Privacy Policy
Last updated: October 7, 2026.
Short and plain: what data we hold, why, and what you control.
In short
This notice explains what personal data Bebiko collects, why, what is public, and what your rights are. Our principle: only the minimum data a working marketplace needs.
What we collect
Account: email address; your password is kept by the authentication service in hashed form. Profile: display name and, if you choose, a profile photo, a short bio, your city and phone number. Listings: title, description, price, condition, category, item details (e.g. size), city and photos. Messages you send and deal records. Reviews and replies. Reports you file and users you block. Favorites and notification settings. Support requests and our replies. A log of phone-number reveals. Technical sign-in data (see “IP addresses”). An internal log of moderation and administrative actions.
Photos
Photos you upload are converted to WebP and their location metadata (EXIF) is removed. They are kept in private, access-controlled storage and served through short-lived signed links. Banner images are public by nature.
What is public
Public: your active listings (with their details and photos), display name, profile photo and bio (if you add them), city (if you enter one), join date, your reviews and replies, number of items sold and number of confirmed exchanges. Your email address is never shown publicly.
What stays private
Your phone number is stored separately and never shown publicly: a buyer sees it only if you turn on number display for that listing, and every reveal is logged to prevent abuse. Only the participants of a conversation can see its messages. Administrators see only basic deal information (parties, status, dates), never the buyer's message. Your favorites and notification settings are private.
IP addresses
Our hosting (Vercel) and authentication service (Supabase) record IP addresses in technical logs to operate and secure the service — Supabase also stores them with your session, together with browser details, when you sign in. Beyond that, we use a visitor's IP address only briefly, to preselect the country filter when browsing (e.g. Montenegro) — for that purpose we don't store it or pass it on. We don't use geolocation databases.
Cookies
We use only essential cookies: for sign-in and your session, and to remember your chosen language. No advertising cookies and no cross-site tracking. For visit statistics we use Vercel Web Analytics, which sets no cookies (see “Providers”).
We send transactional emails (confirmations, notifications, warnings) through our provider Resend. You can turn off the notifications you control in your account preferences; messages essential to platform integrity (such as moderation warnings) can't be turned off.
Providers
The site is delivered by Vercel (hosting), which also gives us anonymous visit statistics (Vercel Web Analytics): which page was opened (without the parameters in its address), where the visitor came from, the country and city Vercel estimates from the request, device type, operating system and browser. It uses no cookies and does not store IP addresses; it recognises a visitor only by a temporary marker that is discarded after 24 hours. Sign-in and administration pages are not measured. The database, authentication and file storage are provided by Supabase, and that data is stored in Switzerland (Zurich); email is delivered by Resend. There are no other third parties. We never sell your data. Our providers may also process data in other countries (including the US), under the contractual safeguards in their terms.
Retention and deletion
While your account is active, we keep data for as long as the service needs it. When you delete your account: if you have no shared history, everything is erased completely (including images). If you do, your profile is anonymized ("Closed account"), your contact data and your own content are erased, your listings stay hidden but are preserved with their images as moderation evidence, and the records other parties hold (messages, deals, reviews), plus the audit log, are preserved. Backups age out naturally over time. We don't claim statutory retention periods we don't apply.
Your rights
You can view and correct most of your data (profile, listings) yourself, and you can delete your account yourself. You can request a data export, restriction of processing or object to processing through the support form. You can withdraw consent-based choices (such as showing your phone number) at any time. Bebiko doesn't make automated decisions about you or build a profile of you.
Security and children
We protect data with role-based access rules, encryption in transit, two-factor authentication for admin accounts, and a log of phone reveals. No system is completely secure. Bebiko is for adults (18+); the products are for children, but we do not knowingly collect children's data.
Data controller
The controller of your personal data is the owner and operator of the Bebiko platform, based in Montenegro. For all data-protection questions and to exercise your rights, use the support form (link in the footer of every page) — we reply by email.
Legal bases
We base processing on: performance of a contract (account, listings, conversations, deals); our legitimate interest (moderation, fraud prevention, platform security and the internal action log, anonymous visit statistics); and your consent where it is explicit (showing your phone number, optional notifications and, when enabled, Google's ads). You can withdraw consent at any time, without affecting processing carried out before the withdrawal.
Protection and complaints
Personal-data protection is governed by the Montenegrin Law on Personal Data Protection; where services are offered to persons in the European Union, GDPR standards are respected as well. If you believe your rights have been violated, you may complain to the supervisory authority — the Agency for Personal Data Protection of Montenegro — and you can also contact us first via support.