Privacy Policy

Flipmule is a business tool used by online sellers to synchronise their marketplace data into a workspace they control. It is intended for use by businesses and self-employed individuals. Wherever you are based, we handle your personal data in line with the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR and other data protection laws that apply to you.

• Account data: your email address, a securely hashed password (we never store your password in readable form), the business name you choose, and your account and country settings.
• Marketplace data (eBay): with your explicit OAuth consent we read your orders, buyer postal details contained in those orders, transaction fees, payouts and active listings through official eBay APIs. We never see or ask for your eBay password.
• Google data: with your explicit OAuth consent we create and write to the spreadsheet we make for you in your own Google Drive. We use the drive.file scope (which limits our access to files this app creates or that you specifically open with it) and the spreadsheets scope (used only to read and write those workbooks) — we cannot see the rest of your Drive. Flipmule’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Support data: if you contact us or use the in-app chat, we process the messages and contact details you provide so we can help you.
• Usage and technical data: basic logs such as IP address, timestamps, device/browser information and error diagnostics, used to keep the Service secure and working. OAuth access and refresh tokens are held encrypted and are never written to our logs.

Some marketplace data (for example a buyer’s name and delivery address on an order) is personal data of third parties. Where you bring that data into Flipmule and into your own spreadsheet, you act as its controller and we process it on your behalf as described in section 11.

We offer an optional browser extension that gives you one-click access to your workbook, recent sales and dashboard. If you install it:

• Sign-in: the extension reads a single Flipmule session cookie from flipmule.com — solely to sign you in to the same account you use on the website, without asking for your password again. It does not read cookies from any other site.
• Local storage: the extension stores its own session tokens and your selected business on your device, in the browser’s extension storage. Removing the extension deletes this data; signing out of the extension revokes its session on our servers.
• Data sent: the extension communicates only with Flipmule’s own servers, to show your data (for example your recent sales). It does not track your browsing, does not read the pages you visit, and does not send data to anyone else.

We do not sell or transfer extension data to third parties, and we do not use it for any purpose unrelated to providing the Service.

• To provide the Service (Article 6(1)(b) — contract): creating your account, connecting your marketplace and Google accounts, syncing data into your Sheet, and powering your dashboard and reports.
• To keep the Service secure and improve it (Article 6(1)(f) — legitimate interests): preventing fraud and abuse, diagnosing errors, and maintaining and developing the Service. Our legitimate interest is running a secure, reliable product; it does not override your rights.
• To communicate with you (contract / legitimate interests): sending service and security messages, replying to support requests, and giving you important notices.
• With your consent (Article 6(1)(a)): where we ask for it — for example connecting a third-party account, or any optional marketing. You can withdraw consent at any time.
• To meet legal obligations (Article 6(1)(c)): complying with law, including tax, accounting and data-protection obligations and lawful requests.

We do not sell your personal data, we do not use it for advertising or ad-profiling, and we do not carry out automated decision-making that produces legal or similarly significant effects on you.

We share data only with providers that help us run the Service, under written contracts that require them to protect it and use it only on our instructions:

• eBay (marketplace you connect): to read your selling data with your consent.
• Google: to create and update the spreadsheet in your own Drive.
• Railway (hosting & database): runs our application and database.
• Vercel (hosting): serves our website and app front-end.
• Cloudflare (network/security): provides content delivery and protection.
• Resend (email delivery): sends transactional emails such as verification and password-reset messages.
• In-app support chat provider: processes your chat messages and contact details so we can answer you.

We keep an up-to-date list of sub-processors and will make reasonable efforts to give advance notice of material changes. We may also disclose data where required by law, to protect our rights or users, or in connection with a merger, acquisition or sale of assets (in which case we will tell you).

Some of our providers process data outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards recognised under UK law — such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — so your data keeps an essentially equivalent level of protection. You can ask us for details of the safeguards that apply.

• Encryption in transit: all traffic uses HTTPS/TLS.
• Encryption at rest: OAuth access and refresh tokens are encrypted using AES-256-GCM.
• Password protection: passwords are hashed with Argon2id and never stored in readable form.
• Access control: each customer's data is isolated to their own account; access tokens are never logged; our production database runs on a private network.
• Minimisation: we request the narrowest marketplace and Google permissions the Service needs (for Google, the per-file drive.file scope plus a spreadsheets scope used only on the workbooks this app creates).

No system can be guaranteed completely secure, but we take appropriate technical and organisational measures to protect your data. If a personal data breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required and inform you without undue delay when the law requires it.

We keep your personal data for as long as your account is active and as needed to provide the Service. You can disconnect a marketplace at any time, which stops syncing, or delete your account, which removes the personal data we hold about you from our live systems. Residual copies may persist in encrypted backups for a limited period and are overwritten on our normal backup cycle; we may also retain limited data where the law requires (for example tax and accounting records, typically for up to six years). We honour eBay’s marketplace account deletion notifications: when an eBay user deletes their eBay account, the data we hold for that account is deleted automatically.

The spreadsheet lives in your own Google Drive. Deleting your Flipmule account does not delete that spreadsheet — it remains yours to keep or delete.

Under the UK GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, email [email protected]. We will respond within one month, as the law requires (this may be extended by two further months for complex requests, in which case we will tell you). We do not charge a fee unless a request is manifestly unfounded or excessive.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113, or to your local data protection authority if you are in the EEA. We would appreciate the chance to address your concern first.

For your own account and settings, we are the controller. For third-party personal data you bring into the Service through your connected accounts (for example your buyers’ names and delivery addresses on eBay orders), you are the controller and we act as your processor: we process that data only to provide the Service to you and on your instructions, apply the security measures in section 6, and delete or return it when you disconnect or close your account. If you require a separate written data processing agreement, contact us.

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the new version here and update the date above; where changes are significant we will notify you in the Service or by email.

FSH Technologies Ltd, 108d Abbotts Road, Leek, England, ST13 6PF. Questions or requests? Email [email protected].