Your information, handled with care

Information we collect

We collect information you provide when you create an account, open a store, list an item, contact support, or make a purchase. This can include your name, email address, phone number, account details, listing and order information, messages sent to support, and delivery information.

We also collect technical information about how the website is used, such as device, browser, a minimized network signal (for example a truncated network prefix, not a full IP address), coarse region, pages viewed, and interactions needed to operate, secure, and improve the service.

How we use information

Trezela uses information to operate the marketplace, create and manage accounts and listings, process purchases, provide customer support, prevent fraud and abuse, communicate about service-related matters, and improve the platform.

Payments and service providers

Payment information is handled by Stripe, our payment service provider. Trezela does not store full payment-card numbers. We may share the information needed to complete an order with the seller, buyer, payment provider, delivery providers, and service providers that help us operate the marketplace.

When we disclose information

We disclose information when needed to complete a transaction, comply with law, protect the safety and rights of Trezela and its users, investigate fraud or security issues, or as part of a business reorganization. We do not sell personal information.

Security monitoring

To prevent fraud and abuse and to keep accounts secure, Trezela records server-side security events for actions such as signing in, verifying an email address, resetting a password, changing account credentials, restricting an account, or requesting a refund. These records include the account reference, the outcome, the kind of browser and device, a coarse country region when our hosting platform provides it, and a minimized network signal (a keyed fingerprint or a truncated network prefix — never a full IP address). Security records are used only for security and fraud-prevention purposes, are visible only to authorized security staff, and are retained for up to 180 days (rate-limit and integrity records for up to 30 days) and then deleted.

For a limited fraud-prevention purpose, Trezela may store the exact connecting address in encrypted form, separate from ordinary security events, for up to 30 days by default (a reviewed window of up to 180 days when needed). Encrypted exact addresses are accessible only to authorized security administrators under a recorded reason, are never shown to buyers, sellers or general support staff, and are deleted on expiry or on request with the deletion itself recorded.

Staff security (passkeys)

Staff accounts use passkeys (device biometrics or PIN) for high-impact administrative actions. Passkey enrollment stores only public keys and credential metadata; biometric information never leaves your device and is never collected or stored by Trezela.

Security and retention

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No online service can guarantee absolute security. We retain information only for as long as needed for the purposes described here, including legal, accounting, fraud-prevention, and dispute-resolution obligations.

Your choices and contact

You may request access, correction, or deletion of personal information, subject to applicable law and our legitimate recordkeeping obligations. To make a request or ask about this policy, email privacy@trezela.com.

Changes to this policy

We may update this policy as our service changes. We will post the revised version here and update the date above.