Privacy Policy

Who we are

MojoRadar is an independent search engine for pre-owned and vintage guitars and basses from trusted guitar stores across Europe, operated by Orpheus Techworks SRL, registered in Romania (CUI: 54267679), at 35D Buna Ziua Street, Apt. 4, 400495 Cluj-Napoca.

We do not sell instruments or process payments. You can browse the site without an account; creating one is optional. Our Terms of Service describe how the site works.

What data we collect

If you accept cookies, we collect pseudonymous analytics data so we can keep improving MojoRadar - making it easier to find the right instrument, fixing things that aren't working well, and building a better experience for everyone who uses the site. This data does not directly identify you but may be considered personal data under GDPR because it is linked to a pseudonymous device identifier. This includes:

• Pages viewed and time spent on each page
• Clicks and interactions with site elements
• General device information (browser type, screen size)
• Your IP address, and the approximate location inferred from it (country, region and city)
• Session duration and navigation patterns

If you browse without an account, analytics data is pseudonymous and is linked to a random device identifier, not to your identity. For signed-in users, analytics events are linked to your account ID.

Account data

When you create an account we store your email address and an account role. Lawful basis: Article 6(1)(b) GDPR (necessary to provide the account you signed up for). Account data is stored with Supabase (database and authentication, hosted in eu-north-1 / Stockholm). We keep account data until you delete your account, plus 7 days of backup retention. You can delete your account yourself at any time from your account page.

The sign-in form is protected by Cloudflare Turnstile, which checks that a real person is submitting it. This stops attackers flooding someone else's inbox with sign-in emails. Cloudflare receives your IP address and technical signals about your browser for that check, and states that it uses this data only to tell a person from a script, not to build a profile of you or to target advertising. The check runs because the form cannot be kept safe without it (our legitimate interest, Article 6(1)(f) GDPR), so it is not part of the optional cookie choice. Cloudflare is a US-based company; see “Third parties” for how that transfer is safeguarded.

Watchlist and emails

If you watch products, we store which products you watch, which changes to them you have seen, and a short-lived count of how many products you added recently, to stop abuse. This data is kept while your account exists. Lawful basis: Article 6(1)(b) GDPR (necessary to provide the watchlist you asked for). You can watch up to a set number of products; the limit is shown on your watchlist page.

We can also email you a daily summary when something you watch changes: a price change, a product coming back, or a product being sold. It is normally one email a day, and none if nothing changed. The email is about your watchlist only, with a link back to the site; it never contains offers or anything about other products. We send these emails only with your consent (Article 6(1)(a) GDPR), which you give when you turn them on, and you can withdraw it at any time with the link at the bottom of every email or from your account page. Your watchlist stays saved; only the emails stop.

Sign-in codes and watchlist emails are delivered by Resend, which receives your email address and the content of each email. Resend is a US-based company; see “Third parties” for how that transfer is safeguarded.

Cookies and browser storage we use

Analytics cookies are only set if you click “Accept” on the cookie banner. If you reject cookies, no analytics cookies are set. Signing in to an account sets strictly necessary authentication cookies that keep you signed in. These are required for the account to work and do not need consent.

We also keep a few settings in your browser rather than in cookies: your cookie choice, your light or dark theme if you set one, and how far you scrolled a list of products so that going back returns you where you were. These are ordinary settings like any website remembers: they identify nothing about you, and they work the same whether you accept or reject cookies. How far you scrolled is forgotten when you close the tab; your other settings stay until you clear your browser data.

Hosting and infrastructure

This website is hosted by Vercel Inc. When you visit the site, Vercel processes standard connection data as part of serving the page. This includes your IP address, browser type, and the page you requested. This processing is necessary for the website to function and is handled by Vercel under their Privacy Policy.

Where your analytics data is stored

Analytics data is processed by Amplitude, our analytics provider. Amplitude acts as our data processor under a Data Processing Addendum. Analytics data is stored in Amplitude's EU data center. Amplitude is a US-based company; see “Third parties” for how that is safeguarded.

Error monitoring

We use Sentry for error monitoring and Axiomfor server-side logging. Sentry stores our error data in the European Union (Germany). Axiom stores our logs in the United States (US East 1); Axiom is a US-based company, and “Third parties” explains how that transfer is safeguarded. These services may process technical data such as browser information, approximate location, and error details when issues occur. When errors happen on our servers, this processing is based on our legitimate interest in maintaining a functional and reliable service (Article 6(1)(f) GDPR). When errors happen in your browser, Sentry only runs if you accept cookies, so it is based on your consent (Article 6(1)(a) GDPR). Email addresses, the one-time codes carried by unsubscribe links, and request headers that could identify you (cookies and your IP address) are removed from error reports and server-side logs before they are sent, whether the error happened on our servers or in your browser.

Third parties

The following third parties process data in connection with your visit:

• Vercel - hosting infrastructure (processes connection data for all visitors)
• Amplitude - analytics (only when you have consented to cookies; stored in the EU)
• Sentry - error monitoring (errors and technical context; stored in the EU, Germany)
• Axiom - server-side logging (technical request data only; stored in the US)
• Supabase - database and authentication for accounts and watchlists (eu-north-1 / Stockholm)
• Resend - email delivery (sign-in codes and watchlist emails)
• Cloudflare - bot protection on the sign-in form (processes your IP address and browser signals to tell a person from a script)

Some of these providers are US companies: Resend, Cloudflare, Amplitude, Vercel and Axiom. Transfers to them are covered by the European Commission's Standard Contractual Clauses, the GDPR's standard safeguard for data leaving the EU, which are published by the European Commission and are part of each provider's data processing terms. Where a provider is also certified under the EU-US Data Privacy Framework, that framework applies first.

The parties listed above are the only ones that receive your data. We do not sell it.

Data retention

How long data is kept:

• Amplitude (analytics): 12 months, then deleted automatically.
• Sentry (error monitoring): 30 days.
• Axiom (server-side logs): 30 days.
• Resend (email delivery): a record of each email sent on our behalf for 30 days.
• Cloudflare(sign-in bot check): processes connection signals to tell a person from a script under Cloudflare's data processing agreement, which publishes no fixed retention period for that data.
• Vercel (hosting): connection logs for one hour.
• Supabase (accounts and watchlists): until you delete your account, plus 7 days of backup retention.

Deleting your account removes it at once; records that already exist in the email, error and log services above expire within those periods. Your cookie consent preference is stored in your browser until you clear your browser data or change your choice via “Cookie Settings” in the footer. How far you scrolled is forgotten when you close the tab, and your theme choice stays in your browser until you clear your browser data.

Legal basis

MojoRadar processes personal data in compliance with the GDPR, with a lawful basis for each processing activity:

• Consent (Article 6(1)(a)): analytics, browser-side error monitoring, and watchlist emails. Where we rely on consent, you can withdraw it at any time.
• Contract (Article 6(1)(b)): your account and your watchlist, which cannot be provided without your email address and what you watch.
• Legitimate interest (Article 6(1)(f)): hosting the site, server-side error monitoring and request logging, and the bot check on the sign-in form, which keep the site working and safe.

How to withdraw consent or object is under “Your rights”.

Your rights

Under the General Data Protection Regulation (GDPR) and UK data protection law, you have the right to:

• Withdraw consent- “Cookie Settings” in the footer for cookies; the link in every email or your account page for watchlist emails
• Access your data - ask what data we hold about you
• Correct your data - ask us to correct data about you, such as your email address
• Delete your data - if you have an account, delete it yourself from your account page; that removes your account, your watchlist and your email preferences at once, and we ask Amplitude to delete the analytics data linked to your account, which Amplitude completes within 30 days
• Limit how we use your data - ask us to restrict processing
• Object - to processing based on legitimate interest, such as server-side logging
• Get a copy of your data - request the data you gave us in a portable format
• Complain- to your local data protection authority. The authority for MojoRadar is Romania's ANSPDCP. If you are in the UK, you can also contact the Information Commissioner's Office (ICO).

To exercise any of these rights, write to privacy@mojoradar.com. We answer within one month. If you browse without an account, the analytics data we hold is pseudonymous and tied to a random device identifier rather than to you, so we may not be able to find records for you. We will still do our best to help.

Contact

For any privacy-related questions or requests, contact us at privacy@mojoradar.com.

Changes to this policy

We may update this privacy policy from time to time. The latest version is always the one published on this page. If a change matters to you as an account holder, we will tell you by email or with a notice on the site before it takes effect.