Privacy Policy

Ace Buyback is operated by Osiris One, based in the Netherlands, and is the data controller for the personal data processed through buyback.osiris.one. For any privacy question or request, contact ismail@osiris.one.

We only collect what we need to buy your screens and pay you:

• Account details — name, email address, phone number, company name (for business sellers), and your password (stored only as a secure hash by our authentication provider).
• Shipping addresses — pickup and return addresses for your shipments.
• Payout details — IBAN / bank account details, PayPal address, or cryptocurrency wallet addresses, depending on how you choose to be paid.
• Transaction history — your buyback requests, test results, quotes, payouts, and rewards.
• Technical data — IP address, device and browser information, and aggregated usage analytics used for security (e.g. rate limiting) and to improve the site.

• To perform our contract with you — creating your account, generating shipping labels, testing your items, sending quotes, and paying you.
• Legal obligations — bookkeeping, tax, and anti-fraud requirements oblige us to keep records of purchases and payouts.
• Legitimate interests — securing the platform, preventing fraud and abuse, and understanding how the site is used.
• Consent — our newsletter and any non-essential communications. You can withdraw consent at any time.

We do not sell your personal data, and we do not use it for third-party advertising.

Your data is stored and processed by a small set of service providers acting under data processing agreements:

• Supabase — authentication and database hosting.
• Vercel — website hosting and privacy-friendly analytics.
• Sendcloud — shipping labels and parcel tracking (receives your name, address, phone, and email for carrier delivery).
• Resend — transactional email such as confirmations, quotes, and payout notifications.

Where a provider processes data outside the European Economic Area, transfers are protected by EU Standard Contractual Clauses or an adequacy decision.

• Account data — kept while your account is active, deleted or anonymised within 30 days of account deletion unless we must keep it longer by law.
• Purchase and payout records — kept for 7 years to meet Dutch bookkeeping and tax obligations.
• Technical logs — kept for up to 12 months for security purposes.

Under the General Data Protection Regulation you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased where we no longer need it;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email ismail@osiris.one. We respond within one month. You can also lodge a complaint with your local data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

All traffic to the site is encrypted (TLS). Passwords are hashed, payout details are accessible only to the staff who process payments, and access to production systems is restricted and logged. No system is perfectly secure, so if we ever discover a breach affecting your data we will notify you and the supervisory authority as required by law.

We use strictly necessary cookies to keep you signed in and to remember preferences such as your pricing region. Our analytics are aggregated and do not use cross-site tracking cookies.

We update this policy when our processing changes. The version on this page applies from the "last updated" date above; material changes will be announced in the app or by email.