This notice describes how personal data of users of the myHommade website and mobile application (the "Platform") is processed, in accordance with EU Regulation 2016/679 ("GDPR"), UK GDPR and applicable data protection law.
1. Data controller
The data controller is Leonilde Ltd ("myHommade", "we"), an English company, Company Number 11020979, registered office at 181 Downhills Way, London, England, N17 6AH (United Kingdom).
As we process data of users in the European Union, where required by GDPR Art. 27 our EU representative is Rosario Peditto, Via Ota 55, 95123 Catania, Italia — rosariopeditto@pec.it.
For any request regarding data protection you can contact us at myhommadeltd@gmail.com.
2. Categories of data processed
In connection with use of the Platform we may process:
- Identification and contact data: first name, last name, email address, phone number
- Account data: login credentials, profile photo, preferences, language, role (buyer/seller)
- Order and transaction data: products bought/sold, amounts, billing and shipping addresses. Card payment data is processed directly by the payment provider (Stripe) and is not stored on our systems
- Seller data: data required for onboarding and payments via Stripe Connect (e.g. identification and payout data required for the provider's anti-money laundering obligations)
- Uploaded content: product images and videos, profile images and chat attachments, stored in cloud storage
- Communications: messages exchanged via the Platform chat or contact forms
- Technical and usage data: IP address, device identifiers, operating system, app version, push notification tokens, system logs
3. Purposes and legal bases of processing
We process data for the following purposes:
- Provision of services (registration, account management, product listing, purchases and sales) — legal basis: contract performance (GDPR Art. 6.1.b)
- Payment, order and shipping management — contract performance and legal obligations (GDPR Art. 6.1.b and 6.1.c)
- Push notifications relating to account, orders and messages — contract performance and/or consent, revocable in device settings
- Artificial intelligence features (product image analysis, translations, assistant) — contract performance and legitimate interest in providing advanced tools (GDPR Art. 6.1.f)
- Customer support and request handling — contract performance and legitimate interest
- Platform security and fraud and abuse prevention — legitimate interest (GDPR Art. 6.1.f)
- Promotional communications and newsletter — data subject consent (GDPR Art. 6.1.a), revocable at any time
- Tax and legal compliance — legal obligation (GDPR Art. 6.1.c)
4. Providers and recipients of data
To provide services we use third-party providers acting as processors or independent controllers, limited to what is necessary for the purposes above:
- Google Ireland/LLC (Firebase and Google Cloud) — account authentication, database, image and content storage, backend infrastructure hosting (Google Cloud Run) and technical push notification delivery
- Stripe, Inc. / Stripe Payments Europe — payment processing and seller payouts via Stripe Connect
- OpenAI, L.L.C. — product image analysis, translations, conversational assistant and image generation
- Sendcloud B.V. — shipping label generation, tracking and shipment management in the EU
- Shippo (Simpler Postage, Inc.) — shipping management for the UK and United States (e.g. Evri, Royal Mail, USPS), including QR code labels
- Expo (650 Industries, Inc.) — push notification delivery and app distribution
- Couriers and competent authorities — for order delivery and to comply with legal obligations or authority requests
Some support services do not involve processing of users' personal data: for example exchange rates are obtained via an external service (Frankfurter) without transmitting personal data. We do not sell personal data to third parties.
5. Transfers of data outside the EU
Some providers are located or have infrastructure outside the European Union, particularly in the United States (Stripe, OpenAI, Shippo, Expo) and the United Kingdom (controller Leonilde Ltd). Such transfers take place with adequate safeguards under GDPR Chapter V, such as the European Commission Standard Contractual Clauses, the UK adequacy decision and, where applicable, the EU-US Data Privacy Framework.
6. Data retention
We retain personal data for as long as strictly necessary for the purposes for which it was collected and in compliance with legal obligations. Account data is retained until deletion by the user; order and payment data is retained for the period required by applicable tax and accounting obligations.
7. Data subject rights
You have the right to access your data, obtain rectification or erasure, restrict or object to processing, and the right to data portability. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. To exercise your rights write to myhommadeltd@gmail.com.
You also have the right to lodge a complaint with a supervisory authority, in particular the Italian Data Protection Authority (garanteprivacy.it) or, in the UK, the Information Commissioner's Office (ico.org.uk).
To request deletion of your account and associated data, visit myHommade — Account deletion / Eliminazione account.
8. Security
We adopt appropriate technical and organisational measures to protect personal data from unauthorised access, loss, destruction or alteration, including encryption in transit, access controls and infrastructure managed by certified providers.
9. Minors
The Platform is reserved for users aged 18 and over. We do not knowingly collect data from minors under 18; if we become aware of processing of minors' data without a legal basis, we will delete it.
10. Changes
We reserve the right to update this notice. Changes will be published on this page with the update date; material changes may be communicated to registered users.
For information on cookies and tracking technologies on the site, see our Cookie Policy.