Who we are
SecondSell is a second-hand marketplace for students in Leuven, run by a small group of KU Leuven students. We are the data controller for everything described on this page. A person reads the address in the last section.
SecondSell is a place where two students find each other. We never handle money, delivery or payment, and we never see what you agree between you.
What we store
When you create an account we store:
- your email address and a hash of your password (never the password itself)
- the display name you choose
- the neighbourhood you pick, if you pick one — never a street or house number
- an optional phone number, which is never shown to anyone else
While you use SecondSell we also store:
- listing drafts and listings you publish: title, description, price, condition, category, neighbourhood, photos, structured item details and status (draft, active, reserved, sold, deleted)
- AI suggestions and supporting photo or text references, plus derived search text and numerical search embeddings used to find relevant listings
- messages you send and receive, with the time they were sent and read
- a session cookie that keeps you signed in on your device
- basic technical logs (request path, time, IP address, browser) kept for a few weeks to keep the service running and to spot abuse
Your email and phone number are never shown to other students. What they see is your display name, your neighbourhood, and what you write in listings and messages.
Listings from Facebook
Some listings on SecondSell are copies of public posts from KU Leuven buy-and-sell groups on Facebook. For those we store the post's title, description, price, photo, publish date and a link to the original. We do not store the poster's name or profile, and you cannot message them through SecondSell — the original post is the only way to reach them. Each of these listings is labelled "Posted on Facebook".
If one of those posts is yours and you want it off SecondSell, email us the link and we remove it.
Messages
Conversations are stored so both sides can read them later. They are not encrypted end to end — we can read them if we need to investigate abuse — and they stay after a listing is sold or deleted, so an agreement made in a conversation is still there for both of you.
Photos
Photos you upload are stored with the listing. Draft photos are visible only to you; after you publish, they are shown to everyone who opens the listing. Removing a photo while editing deletes it permanently. Deleting a listing hides it from everyone but you; its photos are removed when your account is.
If you choose a short video while creating a listing, the original video stays in your browser. You choose still frames, and only those frames are uploaded as listing photos. We do not upload or process the video's sound.
Where it lives, and who helps us
Everything runs on Google Cloud in Belgium (Google Cloud, europe-west1): the database, the photos and the servers. Cloudflare sits in front of the site to route traffic. Emails we send you — confirming your address, resetting your password — go through Resend, from a European region.
For AI-assisted listing suggestions and search, we send the relevant listing text, selected photos, structured details or search query to OpenRouter. OpenRouter routes those requests to the configured model provider. We do not separately attach your account profile, messages, email address or phone number to those requests. Anything you write in listing text or a search query, or show in a selected photo, can be included in the relevant request. We do not sell your data.
We use no analytics or advertising trackers. The only cookie is the one that keeps you signed in.
Why we are allowed to
Account, listings, messages and emails: because you asked us to run an account for you (performance of a contract, GDPR art. 6(1)(b)). Technical logs and the copies of public Facebook posts: because a working, searchable student marketplace is in our legitimate interest and yours, and neither goes further than that (art. 6(1)(f)).
Your rights
You can see, correct and delete what we hold about you. Name, phone and neighbourhood you change yourself on your profile page; listings you edit or delete yourself. For anything else — a copy of your data, a correction we have to make, or a deletion — email us. We answer within a month, usually much faster.
If you think we are handling your data wrongly, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).
Deleting your account
Write to us and we remove your account, your listings and your photos. Messages the other person received are kept on their side, with your display name, so their half of the conversation still makes sense.
There is no delete button yet. Until there is, an email from the address on your account is enough.
Contact
Questions about any of this go to andrei.shostak@student.kuleuven.be. The contact page has the same address.