Legal

Security & Data Protection

Last updated 3 October 2026. How Flipsta keeps your data and your selling accounts safe.

1. Our information security programme

Flipsta is a small UK business. The owner (Steven Gibbs) is responsible for information security and data protection, and reviews this policy at least every 12 months and whenever something important changes.
Questions or concerns about security or personal data can be sent to admin@flipsta.co.uk.
We build on established providers rather than running our own servers: Render (application hosting), Supabase (database and file storage, on Amazon Web Services), Stripe (payments — we never see or store card details) and Resend (email).

Our database and application run in our providers' managed, isolated environments. The database only accepts authenticated, encrypted connections using strong credentials that are held solely in our hosting provider's secret settings.
Our providers supply firewalling, DDoS protection and monitoring of their networks. We review our application and database logs for errors and unusual activity.
Webhooks we receive from selling platforms (such as Shopify and TikTok Shop) are rejected unless they carry a valid cryptographic signature.

Company devices run up-to-date operating systems with anti-virus switched on, automatic screen locking and strong, unique passwords.
Two-step login (multi-factor authentication) is switched on for every system that holds Flipsta data or code, including our hosting, database and code repository.
Secret keys (API keys, app secrets) are kept only in our hosting provider's encrypted environment settings — never in our code, in emails or on shared documents.

Only the owner has administrator access to Flipsta's database, hosting and code. Access is granted to anyone else only if their role needs it, only to what they need, and is removed as soon as it is no longer needed.
Inside the platform, database row-level security means each signed-in user can only read their own data. Staff tools are restricted to staff accounts.
Access tokens that sellers give Flipsta for their selling-platform accounts (for example eBay, Shopify or TikTok Shop) are stored only on our servers, are never sent to anyone's browser, and are only used to carry out the listing and order actions the seller has asked for.

Public: listings and shop pages people choose to publish.
Internal: operational data such as listing drafts and logs.
Confidential: personal data (account details, delivery addresses, order records) and sellers' selling-platform access tokens.
Restricted: secret keys and passwords.
All data is encrypted in transit (HTTPS/TLS on every connection) and at rest (our database and file storage are encrypted at rest by our provider). Confidential and restricted data is only accessible to the systems and people that need it.

We keep our software and its dependencies up to date and apply security fixes promptly.
We review our database provider's security advisories and alerts, and fix issues they raise.
Changes to the platform are checked (including automated type-checking and a full build) before they go live, and can be rolled back.

The owner is responsible for handling any security incident. Anyone who spots a possible incident should report it immediately to admin@flipsta.co.uk.
On a suspected incident we will: contain it (for example revoke keys or tokens and block access), work out what data and which people are affected, fix the cause, and keep a written record of what happened and what we did.
If personal data may have been exposed, we will tell the affected sellers and any affected selling platform (for example TikTok Shop or Shopify) without undue delay and in any case within 72 hours of becoming aware of it, and notify the UK Information Commissioner's Office where the law requires.

We collect and use personal data only to run Flipsta, as described in our Privacy Policy (flipsta.co.uk/privacy), and follow UK data protection law (UK GDPR and the Data Protection Act 2018).
From selling platforms we only take what we need to list items and record sales — for example product, stock and order details. We do not copy buyers' names, addresses or contact details from TikTok Shop or Shopify; sellers ship those orders from the platform itself.
We will help sellers and the selling platforms to access, correct or delete data when a person asks.
Where data is stored: our database is in the European Union (Ireland). Our application servers that process requests are in the United States. Payments are handled by Stripe.

When a seller disconnects a selling platform, or the platform tells us the seller has removed Flipsta, we delete the stored access tokens for that account straight away.
When our relationship with a seller or a selling platform ends, we delete the data we collected from that platform within 30 days, except records the law requires us to keep (for example sales records for tax purposes), which contain no buyer contact details from that platform.