Privacy policy
Last updated: 2026-10-19
This policy explains which personal data Trendmint processes, why, how long we keep it and what you can do with it. We describe what is actually stored, not what could be stored.
In short
- We store what is needed for you to have an account and for the service to work: your email address, your password (as a hash), what you save yourself and a short log of how the service is used.
- We have no advertising or tracking cookies, we never sell your data and we only share it with the services that run Trendmint.
- Your AI questions are sent to Anthropic so that an answer can be written. Do not enter sensitive information or other people's personal data.
- You can export and delete all of your data yourself under Settings.
- The service also shows public information about shops and advertisers. If that is a sole trader it can be a person, and you can then ask for correction or removal.
1. Who is responsible for your data
Maximilian Stefanov and Kristijan Stanojkovic, acting as private individuals, are joint controllers of the personal data processed when you use Trendmint. This means that we decide why and how the data is processed.
Send questions about personal data to Maximilian.stefanov1@gmail.com. We do not have a data protection officer.
2. Which data we process and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email address and password | Create the account, sign you in and send the emails that belong to the account (confirmation, password reset). The password is only stored as a hash at Supabase; we cannot read it. | Contract | Until you delete the account |
| Acceptance of the terms and policy (version and time) | Be able to show that you accepted the terms when you signed up. | Legitimate interest (proving the agreement) | Until you delete the account |
| What you save yourself: saved items, followed and hidden advertisers, saved views, products, calculations, supplier ratings and orders, brand profile, company details and guide progress | Give you the features you use. | Contract | Until you remove it or delete the account |
| AI questions: a short summary (at most 500 characters) and the time | Count usage against your plan and limit abuse. The answer itself is not stored by us. | Contract | Until you delete the account |
| Usage events: sign-up, sign-in, saved item, followed advertiser, guide step, started payment. Only the name of the event and the time; no IP address, no page, no text | Understand whether and how the service is used so that we can improve it. | Legitimate interest | Until you delete the account |
| IP address and a hash of the email address, in an abuse counter that stops attacks on sign-in, sign-up and password reset | Protect the service and your account against automated attacks. | Legitimate interest (security) | About one day |
| Plan and status. When payment is active, also customer and subscription IDs at Stripe (never card numbers) | Manage your subscription. | Contract | Until you delete the account |
| Payment and invoice records (when payment is active) | Bookkeeping. | Legal obligation (Swedish Bookkeeping Act) | 7 years after the end of the financial year |
| Clicks on outgoing supplier links: time, supplier and the domain you came from. No account ID is attached to the click | Count how often suppliers are visited. | Legitimate interest | 180 days |
| Technical logs at our hosting provider (IP address, time, browser) | Operation, troubleshooting and security. | Legitimate interest | A limited time according to the provider's routines |
We make no decisions about you that are based solely on automated processing and that have legal effects for you. We do not use any data for advertising and we do not build profiles about you outside the service.
Where the legal basis is legitimate interest you have the right to object, see section 9.
3. Email we send
We send the emails that belong to the service: confirmation of your email address, password reset and change of email. We may also send a weekly summary of new ads from advertisers you follow. It is information about a feature you use yourself, not advertising.
We do not send newsletters or marketing unless you have first said yes to it.
4. The AI assistant
When you ask the assistant a question, your text, and the parts of our product data needed for the answer, are sent to Anthropic, which provides the Claude AI model and processes the data on our behalf.
The answers are written automatically by an AI system and may contain errors. The assistant makes no decisions about you.
Do not enter sensitive information (for example about health) or other people's personal data in the assistant. It is not needed to get an answer.
5. Public information about shops, advertisers and suppliers
Trendmint shows information that is already public: shops' product lists, ads and advertisers in public ad libraries, and suppliers' products. Most of it is information about companies. A sole trader, or a personal name in an ad, can however be personal data.
We process such data based on legitimate interest: giving online sellers a basis for their decisions. We only include what has been published and add nothing from other sources. Because we do not have contact details for everyone who appears in such information, we give the information here instead of individually. Images of ads and products may be stored as copies by us, because links to them otherwise expire.
If you appear in such information you can ask us at any time to correct or remove it by emailing Maximilian.stefanov1@gmail.com. We remove it without delay unless there is a compelling reason to keep it. More about how we collect the information is under Cookies and tracking.
6. Who receives data
We use providers that process data on our behalf (processors) and we have data processing agreements with them. They may only use the data to perform their service for us.
| Provider | What they do for us | Which data they can reach |
|---|---|---|
| Supabase | Database, sign-in and file storage | Everything listed in section 2 |
| Vercel | Runs the website and delivers the pages | Web traffic and technical logs (including IP address) |
| Anthropic | The AI model behind the assistant | The text of your question and excerpts of product data |
| Resend (when email sending is on) | Sends email | Your email address and the content of the email |
| Stripe (when payment is switched on) | Receives payments | What the payment needs; card details are handled only by Stripe |
| Cloudflare (if bot protection is switched on) | Checks that sign-in and sign-up are done by a human | Browser data and IP address at sign-in and sign-up |
We never sell data and we only hand it to authorities when the law requires it.
7. Transfers outside the EU/EEA
Some providers, above all Anthropic and Vercel, may process data in the USA or other countries outside the EU/EEA. The data is then protected through the EU–US Data Privacy Framework (for certified providers) or through the European Commission's standard contractual clauses, together with supplementary safeguards where needed. You can ask us which protection applies to a particular provider.
8. How long we keep data
The table in section 2 states the retention time for each kind of data. Everything that belongs to your account is kept for as long as the account exists.
When you delete the account, the account and all data that belongs to it are removed from the database, and an ongoing paid subscription is ended first. Backups at our database provider may remain for a limited time before they are overwritten. Invoice records are kept for as long as the Bookkeeping Act requires.
9. Your rights
You have the right to:
- know which data we have about you and get a copy. You can download it yourself under Settings (Export my data).
- have data corrected. You change your email address and password under Settings.
- have it deleted. You delete the account under Settings; everything that belongs to it is then removed.
- restrict the processing in some cases, and move your data (the export file can be read by other systems).
- object to processing that is based on legitimate interest. We then assess whether our reason outweighs yours.
- withdraw consent you have given, at any time.
Contact Maximilian.stefanov1@gmail.com if you need help. We reply within one month at the latest. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
10. How we protect the data
- Each user can only read their own rows; the database is built so that reading other people's data is not possible.
- Passwords are stored as hashes and traffic is encrypted (HTTPS).
- Secret keys exist only on the server, never in the code or in the browser.
- Sign-in, sign-up and other sensitive actions have limits against automated attacks.
- We have alerts that warn us about outages.
No service is completely secure. If an incident puts your rights at risk we report it to IMY within 72 hours, and we tell you if the risk is high.
12. Children
Trendmint is aimed at people who are at least 18 years old. If we find that an account belongs to someone younger, and a guardian's consent is missing, we delete the account.
13. Changes
We update the policy when something changes. The date at the top shows when the text was last changed. For material changes we tell you in the app or by email before they take effect.
If Trendmint or the company is sold, data may go with it to the buyer, who then takes over responsibility under this policy. We tell you in advance and you can delete your account before the transfer.
14. Contact
Maximilian Stefanov and Kristijan Stanojkovic. Email: Maximilian.stefanov1@gmail.com. See also Contact.