Privacy Policy

1. Data we collect

We collect the following categories of personal data:

• Account data — your email address, username and display name, and your authentication data (a securely hashed password, or, if you sign in with Google, the Google account identifier and basic profile data returned by Google). We do not see or store your Google password.
• Content you create — your storefront and its details, the deals you save to your watchlist, listings you flip, and any orders you place or receive.
• Usage and device data — how you interact with the Service, together with technical data such as IP address, browser and device type, and approximate location derived from your IP, collected through our analytics.
• Cookies and similar technologies — see our Cookie Policy.

2. How and why we use your data

We use your personal data to:

• create and operate your account and authenticate you;
• provide the Service — surfacing deals, running your watchlist and storefront, and (in future) processing on-platform orders;
• send you transactional emails (for example a welcome message, order confirmations, sale and shipping notifications);
• understand and improve how the Service is used, and keep it secure and working;
• comply with our legal obligations and enforce our terms.

3. Legal bases (UK/EU GDPR)

We rely on the following legal bases under the UK GDPR and EU GDPR:

• Performance of a contract — to create your account and provide the features you ask for (your watchlist, storefront, orders) and related transactional emails.
• Legitimate interests — to keep the Service secure, prevent abuse, and understand and improve how it is used (analytics), balanced against your rights.
• Consent — where we ask for it, for example for non-essential cookies or optional communications. You can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

4. Service providers and third parties

We share personal data with the following processors and third parties only as needed to run the Service. Each acts under contract and/or its own privacy terms:

• Supabase — authentication and database hosting (stores your account and content data).
• Vercel — application hosting and analytics (processes usage and device data).
• Google— when you choose “Sign in with Google” (OAuth authentication).
• eBay and the eBay Partner Network — source of listing data we surface, and the affiliate network for outbound links (see the affiliate disclosure below).
• PriceCharting — pricing/valuation data used to score deals.
• Stripe — payment processing and seller payouts. This applies only once on-platform payments are enabled; until then no payment data is processed.
• We may also use an email delivery provider to send the transactional emails described above.

We do not sell your personal data. We may disclose data where required by law or to protect our rights, and in connection with a business transfer (for example a merger or acquisition), subject to this Policy.

5. Affiliate links

Flippiks participates in the eBay Partner Network and may earn a commission on qualifying purchases made through outbound links from the Service, at no extra cost to you. When you click an outbound link, the destination marketplace (such as eBay) and the affiliate network may set their own cookies and process your data under their own privacy policies. Listing prices and availability are set by third-party sellers and may change; Flippiks is not the seller and is not responsible for third-party listings or transactions.

6. Data retention

We keep your personal data for as long as your account is active and as needed to provide the Service. If you close your account we will delete or anonymise your personal data within a reasonable period, except where we must keep certain records longer to meet legal, accounting, tax or dispute-resolution obligations (for example order records once on-platform payments are live).

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and reliance on reputable infrastructure providers. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and will notify you and any regulator where the law requires it in the event of a qualifying breach.

8. International transfers

Some of our providers (including Supabase, Vercel, Google and Stripe) operate globally, so your personal data may be processed in the United States and other countries outside the UK and EEA. Where we transfer data internationally we rely on appropriate safeguards, such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses, and adequacy decisions where they apply.

9. Your rights (UK/EU GDPR)

If you are in the UK or EEA, you have the right to: access your data; rectify inaccurate data; request erasure; restrict or object to certain processing; and data portability. Where we rely on consent, you can withdraw it at any time. To exercise any of these rights, contact us at contact@flippiks.com. You also have the right to complain to your data protection authority (in the UK, the Information Commissioner’s Office).

10. US and California privacy rights

If you are a US resident, you may have rights under applicable state law. California residents have the right under the CCPA/CPRA to know what personal information we collect, to request deletion, and to opt out of the sale or sharing of personal information. Flippiks does not sell your personal data. To make a request, contact us at contact@flippiks.com. We will not discriminate against you for exercising these rights.

11. Children

Flippiks is not directed to, and may not be used by, children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us at contact@flippiks.com and we will delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will change the “Last updated” date above and, for material changes, take reasonable steps to notify you.

13. Contact

For any privacy question or request, contact us at contact@flippiks.com. See also our Terms of Service and Cookie Policy.