Privacy Policy

The data controller is:

wedey OÜ — Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia — Registry code 17153535 Privacy contact: legal@wedey.ai

• Account data: name, email, password (stored hashed).
• Order & item data: the item's brand, model, category, your description, and any authenticity information you provide.
• Photographs you upload of your item (and any personal data that may incidentally appear in them).
• Payment data: processed by our payment provider Stripe. We receive confirmation and limited transaction details; we do not store your full card number.
• The verdict and certificate generated for your order.
• Communications: messages you send us (support, disputes).
• Technical data: IP address, device/browser type, and cookie data (see the Cookie Policy).

Purpose

Legal basis (GDPR Art. 6)

Create and manage your account

Performance of a contract — Art. 6(1)(b)

Perform the authentication and issue your verdict & certificate

Performance of a contract — Art. 6(1)(b)

Process payments

Contract / legal obligation — Art. 6(1)(b), (c)

Keep accounting and tax records

Legal obligation — Art. 6(1)(c)

Enable public verification of a certificate (by number/QR) without exposing your personal data

Contract / legitimate interests — Art. 6(1)(b), (f)

Security, fraud prevention, and protecting the Services

Legitimate interests — Art. 6(1)(f)

Respond to your messages and handle disputes

Contract / legitimate interests — Art. 6(1)(b), (f)

Send marketing emails (only if you opt in)

Consent — Art. 6(1)(a)

We use AI-assisted image analysis to support our experts. The AI does not make the final decision — a human expert reviews and issues every verdict (see Section 9).

With your separate, opt-in consent, we may retain and use your photographs to improve and train our authentication models and build a reference database. You can withdraw this consent at any time, which stops future use; it does not affect processing already carried out. Declining does not affect your authentication in any way.

We share data only as needed, with processors bound by data-processing agreements:

• Database, authentication and photo storage: Supabase, United States (US East region).
• Website hosting and delivery: Vercel, United States.
• Payment processing: Stripe.
• Transactional email: Brevo, European Union.
• Error monitoring: Sentry.
• Audience measurement: Google Analytics — only after you accept analytics cookies.
• AI image analysis: in-house.
• Professional advisers or authorities, where legally required.

We do not sell your personal data.

Our database, photo storage and website hosting are located in the United States. Where personal data is transferred outside the European Economic Area, we rely on a lawful transfer mechanism — the EU–US Data Privacy Framework where the recipient is certified, or EU Standard Contractual Clauses with supplementary measures.

• Account data: while your account is active, then deleted or anonymised after 12 months.
• Order records, verdicts and certificates: retained to support verification, for 7 years.
• Photographs: retained for 7 years, alongside the order they belong to, so that the certificate stays verifiable.
• Photographs reused for model training, where you consented: kept until you withdraw that consent.
• Marketing data: until you unsubscribe or withdraw consent.

Wherever you are, if your data is processed by us you may request: access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent at any time (without affecting prior processing). To exercise these, contact legal@wedey.ai

If you are in the EU/EEA, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with your local supervisory authority. Consumers elsewhere may have rights under their local data-protection law.

We use AI to assist analysis, but final verdicts are made by human experts. We therefore do not carry out solely automated decision-making producing legal or similarly significant effects within the meaning of GDPR Art. 22.

We apply appropriate technical and organisational measures to protect your data (e.g. encryption in transit, access controls, hashed passwords). No system is perfectly secure; we work to protect your data and to notify you and the authorities of a breach where legally required.

The Services are for adults (18+). We do not knowingly collect data from minors; if we learn we have, we delete it.

We may update this Policy and will post the new "Last updated" date; material changes will be notified to registered users. Questions or requests: legal@wedey.ai, wedey OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia.