Privacy Policy

This Privacy Policy explains how Varmeli ("Varmeli", "we", "us", or "our") handles personal data when you use the WorthAI mobile application, website, support channels, and related services (collectively, the "Service"). Varmeli is the controller for the processing described here unless stated otherwise.

WorthAI helps users identify items from images and obtain estimated market and expected resale values. These outputs are estimates, not guaranteed sale prices.

1. Information we collect

Information you provide

• Account information, such as your email address, display name, authentication identifiers, and profile settings.
• Images and scan content you choose to submit, plus item details, condition notes, corrections, saved items, and collection data.
• Support communications, feedback, survey responses, and information you provide when reporting a problem.
• Setup answers you give when you start using WorthAI, such as your goals, the categories and marketplaces you use, how you heard about WorthAI, and, if you choose to answer, your gender. You can choose "Prefer not to say".
• Subscription and entitlement information. Payments are processed by Google Play or the Apple App Store; we do not receive your complete payment-card details.

Information collected automatically

• Device and app information needed to operate and secure the Service, such as operating system, app version, language, country or region, and diagnostic data. WorthAI does not intentionally collect the Android Advertising ID in the current release.
• Usage information, such as feature interactions, scan outcomes, timestamps, subscription status, request failures, and performance events.
• Security and network information, such as IP address, authentication events, and signals used to prevent fraud, abuse, and unauthorized access.

Information from other sources

We may receive authentication information from a sign-in provider, purchase and subscription status from Google Play and RevenueCat, and product or marketplace information from data providers and public sources. Marketplace information may include listing attributes, asking prices, and, when lawfully available, sold-comparable data.

Where WorthAI stores information

• On your device: saved collection items, scan photos, preferences, onboarding state, and local history are stored locally. On Android, photos may be written to WorthAI's private application files. Android backup is disabled in the current release.
• Collection backup: when you are signed in, your saved items and their photos are also backed up to your WorthAI account so you can restore them on a new or reinstalled phone. Location and camera details (EXIF data) are removed from photos before they leave your phone.
• In WorthAI's Supabase backend: account and authentication records, subscription entitlements, scan-usage records, metadata-only recognition results, and feedback you deliberately submit. Recognition telemetry records photo counts and derived identity data, but is designed not to store the scan images themselves.
• During a scan: selected images are transmitted to WorthAI's backend and then to AI/vision providers for transient analysis. This transmission is necessary to return the requested result; it is different from saving the image in your collection or improvement dataset.
• Marketplace connections: if you connect eBay, WorthAI stores an encrypted refresh token, marketplace identifier, connection metadata, and an eBay user identifier required for connection management and deletion compliance.

2. How we use information

• Provide, operate, personalize, and secure the Service.
• Analyze submitted images, identify items, estimate condition and value, and display comparable market information.
• Maintain local collections, scan history, account settings, and subscription access.
• Improve recognition and pricing quality by evaluating errors, user corrections, aggregate outcomes, and service performance. Where practical, we use de-identified or aggregated data for improvement.
• Process support requests and communicate important service, security, billing, or policy information.
• Detect fraud, misuse, technical failures, and violations of our Terms of Use; comply with law and enforce legal rights.

3. Legal bases under the GDPR

Where the GDPR or similar law applies, we rely on: (a) performance of our contract to provide requested features and manage subscriptions; (b) legitimate interests in securing, maintaining, and improving WorthAI, balanced against your rights; (c) consent where required, including for optional permissions or uses; and (d) compliance with legal obligations. You may withdraw consent at any time without affecting earlier lawful processing.

4. How we share information

We do not sell your personal data. We may disclose limited information to:

• Cloud hosting, database, authentication, AI processing, analytics, security, customer-support, and communications providers acting for us.
• Google Play and RevenueCat to process purchases, confirm subscription status, prevent fraud, and provide paid access.
• Marketplace and product-data providers when needed to perform a search or valuation request, including sending a scan photo to eBay's image search to find matching listings. We seek to avoid sending direct account identifiers unless necessary.
• Professional advisers, authorities, courts, or counterparties where required by law or necessary to protect rights and safety.

If WorthAI changes owner. If WorthAI or the company behind it merges, is acquired, or sells all or part of its business, your information may transfer to the new owner as part of that transaction. The new owner must keep the promises in this policy for the information it receives, and we will tell you before your information is transferred or becomes subject to a different privacy policy. Anonymous statistics may transfer without notice because they do not identify anyone.

Our providers may process data under their own terms where they act as independent controllers. Their services are subject to their respective privacy notices.

Current production provider categories

• Supabase: authentication, database, Edge Functions, and selected storage.
• OpenAI: image and text analysis used for recognition, research, and marketplace-quality checks.
• Google Cloud Vision: optional image annotation and identity evidence; Google Sign-In and Google Play may also process authentication and purchase data.
• RevenueCat: subscription entitlement and purchase-event processing for Google Play and, if enabled, Apple App Store.
• eBay: marketplace search, connected-account authorization, listing workflows, and marketplace-account deletion notifications.

We periodically review provider configurations, data-processing terms, subprocessor locations, and model-training controls. We will update this policy before adding a provider that materially changes how personal data is processed.

5. Images, camera access, and AI processing

WorthAI accesses the camera or photo library only after you choose to grant the relevant permission. Submitted images may contain personal information in the background. Review images before uploading and do not submit confidential material or images of people who have not consented.

Images and related descriptions may be processed by automated systems to recognize products, infer attributes, find comparables, and produce estimates. Automated outputs can be wrong. WorthAI does not make decisions that produce legal or similarly significant effects about you.

WorthAI configures OpenAI API requests not to store responses for application use and does not opt submitted content into provider model training. OpenAI may nevertheless retain API abuse-monitoring data for up to 30 days unless Zero Data Retention applies. Google Cloud Vision states that synchronous image content is processed in memory and is not used to train its models.

Anonymous price statistics (on unless you turn it off)

When you save a scanned item, set an asking price, or record a sale, we use the product details (category, brand, model), its condition, the price and currency, the month, your country (from your phone's language and region setting), how confident our recognition was, and whether you corrected it. We use this to build anonymous statistics about resale prices and about how well recognition works. We do this based on our legitimate interest in giving everyone better prices and recognition. These statistics never include your name, account, photos, notes, or exact dates, and a figure is only kept, published, or shared when at least 5 different people contributed to it. Your details wait at least 14 days before they are combined and are then deleted from the waiting area; the combined statistics cannot be linked to you and are kept indefinitely. You can object at any time by turning off "Anonymous price statistics" in Profile. Anything not yet combined is deleted immediately. Figures already combined cannot be removed because they no longer identify you.

Photo training (off unless you turn it on)

If you say yes, we keep copies of the photos from your later scans, together with the item details you confirm, to train and test our recognition. The legal basis is your consent. Photos taken before you said yes are never used. Location and camera details are removed from the copies, and they are kept in separate storage under a random code instead of your account; we keep the link between that code and your account only so we can delete your photos when you ask. We may leave out photos that show people, faces, or documents. We keep training photos for up to 3 years. You can withdraw at any time in Profile: we then delete your training photos and their details, normally within 24 hours, and leave them out of all future training. Saying no changes nothing else in the app.

Gender (optional)

During setup we ask your gender, and you can choose "Prefer not to say". If you answer, we only use it in totals to understand who uses WorthAI. It never affects prices or results, is not shared, and is kept with your setup answers until you delete your account.

6. Retention

Retention is tied to the data's purpose. Local collections and photos remain until you remove them, clear app data, or uninstall the app. Cloud account, entitlement, scan-usage, recognition, feedback, and connected-marketplace rows generally remain while the account exists unless deleted earlier. OAuth state records expire by design. Marketplace caches expire according to their stored expiry time. Billing-event and security records may be retained longer where necessary for accounting, fraud prevention, dispute handling, or legal compliance. Backups age out under provider backup schedules. De-identified product and market evidence may be retained because it no longer identifies an account.

Account-linked cloud rows are deleted when the account-deletion process completes, except where a longer period is necessary to meet legal, accounting, fraud-prevention, security, or dispute obligations. Operational provider logs and backups expire under the applicable provider schedule and access controls. We review retained records and delete or de-identify them when their stated purpose no longer applies.

7. Security

We use administrative, technical, and organizational safeguards designed to protect data, including access controls, encrypted transport, service monitoring, and restricted production access. No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your login credentials and device.

8. International transfers

Our providers may process information outside Sweden or the European Economic Area. Where required, we use recognized transfer mechanisms such as adequacy decisions, the European Commission's Standard Contractual Clauses, and supplementary safeguards.

9. Your choices and rights

• Access, correct, export, or delete eligible account information.
• Object to or restrict certain processing, and withdraw consent where processing relies on consent.
• Disable camera, photo, or notification permissions in device settings, understanding that related features may stop working.
• Turn off "Anonymous price statistics" or "Photo training" in Profile at any time.
• Cancel a subscription through Google Play or the Apple App Store. Deleting WorthAI does not automatically cancel a subscription.
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

To exercise privacy rights or request account deletion, use the in-app controls when available or email contact@varmeli.com. We may verify your identity before completing a request.

10. Children

WorthAI is intended for adults aged 18 and over and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.

11. Changes to this policy

We may update this Privacy Policy to reflect product, legal, or operational changes. We will post the revised version with a new effective date and provide additional notice when required by law.

12. Contact

Varmeli
Email: contact@varmeli.com
Website: https://www.worthai.app
Sweden

Reference framework

This policy is designed to support transparency obligations under the EU General Data Protection Regulation and Google Play's User Data requirements. Actual disclosures must remain consistent with WorthAI's implemented data flows and Google Play Data safety form.