REEVENDY — Privacy Policy

Version: 1.0-rc2 · Effective date: 2026-06-27

Tunisian marketplace for luxury and thrift goods.

1. Introduction

REEVENDY (“we”, “us”, “notre application”) is a mobile marketplace application operated by Mohamed Khalil BECH, based in Ariana, El Menzah 7, Cité El Fellah, 2037, Tunisie.

This Privacy Policy describes how we collect, use, and protect your personal data when you use the REEVENDY mobile application (the “App”).

Contact for privacy questions: ea.reevendy@gmail.com · Phone: +216 52 032 181

Data Protection Officer: Aucun DPO formel désigné actuellement. Pour toute question relative à la protection des données, contactez-nous à l'adresse ci-dessus.

2. Data we collect

2.1 Data you provide

• Account data: email, first name, last name, phone numbers (one or two), and address. Required to create a buyer or seller profile.
• Product listings: name, description, brand, price (and optional price range, purchase year, purchase price), and 1 to 5 photos in JPG or PNG format, each up to 10 MB.

2.2 Data collected automatically

• Authentication tokens: Keycloak access and refresh tokens, stored on your device using Android’s secure storage (Keystore + EncryptedSharedPreferences). These are never written to plain text files.
• Network data: Des journaux techniques, y compris les adresses IP et métadonnées associées, peuvent être traités à des fins de sécurité, de prévention des abus, de diagnostic et de maintenance du service.

2.3 Data we DO NOT collect

Based on the current mobile code:

• No device identifiers: we do not collect device model, OS version, advertising ID, or IMEI.
• No location data: we do not access GPS. The “location” field in product creation is a manually selected Tunisian city from a predefined list.
• No camera access: the App only opens your gallery via the system picker; direct camera capture is not available.
• No analytics or advertising SDKs: the App does not include Firebase, Google Analytics, Crashlytics, Sentry, Facebook, or similar third-party trackers.

Engagement RC1: aucun SDK analytics ne sera intégré à l'application avant la prochaine mise à jour de cette politique. Tout ajout futur sera annoncé conformément à la section 11 et fera l'objet d'une mise à jour de la présente politique préalablement à tout déploiement.

3. How we use your data

We process your data to:

• Authenticate you via Keycloak (OAuth PKCE flow).
• Display and manage your profile.
• Allow you to publish, edit, and browse product listings.
• Allow buyers to make offers and sellers to accept, decline, or counter them.
• Process orders under the Cash-on-Delivery model used in Tunisia.
• Secure the App and prevent fraud.

We do not:

• Sell your personal data.
• Share your data for cross-context advertising.
• Build profiles based on your behavior for third-party use.

4. Legal basis (Tunisian Law 63-2004, 27 July 2004)

We process your personal data under the following bases, as permitted by Tunisian Law 63-2004 on the protection of personal data:

Processing purpose	Legal basis
Account creation and authentication	Performance of a contract (Article 4)
Publication of product listings	Performance of a contract (Article 4)
Processing offers and orders	Performance of a contract (Article 4)
Storing IP logs for security	Our legitimate interest in protecting the service (Article 4)
Storing profile and listing photos	Consent (you provide the data voluntarily to list a product)

Version opérationnelle fournie de bonne foi, susceptible d'ajustements après revue juridique complémentaire si nécessaire.

You may withdraw consent for photo processing at any time by deleting your listings or contacting us at the email in §1.

5. Data sharing

We share your data only with the following processors, strictly to operate the service:

• Keycloak (authentication provider): processes your login credentials. Hosted at https://auth.reeventy.tn.
• Backend API: stores your account, listings, offers, and orders. Hosted at https://api.reeventy.tn.
• Subprocessors: prestataires techniques d'hébergement, d'authentification et de stockage strictement nécessaires à l'exploitation du service.
• No other third parties receive your data, except where required by Tunisian law.

6. International transfers

Your data is intended to be processed within Tunisia.

Certaines données techniques peuvent être stockées ou traitées en dehors de la Tunisie selon les prestataires techniques utilisés, notamment si des services d'hébergement ou de stockage opèrent depuis d'autres juridictions. Le cas échéant, des garanties contractuelles appropriées seront mises en place.

7. Data retention

We retain your data for the following periods:

Data type	Retention
Authentication tokens (device)	Deleted from your device when you log out
Account data (backend)	Kept while your account is active; deleted on your request within 30 days
Product listings and photos	Kept while your account is active; deleted on your request within 30 days
Backend logs (including IP)	30 jours

To request deletion, contact us at the email in §1. See §9 for your full rights.

8. Security

8.1 Measures in place

• Transport security: all API calls use HTTPS. Cleartext traffic is blocked by the App’s network_security_config.xml.
• Token storage: tokens are stored in Android’s secure storage (Keystore-backed).
• Logging hygiene: release builds do not log personal data (email, phone, address, tokens, or exception bodies). All developer.log calls are gated behind kDebugMode.
• Client-side image validation: photos uploaded by the seller are validated for extension, size (≤ 10 MB), and count (≤ 5) before transmission.
• Code-level security review: an internal mobile security review was conducted in June 2026.

8.2 Known limitations

• During RC1, the App’s Keycloak integration uses a compatibility flag (allowInsecureConnections) for transitional compatibility with the staging environment. This flag must be removed before the stable release.
• Logout removes tokens from your device but does not call Keycloak’s endSession endpoint. The refresh token remains valid on Keycloak’s side until it expires.
• Server-side image upload validation (MIME / magic bytes) is the backend’s responsibility.

9. Your rights

Under Tunisian Law 63-2004 and, where applicable, the GDPR, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Object to processing based on legitimate interest.
• Receive a portable copy of your data.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, contact us at ea.reevendy@gmail.com.

We will respond within 30 days. If we refuse, we will explain why and inform you of your right to lodge a complaint with the Tunisian National Authority for the Protection of Personal Data (INPDP).

Processus de suppression: accusé de réception des demandes sous 7 jours ouvrés. Traitement dans un délai maximal de 30 jours, sauf obligation légale ou contrainte technique justifiée.

10. Children

The App is not directed at children under 16. We do not knowingly collect data from children under 16.

If you believe a child under 16 has provided us with personal data, please contact us at the email in §1 and we will delete it.

Contrôle d'âge: aucun contrôle d'âge formel n'est actuellement appliqué à l'inscription. Une vérification explicite sera considérée pour une version ultérieure.

11. Changes to this policy

We may update this Privacy Policy. Material changes will be announced at least 30 days before taking effect via:

• An in-app notification on your next App launch.
• A note in the Play Store update description.
• The “Last update” date in §12.

Continuing to use the App after the effective date means you accept the updated policy.

12. Date of last update

2026-06-27 — v1.0-rc2.