Legal
Privacy Policy
Last updated: 30 July 2026
Who we are
Sfotai (“we”) lets you photograph an item, generates listing photos and a description for it, and keeps a valuation of your collection.
Sfotai is operated as Sfotai, a.k.a. Listonce.co. Privacy contact: sfotai4@gmail.com.
What we collect
Account — your email address and password. Passwords are stored hashed by our authentication provider; we never see them.
Items you add — title, brand, category, condition, description, price, and the price history we record over time.
Photos — the photo you upload for an item, and the images our AI generates from it.
Purchases — your token balance and purchase history. Purchases are handled directly by Apple via StoreKit; we never receive your card details.
We do not collect location, contacts, or advertising identifiers, and we do not track you across other apps or websites.
Why, and on what legal basis
| Purpose | Basis (GDPR Art. 6) |
|---|---|
| Running your account and collection | Contract — Art. 6(1)(b) |
| Generating listing photos and descriptions | Contract — Art. 6(1)(b) |
| Managing token purchases and balance | Contract — Art. 6(1)(b) |
| Keeping the service secure and working | Legitimate interests — Art. 6(1)(f) |
Who we share it with
We do not sell your data. We use these processors:
| Processor | What they handle | Where |
|---|---|---|
| Supabase | Account, items, price history, photo storage | EU |
| Google Cloud (Vertex AI) | Photos sent for AI processing | EU and US — see below |
| Apple | Payments (StoreKit), app distribution | US/EU |
International transfers.AI processing runs across several Google Cloud regions, including regions in the United States. Transfers outside the EEA rely on the European Commission’s Standard Contractual Clauses together with Google’s supplementary safeguards. See the AI notice for detail on exactly what is sent.
How long we keep it
Your items and photos stay until you delete them or delete your account. Deleting your account removes your items, price history and photos immediately, and removes the login itself. Backups roll off within 30 days.
Your rights
Under GDPR you may access, correct, delete, export, restrict or object to the processing of your data, and you may withdraw consent where we rely on it. See Your GDPR Rights for how to exercise each one.
Children
Sfotai is not intended for children under 16, and we do not knowingly collect their data.
Changes
If we change this policy we will update the date above and notify you in the app before material changes take effect.