Kistje
Last updated: 24 October 2026
Who is responsible for your data?
Kistje is the data controller for the personal data processed through this service. You can reach us at any time at support@kistje.eu for questions about this policy or your data.
What data do we collect?
Account data: your email address and a securely hashed password. Inventory data: the items you add, including names, prices, dates, rooms, household member names, notes, and photos. Settings data: your country, language, currency, and marketplace preferences. Usage data: privacy-preserving pageviews and basic browser metadata used to understand aggregate product usage. We do not collect advertising identifiers or behavioural profiles.
How do we use your data?
We use your data to provide the service: storing your inventory, extracting item details from your descriptions, finding and generating item photos, and estimating second-hand value. To do this, the text you type or dictate is sent to our AI provider, and the item name is sent to our image search provider. We never sell your data or use it for advertising.
Who processes data on our behalf?
Supabase stores your account and inventory data on servers in the European Union. Vercel hosts the application. MailerSend sends transactional emails such as sign-up confirmations. Mistral AI extracts item details and generates photos. Unsplash provides image search results. ImageKit stores and serves your uploaded photos. Umami Cloud (EU) receives cookie-free, sanitized pageview analytics. Marketplace price lookups (eBay and others) run server-side and do not include your personal data.
What about voice input?
Voice input uses the speech recognition built into your browser. On some browsers (for example Chrome) your audio is sent to the browser vendor's servers for transcription. It is never sent to or stored by Kistje. Every voice feature has a text alternative, so you never have to use it.
What is the legal basis?
We process your data to perform the contract you enter into when you create an account (GDPR Art. 6(1)(b)). We rely on legitimate interests (Art. 6(1)(f)) for security, abuse prevention, privacy-preserving usage analytics, and service improvement.
How long do we keep your data?
We keep your data for as long as your account exists. When you delete your account in Settings, your items, photos, settings, and credentials are permanently removed from our systems.
What are your rights?
You can export all your data as JSON from Settings (access and portability). You can correct any item or setting at any time (rectification). You can delete your account and all associated data (erasure). You may also object to processing or request restriction, and you can lodge a complaint with your local supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.
How do we protect your data?
All traffic is encrypted in transit. Database access is isolated per user through row-level security, and photos are stored under per-user paths. External API calls happen server-side so third parties never see your credentials.
Can this policy change?
Yes. If we make material changes we will update the date at the top of this page and, where appropriate, notify you by email.