Privacy Policy
Last updated: 21 October 2026
1. Data Controller
Impulsio AI (“we”), a publisher established in Spain, is the controller of your personal data collected through impulsio.ai. For any questions about your data, contact us at: contact@impulsio.ai. Impulsio AI is independent: it is neither affiliated with Vinted nor endorsed by Vinted.
2. Data Collected
We collect the data you provide when creating your account (email address, first name), the email address you leave in the sign-up form on the site, service usage data (photos you send, generated listings), the feedback you send us with the feedback button, together with the screenshot of the page, which you see before sending and can remove, your answers to the start and end of beta questionnaires, and technical data (IP address, browser type, pages visited) for statistical purposes.
Images produced by artificial intelligence. Images that the Studio produces or edits with artificial intelligence carry, in the metadata of the file you download or that the extension places in the Vinted form, an invisible marker stating that they were generated by AI, as required by Article 50 of the EU Artificial Intelligence Act. This marker contains neither your name nor your account identifier. The platform where you publish the image receives the file with this marker and can read it; it can also erase it when it transforms the image.
3. Purposes of Processing
Your data is used to: provide and improve the service, manage your account and your credits, send you service-related messages (invitation, address confirmation, important information), understand during the beta what works and what gets in the way, through your feedback and your questionnaire answers, and analyse how the service is used in aggregate.
4. Legal Basis
Data processing is based on: performance of contract (service provision), your consent (marketing communications, publication of a review or a photo), our legitimate interest (service improvement, security), and compliance with legal obligations. Consent to marketing communications is separate from creating an account: the box is never pre-ticked, you can leave it empty without losing anything in the service, and you can withdraw that consent as easily as you gave it. Every message carries an unsubscribe link. Permission to publish a review, a photo or a screenshot of your shop follows the same rule and is withdrawn the same way; it is set out in article 13 of the Terms, at /en/cgu.
The buyers you talk to on Vinted. To prepare your replies, the extension reads your conversations and sends us the buyer's last message and username; in automatic mode, it also opens your unread conversations. For this data, we act as controller, on the basis of legitimate interest, yours and ours, in replying to the buyer who wrote to you. It is used only to prepare that reply: we do not store it, we build no profile from it, and it is passed only to the AI model that writes the reply (section 6). Only these remain, with no name, username or message: for 24 hours at most, a technical fingerprint that cannot be turned back into the message and stops the same reply being counted twice; for 14 days at most, the conversation number on Vinted, so that the site's bell opens the right conversation. A buyer can exercise their rights, including the right to object, by writing to us at contact@impulsio.ai.
5. Data Retention
Your account data is kept while your account is open, then for 3 years after it is closed, unless the law requires otherwise. If you ask for your account to be deleted, deletion happens without waiting for that period, following the procedure in section 7. Email addresses left in the sign-up form are kept until you withdraw your consent, and no longer than three years after the last contact. Photos you send for a bulk listing are kept until 7 days after that bulk listing ends, then erased. Photos in My creations are kept until you remove them or delete your account. A technical copy of the photos produced, used to resume an interrupted process, is erased by a daily task once it is more than 24 hours old. Screenshots attached to feedback are kept for 90 days, then erased. The text of your feedback is kept during the beta, then for no more than 12 months after it ends, and deleted afterwards. Questionnaire answers are kept until the end of the beta plus 12 months, then anonymised: they are no longer linked to you. No payment is collected today; if payments are ever collected, billing data will be kept for the period required by Spanish law. To limit abuse, the relay that displays images from Vinted inside the service keeps a hashed and salted fingerprint of your IP address, never the address itself, for 48 hours.
6. Data Recipients
We use the following processors, and only these. Anthropic (Claude AI models), to analyse your photos and write your listings and your replies to buyers. OpenAI and Google (Gemini AI models), to create and enhance your photos (background removal, studio photo, models, backgrounds, photo enhancement). If you create a custom model from a photo of your face, that photo is sent to OpenAI to produce the model; it is not published. Supabase, for the database and account management. Vercel, to host the site and measure visits without cookies. Umami, to measure how the service is used, also without cookies and without any personal identifier. Resend, to send emails (invitation, address confirmation, service messages): messages are sent from the European Union (Ireland), but Resend, a company based in the United States, stores their content and the sending logs there. Google again, to measure site traffic, and Microsoft, to understand how the site is used: these two are only loaded after your consent, and only on the public site, never inside the app, and declining them has no effect on your access to the service. Finally, Google, if you choose to sign in with your Google account: it confirms your identity and sends us your email address, your name and your profile photo. Microsoft does the same if you sign in with your Microsoft account: it confirms your identity and sends us your email address. Meta will play the same role, on the same terms, once signing in with its account is offered. Nothing is posted to those accounts. Each one receives only what it needs for that task. We never sell your data. Some of these processors are established outside the European Union or host part of their services there: those transfers are covered by the European Commission's standard contractual clauses and, for those that have joined it, by the EU-US Data Privacy Framework.
7. Your Rights
Under GDPR, you have the following rights: access, rectification, erasure (“right to be forgotten”), restriction of processing, portability, and objection. To exercise your rights, contact us at contact@impulsio.ai. If our answer does not satisfy you, you can complain to the Spanish data protection authority, the AEPD (Agencia Española de Protección de Datos), which the publisher answers to. You can also complain to the data protection authority of your own country. To delete your account, go to My account, under “Delete my account”. Deletion is immediate and final, and an email confirms it. It erases your account and profile, your credits, your creations and all their images, your questionnaire answers, your feedback and its screenshots, your sign-up to the mailing list, the extension data linked to your account and the log of emails we sent you. Only the cost measurement of each action remains, detached from your account. Database backups and our email provider's sending logs are then erased automatically, without being consulted: within 7 days for backups, within 30 days for sending logs. If you can no longer log in, email us at contact@impulsio.ai from your account's address: we confirm receipt, then the deletion, within one month at most. To get a copy of your data, use the “Request a copy of my data” button in My account, or email us at the same address.
9. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction (encryption, restricted access, regular backups).
10. Amendments
We may update this policy at any time. Any material change will be notified by email with 15 days' notice. The last updated date is shown at the top of this document.
11. The Chrome extension
This section covers the Impulsio AI extension for the Chrome browser. The extension works on Vinted pages in your own browser, with your Vinted session already open. It never asks for your Vinted password and does not store it.
The screen shown by the extension, which addresses the user informally like the rest of the extension, says exactly this:
“The extension reads and fills in Vinted pages in your own browser, with your session. By default it prepares and you approve everything before it is sent. The automatic modes are off at the start: if you switch them on, one function at a time, they act on your behalf, with an hourly and daily cap. They send messages, make a counter-offer, accept or decline an offer, send a message and an offer to members who add your item to their favourites, open your unread conversations to reply, and publish in bulk.
Vinted may consider the extension, and above all its automatic modes, contrary to its terms, and restrict or close your account. That risk is yours.”
The automatic modes. If you switch them on function by function, the extension can reply to offers (counter-offer, acceptance or refusal), reply to buyers' questions, send a thank-you message after a purchase, follow up members who have added your items to their favourites, with a message and an offer that never goes below your floor price, and publish listings on your behalf, as long as your browser is open and signed in to Vinted. To reply to offers and questions in automatic mode, the extension also opens your unread conversations and reads the messages in them; Vinted then shows them as read. Each function has an hourly and daily cap and variable delays between two actions; these caps are counted separately in each browser. Relisting and removing old listings, which you confirm yourself, also have their own hourly and daily cap, even without an automatic mode. The automatic modes never delete a listing. A listing is deleted only at your request, after you confirm it in an extension window: the old listing after a relisting, or the listings you choose to remove from your dashboard, which you can also simply hide. To write these messages, the data listed below goes to us and to our processors, as in semi-automatic mode. Vinted has its own terms, which may prohibit this type of use: see the corresponding article of the terms of use. For its safeguards, the extension reads the alerts and banners on Vinted's pages (verification, restriction, limit, error); what it reads there stays on your device, and only a possible pause becomes a notification (see below).
Catch-up. If a conversation function is in automatic mode, when you reopen your browser or wake your computer, the extension reads the list of unread conversations in your Vinted inbox and keeps only their numbers, on your device. It then reopens these conversations one by one, 15 at most, within the same caps, to reply as if the tab had stayed open. Favourite follow-ups in automatic mode resume in the same way. This list is not sent to us.
The permissions it requests, and why. “storage”: to keep your settings and the link to your account on your device. “alarms”: to sync your settings and page markers every fifteen minutes. Access to Vinted sites in twelve countries (vinted.fr, vinted.es, vinted.de, vinted.it, vinted.nl, vinted.pl, vinted.co.uk, vinted.be, vinted.lu, vinted.ie, vinted.pt, vinted.at): to act on your own pages. Access to impulsio.ai: to link the extension to your account. An optional permission, access to a local server, is never requested at installation: it is only used for the publisher's own testing, and only if local mode is switched on by hand.
Before any action, the extension shows a consent screen, and nothing works until you have accepted it. This is what it says, word for word:
In short: it reads your Vinted listings and conversations. It sends us the text to write (with your prices and instructions), the buyer's last message and username, the list of your listings, the events that need action from you (without the buyer's name or messages), usage counts and, if an action fails, a technical report; the text goes through an AI model (Claude, by Anthropic). Never your Vinted password or your bank details.
What the extension reads
- Your Vinted session, open in this browser
- The listings in your closet
- Your conversations with buyers
- The photos and text of your listings
What goes to our servers
- The text to write or reword, with what is needed to write it: the listing and offer prices, your floor price, your instructions and your info sheet
- The buyer's last message and username, each time a reply is prepared
- The list of your listings (title, price, photo, link, views, favourites, status), to show it on your dashboard and spot duplicates
- Events that need action from you (offer accepted, declined or countered, pending offer, unanswered question, sale, pause), with their date and the conversation and listing numbers on Vinted, to show them in the site's bell, on your other devices too. With them, the country's Vinted site (vinted.co.uk, vinted.fr…) and the record of favourite follow-ups in Automatic: how many went out on their own that day, and those sent without an offer or that failed. Never the buyer's name, username, messages or amounts. Deleted after 14 days at most.
- Usage counts, with no content: the extension was installed, its window was opened, a listing was filled in, an offer was prepared, an automatic mode was switched on or off, or an action failed (fill in, relist, offer, favourites). Never the address of a page or any text. They help us see what works and what gets in the way.
- When an action fails, a technical report: the error message, the action attempted, the type of page, the market and the version numbers. Never the full address of the page, its content, or a buyer's message or username.
- The language to answer in
- An artificial intelligence model (Claude, provided by Anthropic) processes it to produce the reply
What never leaves
- Your Vinted password
- Your bank details
- The full address of the pages you visit
- Nothing is sold on to third parties
“No code is downloaded remotely: everything the extension runs is in the installed package.”
“When you ask from your dashboard, and only after you confirm in an extension window, it can hide duplicate listings. No listing is deleted unless you have confirmed it, and never in automatic mode.”
Reports. The “Report a problem” button sends what the screen announces, word for word: “Sent: what you write here, the page type, the market and the version numbers. Never the full page address, never its content.” When an action of the extension fails, a technical report is also sent automatically: the time, the error message, the action attempted, the page type, the market, the version numbers and page markers. Never the full page address, its content, or a buyer's message or username.
Withdrawal. The “Withdraw my consent” button, in the extension window, withdraws your consent and unlinks the extension from your account, in one step, at any time. The consent screen puts it this way: “You can switch it off at any time, and withdraw your consent with one button.”
What the service keeps for the extension, and for how long. This data is tied to your account, and to it alone: your settings, the proof of your consent (date, text shown, language), the state of the listings the extension reads (1,000 at most), the instructions you send it from the site and the listing packages prepared for it. An unread instruction is deleted after 24 hours. A listing package can be read only once, only by the account that created it, and expires after 15 minutes. When a report arrives without a signed-in account, only a hashed and salted fingerprint of the IP address is kept, for 48 hours, to limit how many can be sent. No page address is stored: a web address slipped into an error message is replaced before it is written.
Vinted notifications. When the extension sees an event on Vinted that needs action from you (an offer accepted, declined or countered by the agent, a pending offer, an unanswered question, a sale, a pause set after a signal from Vinted), it also sends it to your account, so that the site's bell can show it to you on your other devices. What is kept: the type of event, its date, the conversation number and the listing number on Vinted. Also kept: the country's Vinted site where the event was seen (vinted.co.uk, vinted.fr…), to open the conversation on the right site from the bell, including on your phone, and the record of favourite follow-ups in automatic mode: the number of follow-ups sent on their own that day, a follow-up sent without its offer, and a follow-up that could not be sent. Not the buyer's name, username, messages or amounts. These notifications are deleted after 14 days at most, when you withdraw your consent to the extension, and along with your account. A copy, 30 at most, also stays in your browser for 14 days at most; it is deleted when you switch accounts or withdraw your consent.
The texts sent are processed by the processors listed in section 6, under the same conditions as the rest of the service.
contact@impulsio.ai