Privacy
Kayu holds the least it can: an email address so you can sign in, whatever a seller puts on their public shop, and the enquiries people send each other. It is not sold. If you agree — a banner asks, and you can say no — Kayu and a seller running their own ads may use a tracking pixel to see how well those ads work; nothing else on Kayu depends on it. You can have a copy of what is held or have it deleted by asking.
Version 2026-08-25 · in effect from 25 August 2026
What is held, and why
Nothing here is collected because it might be useful later. Each of these exists because something on the site stops working without it.
Your account
Email address, name, and a hashed password — the password itself is never stored and cannot be recovered, only replaced. Needed to sign you in. Kept while the account exists.
A seller’s shop
Business name, country, description, logo and photographs. This is published deliberately: it is the shopfront buyers see.
A seller’s legal details
Registered name, company number, VAT number, address, and where timber was harvested. Only asked of sellers who want a verified badge, only seen by the operator, and never shown to buyers.
Enquiries
Your name, email address and message, passed to the seller so they can reply to you directly. The seller gets your address — that is the entire point of sending one, and there is no way to enquire anonymously.
Reports
Your name, email address and what you told us. The seller is told why their listing was actioned but is not told who reported it.
Technical records
The IP address an enquiry or report came from, and server logs of requests. Used to stop the site being used to spam sellers, and for nothing else.
Beyond the one cookie that keeps you signed in, nothing tracks you unless you say yes. A banner asks, once. Agree and Kayu’s own Meta Pixel and Google Ads tag start, and so does a seller’s own pixel on their own shop and listing pages, if they have set one for their own ads. Decline, or never answer, and both stay off. Nobody is profiled beyond that, and nothing is sold to anyone.
The legal basis
Your account and your shop: because you asked for them — performance of a contract.
Enquiries and reports: legitimate interests, being the operation of a marketplace where people can reach each other and flag what is wrong.
IP addresses and rate limiting: legitimate interests, being keeping the site usable and sellers un-spammed.
A seller’s legal identity: legal obligation, and their own choice to be verified.
Tracking pixels — Kayu’s own and a seller’s own alike: consent. Off by default, and off again the moment you decline or never answer.
Who else sees it
A small number of suppliers run parts of the service. They process data on Kayu’s instructions and for nothing of their own.
Railway
Runs the API and the database.
Vercel
Serves the website.
Cloudflare R2
Stores photographs.
Brevo
Sends email — enquiries, reports and password resets.
Forward Email
Carries replies sent to orders@kayushop.eu.
Meta and Google
Only if you have agreed to tracking. Kayu’s own pixel and tag measure Kayu’s own ads; a seller who has set their own ids sees visits to their own shop and listing pages the same way, and nothing beyond them.
Sellers see the enquiries sent to them. Buyers see what a seller publishes on their shop. Nobody else is given anything, and no data is sold.
Sellers are all over the world, so sending an enquiry to a seller outside the EU sends your name, address and message outside the EU. That is what an enquiry is for, and it cannot be done any other way.
What you can ask for
Email orders@kayushop.eu and a person will do it. No form, no account needed, and no charge.
A copy of everything held about you.
A correction, if something is wrong.
Deletion. Where a record has to survive — a report that led to a listing being removed, for instance — the personal details in it are removed instead and the rest is kept without them.
A machine-readable export.
To object to something being processed at all.
If the answer is unsatisfactory you can complain to the Bulgarian data protection authority, the Комисия за защита на личните данни (kzld.bg), or to the equivalent authority where you live.
How long it is kept
Your account: while it exists. Delete it and the personal details are removed.
Enquiries: kept, because they are the only record that the platform is working and a seller may need to prove what was agreed.
Reports: kept, because a decision about a listing has to be explicable afterwards.
Server logs and IP addresses: a short period, long enough to catch abuse.
Deleting a seller account that has history redacts it rather than erasing the row: the person is removed and the shop is closed, but the record that a shop existed survives, because listings and enquiries point at it.
Talking to us
orders@kayushop.eu, and a person reads it.
Operator details to be published here before launch — company name, registration number, registered address and a contact telephone number.
This page takes effect on 25 August 2026.