Open beta: Scan and Match free and unlimited until 31 January. Sign up and get founder pricing.
Wintraits privacy policy
Courtesy translation. In case of any discrepancy, the Spanish version prevails.
Last updated: 9 November 2026
At Wintraits we process as little personal data as possible. Our service analyses products, not people: the listings, attributes and statistics we work with are not personal data. This policy explains what personal data we process when you use the website, join the waiting list, create an account or connect an AI agent, and what rights you have.
1. Data controller
- Controller: Jaume Pelejà, who runs the project under the trade name Marketempatía.
- Project: Wintraits (https://wintraits.com)
- Contact for any privacy matter: contacto@wintraits.com
We are not required to appoint a data protection officer. You can write to the address above with any question.
2. What data we process, why and on what legal basis
| When | What data | What for | Legal basis | How long |
|---|---|---|---|---|
| You join the waiting list or the newsletter | Email address; date, time and IP of the subscription and of the confirmation | To tell you about the launch and send you the monthly report and the findings | Your consent (art. 6.1.a GDPR), which you confirm by email | Until you unsubscribe. We keep the proof of consent for 3 years after you unsubscribe |
| You create an account | Email address, password (encrypted, we never see it), account type, name and, if you give them, company name, tax ID, address and telephone; plan, sign-up date, categories you look at and whether you want to receive news | To give you access to the service, apply the limits of your plan and, when you buy, invoice you | Performance of the contract for use of the service (art. 6.1.b GDPR) | While the account is active and 12 months after closing it, unless the law requires us to keep it longer |
| You run a diagnosis, check, comparison or evaluation while signed in | The report you see (including what you wrote about your listing or concept), its title and date, linked to your account, so you can download it again as a PDF from “Your studies” | To provide the service you use | Performance of the contract for use of the service (art. 6.1.b GDPR) | 30 days (at most the last 50); you can delete them earlier from your account |
| You use the API or the MCP server (also through an AI agent) | Encrypted fingerprint of your access key (the key itself is not stored), date, tool used and number of requests per day. If you ask for a free key, your email is only used to send you the link (through Brevo) and is not stored: we keep an encrypted fingerprint so that there is one key per email | To authenticate, apply usage limits, prevent abuse and ensure security | Legitimate interest in protecting the service (art. 6.1.f GDPR) | 30 days; after that only aggregated, anonymous weekly figures. The trial report counter of each key, 90 days. The email fingerprint, while its key exists; an unused link, 48 hours |
| You browse the website, run a diagnosis, download a PDF, request a category in the radar or click «Ask for more information» on the pricing page | We do not store your IP in our database: we turn it into an encrypted fingerprint with a secret key that changes every week, which does not reveal who you are or allow us to follow you from one week to the next. Alongside it, the date and how many times you used each feature that day. Separately, without any fingerprint, we add up per day how many entries arrive from each website (only its domain, e.g. google.com, or the link's label) and to which page | To apply the daily limits, prevent abuse and count distinct visitors | Legitimate interest in protecting the service and knowing whether it is used (art. 6.1.f GDPR) | 30 days; after that only aggregated, anonymous weekly figures. For radar requests, the fingerprint is deleted the next day and only the requested category and the date remain |
| You import your Amazon listing with its link or ASIN in the diagnosis, or request a free full report without a key | If you are not signed in, another encrypted fingerprint of your IP with a secret key that changes every month; if you are signed in, your account. Alongside it, the month and how many imports or free full reports you have used. The link and the product's public data are not stored in the database (only in memory, for one hour at most) | To apply each plan's number of imports per month and of free full reports | Legitimate interest in protecting the service (art. 6.1.f GDPR) | Until the month ends; the free full report counter, 30 days |
| Any visit (technical logs) | IP and technical browser data in the server logs | Security and operation | Legitimate interest (art. 6.1.f GDPR) | 30 days at most |
| You arrive at the home page from outside the website | Your IP, only to know whether it is from Spain, using a list of ranges stored on our server (DB-IP, CC BY 4.0 licence). The IP does not leave the server and is not stored | To show you the home page in Spanish or English. Every other page is shown in the language of its address, without looking at the IP or using cookies | Legitimate interest in showing you the website in your language (art. 6.1.f GDPR) | Not stored |
| You write to us | Email address and whatever you tell us | To reply to you | Your consent when writing to us and, if you are a customer, the contract | As long as needed to deal with your request and 12 months after |
| You are a business contact at a company in the sector and have given us permission to write to you, or you are already a customer | Name, business email, company, website, company type, category and country, where we obtained the contact and whether you have replied | To introduce Wintraits to you by email. We never send advertising without your prior permission or a prior customer relationship (art. 21 LSSI) | Your consent (art. 6.1.a GDPR) or, if you are already a customer, our legitimate interest in offering you similar services (art. 6.1.f GDPR and art. 21.2 LSSI) | Until you unsubscribe (every email explains how). After you unsubscribe we delete your data and keep only an encrypted fingerprint of your email so that we do not write to you again |
| You buy a plan or a paid service (when available) | Name or company name, tax ID, billing address, email and purchase details. Card details are processed directly by the payment provider; we do not see them | To charge, invoice and meet tax obligations | Contract (art. 6.1.b) and legal obligation (art. 6.1.c GDPR) | The periods required by tax and commercial law (generally between 4 and 6 years) |
The product data you send us for diagnosis (a URL, an ASIN or the description of a concept) is not personal data. We do not publish or transfer it, and we only use it to give you the result and, in aggregated and anonymous form, to improve the model.
We do not make automated decisions about people. Diagnoses are automatic, but they concern products, not you.
An encrypted fingerprint is still pseudonymous personal data under the GDPR, which is why we include it here even though it does not identify you. You can object to its use by writing to us; bear in mind that without it we cannot apply the daily limits of the free version.
3. Who we share data with
We do not sell or transfer personal data. It is only processed by the providers we need for the service to work, under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| OVH SAS | Server running the website, the API and the database, and their backups | France (EU) |
| GoDaddy.com, LLC | Domain registration and DNS | US company |
| ImprovMX Incorporated | Forwarding the emails you send to contacto@wintraits.com | US company |
| Supabase, Inc. | User accounts and backups | EU region; US company |
| Brevo (Sendinblue SAS) | Sending confirmation emails, notices and the newsletter | France (EU) |
| Stripe Payments Europe, Ltd. | Payments and top-ups, when there are paid plans | Ireland (EU); part of a group headquartered in the US |
| Anthropic, PBC | Reading product listings and drafting introduction emails | US |
We use an artificial intelligence model (Anthropic, a US company) to read product listings. For that it only receives product texts, never your personal data. If you are a business contact and gave us permission to write to you, it may also receive your name, your company and its type to help us draft the email, which we always review before sending. Anthropic does not use that data to train its models.
We may also have to provide data to authorities or courts when required by law.
4. Transfers outside the European Union
Some providers are US companies. When a provider can access personal data from outside the EU, it does so under the EU-US Data Privacy Framework (if the company has joined it) or the standard contractual clauses approved by the European Commission. You can ask us for more information at contacto@wintraits.com.
5. Your rights
You can exercise, at any time and free of charge, the rights of:
- access to your data;
- rectification of inaccurate data;
- erasure of your data;
- objection to processing based on legitimate interest;
- restriction of processing;
- portability of the data you gave us;
- withdrawing your consent, without affecting processing carried out before.
Write to us at contacto@wintraits.com stating which right you want to exercise. If we cannot identify you from the address you write from, we will ask for the minimum needed to check that it is you. We reply within one month at most.
Unsubscribing from the newsletter is immediate: every email includes a link to do it with one click.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
6. Cookies
We only use technical cookies and storage, essential for the website to work (for example, keeping you signed in or remembering your preferences). We do not use advertising cookies or third-party tracking cookies. Visit statistics are calculated on our own server, without cookies and in aggregate.
If in the future we add cookies that are not technical, we will ask for your permission first with a notice on the website.
7. Security
We apply reasonable measures to protect your data: encrypted connections (HTTPS), encrypted passwords, restricted access to the servers, backups and access logs. No system is infallible: if a breach affecting your data occurred, we would notify the authority and, where appropriate, you.
8. Age
Wintraits is designed for sellers, brands and professionals. It is not aimed at people under 18 and we do not knowingly process their data.
9. Changes to this policy
If we change anything important, we will say so on the website and, if you have an account or are subscribed, we will let you know by email before it applies.