is removed from conversations and the remaining copies are anonymised for the other participant.
Fraud evidence: material attached to an unconfirmed fraud report is deleted after 60 days; evidence of confirmed fraud is kept for 5 years (legitimate interest, Article 6(1)(f)).
Ban records: one irreversible check code per banned identity (section 4), kept after account deletion so the ban holds.
Sign-in technical records (sign-in challenges, rate-limit counters, and the sign-in IP address): minutes to hours.
Data-export archives: the download link expires after 30 minutes, and the archive itself is deleted when your account is deleted.
8. Your rights — and the buttons that exercise them
Access and portability (Articles 15 and 20): on your account page, “Export my data” emails you all your data as a single machine-readable JSON file after you re-verify your identity.
Erasure (Article 17): on your account page, “Delete account” permanently deletes your account after a typed confirmation and an identity re-verification. What outlives deletion is exactly what section 7 lists: confirmed-fraud evidence and, where applicable, the ban check code; listings and messages are anonymised.
Rectification (Article 16): edit your profile and listings directly on Kuulu; for anything you cannot edit yourself, email us.
Objection and restriction (Articles 18 and 21): email legal@kuulu.ee.
Withdrawing consent: switch notification emails off or remove the address on your account page, use the unsubscribe link in any email, or revoke the push permission in your browser. Withdrawing does not affect processing that already happened.
We answer every request within one month, free of charge.
9. Automated decisions
Two automated checks can affect your listings. First, every new listing’s photos are screened automatically before publishing: a clearly problematic photo stops publication, and an uncertain one puts the listing on hold — invisible to others — until a person on our team reviews it. Second, if several different users report the same seller within a week, that seller’s listings are hidden automatically until a person reviews the account.
In both cases a person makes the final decision, so no decision with legal or similarly significant effect is made solely by a machine (Article 22). Beyond this we do no profiling and no automated decision-making.
11. If you are unhappy
Start with us: legal@kuulu.ee — a person reads it and replies.
You also always have the right to complain to a data-protection authority: in Estonia the Andmekaitse Inspektsioon (aki.ee), in Latvia the Datu valsts inspekcija (dvi.gov.lv), in Lithuania the Valstybinė duomenų apsaugos inspekcija (vdai.lrv.lt), or the authority of your own EU country.
12. Age limit
Kuulu is for adults: you must be at least 18 years old to create an account, as the terms of service state.
13. Changes to this notice
When our data processing changes, we update this notice and its date. Material changes are announced on Kuulu. The current version always lives on this page.