Privacy policy

Last updated: 25 October 2026

This is a translation of the Spanish original.

This policy explains what personal data Werop (werop.com), the European marketplace for independent fashion, based in Spain, processes, for what purpose and what rights you have over it. It applies to the website www.werop.com, to the Werop Android app and to the seller dashboard (seller.werop.com).

1. Data controller

2. What data we process

• Account data: you can sign in with Google, with Apple or with your email and a password. With Google we receive your email address, your name and your profile photo. With Apple we receive your email (or Apple's anonymous address if you choose to hide it), your name the first time and an identifier of your Apple account to recognise you; we do not see your Google or Apple password. If you create a password on Werop, we only store an encrypted fingerprint of it (PBKDF2), never the password, and we send you an email to confirm your address.
• Shipping addresses: the addresses you save to receive orders, together with the recipient's name and, if you provide it, a contact telephone number. We validate and geocode them with Google Maps to ensure correct deliveries.
• Orders and basket: the products you buy, their amount and the status and tracking of the shipment.
• Seller data (shops only): name and description of the shop, legal name, tax identifier and VAT number, validated registered address and workshop address, contact person, the email where you want to receive Werop's communications if it is not your account email (you confirm it with a link), telephone, website and social media, logo, the identifier of your Stripe account and the channel through which you came to Werop (see section 7). While you fill in the registration form, we save the shop name, username, legal name, website, Instagram and country you type, even if you do not end up sending it, so that we know which shop an application left half-finished belongs to and can offer you help (legitimate interest); never the tax identifier, the telephone or the address. If the owner invites team members to the dashboard, we store their email, their role and who invited them (see section 9).
• Acceptance of the terms (shops only): each time you accept or reject the seller terms —when you sign up and with each new version— we store the version, the date and time, the account you use, your IP address, your browser and the text you ticked (and the reason, if you reject them), as proof of the contract with the shop (performance of the contract and legitimate interest in being able to prove it). They are kept like the rest of the shop’s data (section 8).
• Use of the seller dashboard (shops only): the notifications in your bell (90 days), the queries you send us from «Help and support» with their thread of replies, the technical errors the dashboard reports to us so we can fix them (screen, error message and dashboard version, without data about your customers; 30 days) and, if you choose to stay signed in, a long-session identifier for that device (it expires after 30 days without use and, at most, after 180 days). We also record which dashboard screens are opened and whether it is the owner or someone from their team (without storing anyone's email or using cookies: a tab identifier that only lives in the browser's memory), so that we know which shops need help and can improve the dashboard (legitimate interest).
• Werop's invoices to shops (shops only): each month, the invoice for the commission and for the contribution to shipping costs, with the shop's tax details at the close of the month and the orders it includes; and, each January, the statement of what Werop will report about the shop to the tax authority (DAC7).
• Shop verification and tax obligations (shops only): the information from each shop's review (public registries, online presence, inclusion on sanctions lists), the beneficial owners of a company, the documents you provide from the dashboard («Documents»: identity document, registration for the activity or commercial registry extract and, when we ask for them, powers of attorney, origin of the goods, trademark registration or product conformity), which are stored in a private space in the European Union accessed only by the team that verifies shops and, for reporting to the tax authority (DAC7), your date of birth if you are a natural person and the amounts of your sales and commissions per quarter. Werop does not ask for or store your bank account: you enter it in Stripe's payout onboarding, as Stripe is the one that pays you and verifies it.
• Favourites: the garments you save with the heart, with the date you saved them, to show them to you in «My favourites». Only you see them: shops do not know who has saved their garments. You can remove them whenever you want and they are deleted with your account.
• Order ratings: if you rate an order after receiving it, the scores and comments you write, together with your name and your email. The part about the shop (with your name, without your email) is seen by that shop, which already knows your details from the order; the part about Werop is only seen by our team. They are not published.
• Messages with shops: if you write to a shop with «Write to the shop» (or, if you are a shop, when you reply), the text of the messages, the order or garment they are about, your name and your email. The shop sees your name and your messages, never your email; the shopper sees the shop's name, never its email or who on the team replied. Werop keeps the conversation and may read it to mediate in an incident or deal with a report.
• Waiting list: if you ask us to let you know when Werop opens in your country, your email, the country, the language of the website, the date and the text you accepted. We send you an email to confirm (double opt-in) and we only write to you if you confirm, just once, on the day we open; we then delete your email from the list. The legal basis is your consent, which you can withdraw with the «Unsubscribe» link in any of those emails.
• Store opening request: if your store is in a country where we do not accept stores yet and you ask us to let you know if we open there, your email, the country, the store name, the website or profile and the message you leave us, the language of the panel, the country you ask from (by your IP), the date and the text you accepted. It is not a store sign-up. We send you an email to confirm and only write to you if you confirm it, just once, if we open to stores in your country; then we delete it. It helps us decide where to open. The basis is your consent, which you can withdraw with the “Unsubscribe” link in any of those emails.
• Content notices: if you report a garment or a shop, your name, your email and what you tell us, to process the notice and tell you the decision. We do not give them to the seller.
• Usage analytics: which screens are visited, with an anonymous session identifier, the garment or shop being viewed, the referring website and the campaign tags of the link you arrived through, the type of device (derived from the browser), the type of account (visitor, shopper, shop or Werop staff) and the country. We do not use third-party analytics tools. While a page is open, the browser sends us a presence signal every 30 seconds (session, screen, country and device) so we can see how many people are at each step of the purchase; it is deleted automatically after 2 hours.
• Country of connection: when you sign in we determine the country from your IP address for security and compliance purposes, and we save it in your profile the first time (to know from which countries Werop is used). The IP is not stored with your profile.
• Crawler log: when the visitor to Werop is an automated program (search engines, AI assistants, SEO tools, scanners), we record what it is, which pages it requests, and its country and network of origin (never the full IP address) for 90 days, to know who reads the website and detect abuse.
• Emails we send you: we keep a copy of each email (recipient, subject and content) for 90 days, so we can check what reached you if there is an incident.
• Images: the photos of garments each shop uploads and, if you use image search, the photo you send to search with. Both are processed with artificial intelligence: we explain this in detail in section 6.

3. For what purpose and on what legal basis

• Providing the service (performance of the contract): managing your account, your orders, payments, shipping and communications about them (for example, confirmation emails).
• Improving the platform (legitimate interest): aggregated usage analytics, prevention of fraud or abuse and, if you decide to rate an order, knowing the quality of service of each shop and of Werop. A few days after delivery we invite you by email to rate it; it is optional.
• Preparing the catalogue with the help of AI (performance of the contract, and legitimate interest when you search by image): recognising the garments in the photos, standardising their presentation and finding similar products. Details in section 6.
• Complying with legal obligations (legal obligation): collecting and verifying the shops' tax data required by the DAC7 rules and complying with international sanctions rules; reporting each year to the Spanish Tax Agency (Agencia Tributaria) the information on shops that exceed the DAC7 thresholds; issuing invoices; responding to requests from authorities and recalls of dangerous products (in that case, notifying the affected shoppers). When the verification of a shop goes beyond what the law requires, the basis is our legitimate interest in the marketplace being safe for shoppers.
• Optional features (consent): such as linking your account with Chulair. You can revoke them at any time from «My account».

4. Payments

Payments are processed through Stripe. You enter your card details directly in Stripe's secure form: Werop never sees or stores your card number. To prevent fraud and comply with its own obligations (including verification of the shops it pays), Stripe processes that data as an independent controller under its own privacy policy; for everything else it acts on Werop's behalf.

5. Who we share data with

We work with providers that process data on Werop's behalf (processors) or that, where we indicate, are responsible for their own processing:

• Google Cloud — the database, the images and the artificial intelligence models (Vertex AI) described in section 6, including the seller dashboard's help assistant, are in the Madrid (europe-southwest1) region, within the European Union. The server that handles requests (Cloud Run) is in Belgium (europe-west1), also in the European Union, and its technical and error logs (Cloud Logging and Error Reporting) are stored in Google Cloud.
• Firebase Hosting (Google) — serves the pages of the website and the dashboards through a content delivery network with nodes inside and outside the European Union, which temporarily logs the IP address of each request to deliver it and protect itself against attacks.
• ip-api.com — to know which country you are visiting from, we send it your IP address and it returns only the country (and, for automated crawlers, the network of origin). The provider is in the United States: it is an international transfer limited to the IP, based on our legitimate interest in the security and territorial compliance of the service, with the safeguards required by the GDPR. The result is kept in memory for a few hours to avoid repeating the query; the IP is not associated with your profile.
• Stripe — payment processing, payout onboarding for shops and transfers to sellers (see section 4). Stripe is also an independent controller of the data it processes to prevent fraud and verify who gets paid.
• Apple — Sign in with Apple, only if you choose it, and forwarding of our emails if you hide your address.
• Google Maps Platform — address validation and autocomplete. Google is an independent controller of the use it makes of those queries under its terms.
• IONOS — sending transactional emails (welcome, confirmation of your email, password change, orders).
• Browser or device notification services (Google FCM, Apple, Mozilla) — only if you turn on notifications in the shop app: they receive an identifier of your device and the encrypted notification.
• Sendcloud — receives the parcel's shipping data (sender, recipient and address) to generate the label and the tracking. If you choose to receive the order at a pickup point, also the search for points (the postcode or town of your address) and the chosen point; at lockers that require it, your customer number with the carrier, which only goes on the label and is not seen by the shop.
• Tax and accounting advisers — the firm that keeps Werop's books and files its taxes has read-only access to the accounting in the back office: invoices, monthly closings, the shops' tax details and what Werop reports under DAC7 (form 238). It does not see shoppers' data.

When you buy, the seller of each order receives the data needed to prepare and ship it: recipient's name, shipping address and contact telephone if you gave one. The shop may be in another of the seven countries where Werop accepts shops (Spain, France, Germany, Italy, the Netherlands, Belgium and Austria), all of them within the European Union.

If you link your account with Chulair (virtual fitting room app), the two platforms share only the link identifier and catalogue data; you can undo the link from «My account» whenever you want.

In addition, we disclose data to the Spanish Tax Agency (Agencia Tributaria) (shop information required by the DAC7 rules, which it may exchange with the tax administrations of other European Union countries) and to the competent authorities (courts, police, consumer or market surveillance authorities) when the law requires us to.

We do not sell your data to third parties or use it for third-party advertising.

6. How we use artificial intelligence

Werop uses Google artificial intelligence models (Vertex AI: Gemini and text and image representation models) for the specific things explained below. They run in the Madrid region or, in the case of Gemini Embedding 2, in Google's European Union multi-region: the images and texts we send them do not leave the European Union, except for the internet searches in shop verification, which are explained below.

• Product photos (shops). When a shop uploads the photo of a garment, we send it to the AI to recognise its characteristics (type of garment, colour, apparent fabric), generate a version with a white background and uniform framing that replaces the original in the catalogue, and propose a draft description. None of that is published on its own: the shop reviews the text and decides. The original photo is kept so the process can be repeated.
• Image search (shoppers). If you search by uploading a photo, we send it to the AI to work out which garment appears in it and find similar ones. That photo is not saved: it is not stored in our database or in the image store. The server does keep the result of the analysis in memory for a while —the characteristics deduced and their numerical representation—, identified by a digital fingerprint of the image, so as not to repeat the same work if it is searched again.
• Text search. We convert the catalogue descriptions and what you type when searching into numerical representations that make it possible to find garments similar in meaning, not just by exact words.
• Representation of each garment (search). So that the search engine understands each garment as a whole, we send its published photos, its name, its description and its characteristics to Gemini Embedding 2, which returns a numerical representation that we store with the garment. This model runs in Google's European Union multi-region (not in Madrid), so that data does not leave the EU either. If you search with a photo, it is also converted into a representation of this type, and the photo is not saved.
• Shop verification (due diligence). When a shop applies to register, the AI searches public sources —its website and its legal notice, commercial and trademark registries, social media and reviews— to check that the company is real and sells its own products, and prepares a draft verification with the links consulted. To do so it uses the company data the shop gave us at registration (trade name, legal name, tax identifier, address, website and Instagram). Those searches are carried out by Google's search engine, which may process them outside the European Union. The decision to approve or reject is always made by a person on the Werop team, who reviews the draft; the verification is not published and the shop does not see it.

People in the photos. If someone appears in the photo of a garment (for example, a model), their image is processed in the same way as the rest of the photo. The shop that uploads it is responsible for having the necessary permissions to publish it.

AI does not decide anything about you. We do not take automated decisions with legal or similarly significant effects on people (Article 22 of the GDPR): the AI proposes catalogue texts and images and verification drafts, and there is always a person who decides: approving or rejecting a shop, removing a garment because of a report or resolving a complaint is done by the Werop team, never by an automated system.

Google processes this data as a processor, on Werop's behalf, under the Google Cloud data processing terms, which establish that it is not used to train its models.

Seller dashboard help assistant

The seller dashboard has a «Help» button with an assistant that answers questions about using the dashboard. It is generated by Google's Gemini model in Vertex AI, in the same Madrid region and under the same conditions as the rest of the AI in this section, and the dashboard always makes clear that an AI is answering. It receives the messages written by the person from the shop and, to answer questions about their shop, consults in read-only mode its status (what is missing to start selling), its garments, a specific order (status, garments, shipping; never the shopper's email or full address) and the status of its documents (never the IBAN or document numbers). It does not change anything or make decisions. If the shop asks, the conversation is passed to a person on the Werop team, who replies by email.

Werop keeps the conversations for 180 days to deal with queries and improve the dashboard, after which they are deleted automatically. That is why we ask you not to write passwords, bank details or document numbers in the chat: those details are entered in their own screens of the dashboard.

The Chulair virtual fitting room is a separate service, with its own privacy policy: images you upload there are processed under its terms, not under this policy.

7. Cookies and local storage

Werop does not use third-party advertising or tracking cookies. The shopping website does not set its own cookies; we use the browser's local storage in two ways: (a) necessary, without asking for permission: your session (a token that identifies you while you are signed in), the marketplace status and your decision on this notice; (b) with your consent, which you can give or refuse in the notice that appears when you arrive: a 30-minute session identifier for our own analytics (no third parties) and, if you arrived via a partner's link, an attribution marker of up to 30 days to know that the purchase came from them. If you refuse, analytics does not store anything on your device and there is no attribution. You can change your mind by clearing the site's data in your browser: we will ask you again.

The seller dashboard (seller.werop.com) uses its own technical cookie, __session, only if you choose to stay signed in: it stores, encrypted and out of the page's reach, the key with which we renew your session on that device. It is not used to track you and is not sent to third parties. And the Stripe onboarding form that opens within the dashboard sets the technical Stripe cookies needed for it to work and to prevent fraud, under Stripe's policy.

The dashboard also remembers, only for as long as the tab is open (the browser's session storage), the channel through which someone about to open a shop arrived —the link tags, such as utm_source, and the name of the referring website— and saves it with the shop when it registers, to know which acquisition channels work. It does not identify anyone or track your browsing; it is deleted when you close the tab. The /vender/ pages count their visits without storing anything on your device.

8. How long we keep data

• Waiting list: unconfirmed, 7 days; confirmed, until we write to you when your country opens or, at most, 12 months.
• Store opening request: unconfirmed, 7 days; confirmed, until we write to you when we open to stores in your country or, at most, 12 months.
• Account and orders: while you keep your account and, afterwards, for the time required by legal obligations (for example, tax obligations).
• Shop verification, transactions and DAC7 data: while the shop is active and, afterwards, for the time the law requires: up to ten years for identification, verification and transaction information (reporting to the tax authority, DAC7, and tax and commercial law).
• Analytics events: they are deleted automatically after 90 days. Before that, each day is summarised into counts (visits by screen and by shop, sessions, devices and countries, without session identifiers or data about any person), which are kept to see trends over more than 90 days.
• Invoices and DAC7 statements: for the periods set by tax and commercial law (at least 6 years, Art. 30 of the Spanish Commercial Code, Código de Comercio; for DAC7 information, the period set by its rules).
• Product photos: while the garment remains in the shop's catalogue.
• Image search photos: they are not stored; the result of their analysis lives only in the server's memory and is discarded when the server restarts or when more recent searches push it out.
• Notifications and technical logs: live channel notifications are deleted within 1 hour; the seller dashboard bell, emails sent and the crawler log, after 90 days; the dashboard's technical errors, after 30 days; long dashboard sessions, after 30 days without use and at most after 180; live presence, after 2 hours; conversations with the assistant, after 180 days.
• Favourites and addresses: while your account exists or until you remove them.
• Ratings, messages with shops, content notices and support queries: while your account or the relationship with the shop exists and, afterwards, the legal limitation period for any liability that may arise (as a rule, 3 years).
• Confirmation and password change links: they expire after 24 hours and after one hour, respectively, and are deleted automatically shortly afterwards.

9. If you are a beneficial owner, director or team member of a shop

We may process your data without you having given it to us yourself, because you are part of a shop that sells on Werop. We explain this here (Article 14 of the GDPR); the shop has undertaken in its terms to inform you of it.

• What data: if you are a beneficial owner or director of the company that owns the shop, your name, date of birth, nationality, position and percentage shareholding, as declared by the shop; and what appears about you in public sources related to the shop (commercial and trademark registries, its website and its legal notice, sanctions lists). If you are a team member invited to the dashboard, your email, your role and who invited you, and the activity you carry out in the dashboard.
• Where from: from the shop itself (its declaration and the dashboard invitations) and, for verification, from publicly accessible sources on the internet consulted through Google's search engine, as explained in section 6.
• For what purpose and on what basis: verifying the shop and those who control it before accepting it and during the relationship, and asking it every three years to confirm its tax details (legal obligation: DAC7 and international sanctions rules; and legitimate interest in the marketplace being safe), reporting to the Spanish Tax Agency the information required by the DAC7 rules (legal obligation) and managing the team's access to the dashboard (performance of the contract with the shop and legitimate interest).
• How long: verification information, ten years from the end of the relationship with the shop; team data, while you are part of it.
• With whom: with the same providers as in section 6 (Google, in Madrid) and, when the law requires it, with the Spanish Tax Agency and the competent authorities. It is not published and no other shop sees it.
• Your rights: those in the next section, by writing to hola@werop.com; if you object to processing that the law requires of us, we will explain what we can and cannot accommodate.

If you register a shop or authorise another person to do so. The person who registers the shop gives us their name, their identity document and their position, and whether they are the owner, a director, an attorney-in-fact or acting on someone's behalf. In the latter case they also give us the name, position and email of the legal representative, whom we write to so that they can authorise it. If you authorise it from our link, we keep your name, your identity document, the text you accept, the date and time, your IP address and your browser, as proof of the authorisation; if you say that you did not give it, we keep that too and notify the shop and our team. We use it to check that whoever accepts the terms can do so on behalf of the shop (legal obligation to verify the trader and legitimate interest in preventing unauthorised registrations); it is not published, and we keep it like the rest of the verification information, ten years from the end of the relationship with the shop.

10. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to hola@werop.com from the email associated with your account.

Deleting your account: request it at the same address and we will delete your account and your personal data, except what we must keep by legal obligation (such as order invoices). You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or with the data protection authority of your country.

11. Changes to this policy

If this policy changes substantially, we will announce it on the website before the changes come into force. The date of the last revision appears at the top of the page.