Privacy Policy

1. Who this policy covers, and who's responsible for your data

This Privacy Policy explains what personal data Flipsta collects when you use the Platform, why, and what your rights are under UK data protection law. It's operated by [Flipsta Ltd — company number to be confirmed once registered at Companies House], a company registered in England and Wales at [registered address to be confirmed], which acts as the data controller for the personal data described here.

2. What we collect

Account details: name, email address, date of birth (to confirm you meet the 16+ age minimum), and, if you provide it, a business name, delivery/billing address, and account type (personal/business).

Payment and payout information: Flipsta never sees or stores your card details — these are entered directly into Stripe's own checkout and Stripe Connect (for Reseller payouts). We hold a record of the transactions themselves (amount, date, what was purchased, your plan) but not your card number.

Content you provide: listing titles, descriptions and photos you upload as a Reseller; reviews; support chat messages; Buyer Want requests.

Technical data: standard web server logs (IP address, browser/device type, pages visited), collected automatically by our hosting provider for security and reliability — see Section 6, Cookies.

Referral information: if you sign up via someone's referral link, the referral code is held briefly (see Section 6) so the right person is credited.

3. How we use it, and on what legal basis

To provide the Platform and fulfil a contract with you: creating and running your account, processing opportunity and marketplace purchases, paying out Reseller earnings, and providing customer support (including our AI-assisted chat — see Section 4).

To meet our legal obligations: verifying your age at signup, standard fraud-prevention checks, and, where you meet HMRC's "reportable seller" criteria, reporting certain seller information to HMRC annually (see Section 11 of our Terms & Conditions).

Where you've opted in: sending promotional emails about deals or platform updates. You can opt out of these at any time — see Section 8. We'll always send you essential service emails (order confirmations, security notices) regardless, as these are necessary to provide the service you've signed up for.

With your consent or our legitimate interest in running a functioning marketplace: showing your public seller rating and reviews to other users, and using aggregate (non-identifying) data to understand which categories and features are working well.

4. Support chat and AI

Flipsta's support chat is AI-assisted (Anthropic's Claude). When you use it, the message you type — and, if you're signed in, relevant details from your own account (such as a recent order or your wallet balance, so the chat can actually help rather than asking you to repeat information) — is sent to Anthropic to generate a reply. Your conversation is also stored in our own database so a member of the team can pick it up if the chat escalates to a support ticket.

5. Who we share your data with

We share personal data with the following categories of third party, each acting either as our data processor (handling data on our instructions) or, where noted, as an independent controller of their own:

Supabase — hosts our database and handles account sign-in. Stripe — processes payments and Reseller payouts. Resend — sends account and (where you've opted in) promotional emails. Anthropic — generates support chat replies (Section 4). Render — hosts the Platform itself. Cloudflare — provides bot-protection on signup, where enabled.

CJ Dropshipping and AliExpress-sourced suppliers — if you buy an item fulfilled by a dropshipping supplier, your delivery address is passed to that supplier so they can ship the order to you.

We also share information with HMRC where legally required (Section 3), and with law enforcement or other authorities where required by law. We do not sell your personal data to anyone, and we do not use any advertising or analytics trackers on the Platform.

6. Cookies and similar technologies

The Platform uses a small number of cookies, covered in full in our Cookie Policy. In short: we use only the cookies needed to keep you signed in and, briefly, to credit a referral correctly — no advertising or analytics cookies.

7. International transfers

Most of our processors (Supabase, Stripe, Resend, Render, Cloudflare) store UK/EU user data within the UK or EEA. Two do not: Anthropic (Section 4, US-based) and CJ Dropshipping (Section 5, based overseas, used only for orders you place for a dropshipped item). [The specific safeguards used for these transfers — such as the UK's International Data Transfer Addendum — are still being confirmed and will be added here once finalised.]

8. How long we keep your data

[Specific retention periods for each category of data above have not yet been finalised.] As a general position, we keep account and transaction data for as long as your account is active and for a reasonable period afterwards to meet our legal, accounting and tax-reporting obligations, and delete or anonymise it once it's no longer needed for those purposes.

9. Your rights

Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to delete your data; restrict or object to certain processing; and receive your data in a portable format. To exercise any of these, contact us through the Platform's support ticketing system. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.

10. Children

Flipsta is not intended for anyone under 16, and we don't knowingly collect personal data from children under that age.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to users in advance of taking effect.

12. Contact us

For any question about this policy or your data, please get in touch through the Platform's support ticketing system.