Rebornly App Privacy Policy
Updated 28 October 2026 · Applies to the Rebornly app and its related features when offered. The website beta-signup and beta forum are described in our separate Website Privacy Policy.
1. Who we are
Rebornly is developed and operated by Hartfors AB, a Swedish limited company (organisation number 559607-6546). Contact: support@rebornlyapp.com. Correspondence: Västra Kanalgatan 11, 652 24 Karlstad, Sweden. Hartfors AB is the controller for the app data described here, except where another service provider acts independently under its own privacy notice.
2. Who may use the app
Rebornly is for adults aged 18 and older. We record age confirmation and the versions of rules you accept. If we learn that an account belongs to a minor, we may restrict or delete it. Adults must not publish identifying or unsafe information about real children.
3. Account and community data
Depending on features used, we process your email, credentials handled by our authentication provider, username, display name, profile photo, biography, selected country/region/city, roles, follows, posts, comments, photos, circles, saved content, preferences, access controls, notification settings and account/device/session records. Messages, including group and one-to-one media, are stored to make conversations work. Access to reported content may be granted to authorised moderators under controlled conditions.
4. Dolls and creator records
Doll Passport, Nursery, Studio, WIP and Journey can contain Doll IDs, images, sculpt and creator attribution, characteristics, COA information, recorded current and previous holders, ownership events, notes and history. These can be personal data when tied to members or creators, including people who did not submit the information themselves. Doll history may persist when a member leaves, with identifying details restricted where lawful and appropriate. These records are not independent legal proof of ownership or authenticity.
5. Vault and paid features
Document Vault may hold receipts, COAs, photographs, invoices and materials you choose to upload, including personal data about other people. Paid features involve product entitlements, trial and renewal states, purchase identifiers and cancellation status. Apple, Google and RevenueCat may process relevant information under their own terms. Rebornly does not need full card numbers for app-store subscriptions.
6. Market and Trade, when available
In activated Market countries, transaction processing may involve seller status, listings, possession evidence, buyers, sellers, Stripe-connected seller onboarding, card/Klarna payment statuses, order identifiers (RB-OR-…), shipping, returns, disputes, reviews and Doll transfers. Stripe collects seller identity and bank details as required; which information Hartfors AB receives depends on the integration. Sellers and payment providers may separately be controllers for their own duties. Trade may involve proposals, signed or accepted agreements, downloadable PDFs, possession evidence, tracking, receipt confirmations, reviews, reports and moderator decisions. These features may not be enabled in every country or beta release. Market is not initially available in the United States.
7. Tax reporting
Where applicable platform-operator rules require it, we collect, verify, retain and report sellers' identity, tax information, consideration and transaction counts to the Swedish Tax Agency (Skatteverket). This includes applicable DAC7 reporting. Legal collection and retention obligations depend on the seller and the reporting regime; a deleted account cannot erase records that law requires us to keep.
8. How we use information and legal bases
We use account, social, messaging, Doll, Vault and other feature data to provide the agreed service (GDPR Article 6(1)(b)); data needed for bookkeeping, tax reporting and regulatory compliance under applicable legal obligations (Article 6(1)(c)); and appropriately limited security, fraud prevention, moderation, platform integrity and preservation of justified provenance under legitimate interests (Article 6(1)(f)), subject to balancing and individual rights. Where an optional feature truly requires consent, we ask for it separately (Article 6(1)(a)). We do not treat consent as a blanket basis for core app operation.
9. Who receives data
Other members see content you choose to show to them and certain transaction or Trade details necessary to participate. Private messages and evidence are not public. Authorised staff can access limited necessary data for support, safety, fraud prevention, reports and legal compliance, with access controls. Service providers include Supabase (authentication, EU-region database/storage), Google Cloud (media/security processing), Resend (email), RevenueCat (entitlements), Sentry (diagnostics), Apple and Google (distribution and billing), and GitHub Pages for the website. Stripe and Klarna are involved where eligible Market payments are enabled. These providers receive only the information relevant to their respective services, according to their applicable arrangements.
10. Where data is processed
Some core hosting and media services are configured in EU regions, while suppliers may be based in, or accessible from, other countries, including the United States. Transfers outside the EEA are assessed under applicable data-protection law, using an adequacy decision, Standard Contractual Clauses or another valid mechanism where required. You may ask support for more information about safeguards.
11. Images, AI and automated features
Rebornly removes location metadata from uploaded images processed for the service. Other document formats, including PDFs, may carry embedded metadata and should not be used to share unnecessary sensitive information. Rebornly does not send member data to external AI services or use member content for generative-AI model training. Matching, search and technical security systems may use ordinary automated processing. These features are not intended to make solely automated decisions with legal or similarly significant effects.
12. Retention and deletion
Account information is generally removed or disconnected when the account is deleted, subject to lawful retention of security, moderation, transactions, taxes, legal claims and historical records affecting other members. Your former username remains unavailable for reuse; the minimum data retained to enforce that reservation is restricted. Some Doll provenance and accepted handover records may continue in minimised form. Swedish accounting records are generally retained until the end of the seventh year following the calendar year in which the financial year ended. Other records have distinct limits; temporary Trade evidence is subject to its applicable feature-specific retention. Copies in backups may take additional time to expire.
13. Your choices and rights
You may access and correct account information, change available visibility settings, export your data, and request deletion of your account through the app or at rebornlyapp.com/delete-account/. Depending on law and context you may also request access, erasure, restriction, portability or object to legitimate-interest processing, and withdraw consent where it was the legal basis. We may verify your identity and explain any lawful exceptions. Account deletion does not automatically cancel Apple or Google subscriptions.
14. Complaints and contact
For privacy questions and rights requests, email support@rebornlyapp.com. You may complain to the Swedish Authority for Privacy Protection (IMY), or another competent supervisory authority where applicable. We review this notice when app features, data practices or providers change. Material changes will be communicated where law requires.