Privacy Policy

1. Introduction

Welcome to FLUF Connect, operated by FLUF Ltd, a company registered in England and Wales (company number 12635755), whose registered address is Suite RA01, 195-197 Wood Street, London E17 3NU ("FLUF," "we," "our," or "us"). FLUF Ltd is the controller of the personal information described in this policy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our multi-marketplace crosslisting and inventory management platform.

Effective Date: 25 July 2025

Last Updated: 23 October 2026

2. Information We Collect

2.1 Personal Information

• Account Information: Name, email address, username, password, and profile information
• Contact Details: Billing address, shipping address, phone number
• Payment Information: Billing details and payment history. Card details are entered directly with our payment processor; we never see or store your full card number
• Business Information: Store name, business type, tax information

2.2 Marketplace Data

• Authentication Credentials: The access credentials that let us act on the marketplaces you connect, including those connected through our browser extension or mobile app
• Product Information: Product listings, descriptions, images, prices, inventory levels
• Order Data: Purchase history, order details, buyer information, transaction records
• Store Analytics: Sales data, performance metrics, marketplace statistics

2.3 Technical Information

• Device Information: IP address, browser type, device identifiers, operating system
• Usage Data: Pages visited, features used, time spent on platform, click patterns
• Log Data: Server logs, error reports, performance data
• Cookies and Tracking: Session cookies, preference cookies, analytics cookies

2.4 Information from Third Parties

• Social Media: Information from social media accounts when you choose to connect them
• Payment Processors: Transaction data from Stripe and other payment providers

3. How We Use Your Information

3.1 Core Service Provision

• Enable multi-marketplace product crosslisting and inventory synchronisation
• Manage and coordinate orders across all connected platforms
• Provide automated offer management and price optimisation
• Facilitate secure authentication with marketplace APIs
• Process payments and manage subscriptions

3.2 Platform Improvement

• Analyse usage patterns to improve platform functionality
• Develop new features and services
• Conduct research and analytics to enhance user experience
• Monitor platform performance and reliability
• Create aggregated and anonymised market insights — such as resale pricing benchmarks, sell-through rates, days-to-sell, and category and brand demand trends — which we may publish, license, or otherwise make available to third parties (including academic, research, and commercial organisations) as described in Section 4.5. These insights are produced only in a form that does not identify you or any individual buyer or seller.

3.3 Communication

• Send service-related notifications and updates
• Provide customer support and technical assistance
• Share important platform announcements
• Send marketing communications about FLUF services similar to those you use (you can opt out at any time), or with your consent where required

3.4 Legal and Security

• Comply with legal obligations and regulatory requirements
• Protect against fraud, abuse, and security threats
• Enforce our Terms of Service and other policies
• Respond to legal requests and court orders

4. How We Share Your Information

4.1 With Your Consent

We share your information when you explicitly consent, such as when connecting to new marketplaces or enabling specific integrations.

4.2 Service Providers

• Payment Processing: Stripe (for subscription and payment processing)
• Cloud Infrastructure: EEA-based hosting and data storage providers, and an offsite encrypted backup provider. Named in full in our Data Processing Agreement.
• Analytics: Website and app analytics providers (only with your consent, see Section 7)
• Advertising: Advertising platforms that measure our adverts and show them to people likely to be interested (only with your consent, see Section 7)
• AI Services: AI model providers that process the listing content you ask us to create or edit (such as photos and descriptions) and your conversations with our AI assistant
• Customer Support: Support ticket systems and communication tools

4.3 Legal Requirements

We may disclose your information when required by law, legal process, or to protect our rights, property, or safety of our users.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction.

4.5 Aggregated and De-Identified Data

We create aggregated, anonymised, and de-identified datasets and statistics from platform activity — for example, the prices items sell for, how quickly they sell, sell-through rates, and demand trends by category, brand, condition, and region across connected marketplaces.

This information is processed so that it does not identify, and cannot reasonably be used to identify, you or any individual buyer, seller, or business. Aggregated figures are only released where they are derived from a sufficient number of underlying records, so that no individual transaction, account, or store can be singled out. We never include names, email addresses, postal addresses, phone numbers, payment details, or marketplace account credentials in these datasets.

Because this information is no longer personal data, we may use, publish, license, sell, or otherwise share it with third parties — including universities and research institutions, market-intelligence providers, brands, and other commercial organisations — for purposes such as market research, academic study, industry reporting, and product development. We do this in reliance on our legitimate interests in operating and developing our business (see Section 12).

5. Data Retention

5.1 Retention Periods

We keep personal information only for as long as it serves the purpose below, then delete it automatically.

• Account Data: Kept while your account is open. When you delete your account, your name, email address and login are removed immediately, and the rest of your personal information is deleted 90 days later. The 90 days let you restore an account you deleted by mistake.
• Marketplace Credentials: Revoked as soon as you delete your account, disconnect a marketplace, or uninstall our app from it.
• Order and Transaction Data: The order record (items, prices, fees, dates) is kept while your account is open and for up to 7 years for accounting and tax purposes. Buyer names, contact details and shipping addresses are removed 2 years after the order, or 90 days after you close your account, whichever comes first.
• Product and Listing Data: Kept while your account is open. After closure, listings are kept only as business records detached from your name and contact details.
• Marketplace Messages and Offers: Messages with buyers that we mirror into your inbox, and offer history, are deleted after 1 year.
• Support Communications: Kept for 3 years to answer follow-up questions and resolve refund or payment disputes. If you close your account they are deleted 1 year after closure.
• Conversations with our AI Assistant: Kept for 3 years, like other support conversations, and deleted 90 days after you close your account.
• Subscription and Payment Records: Kept for 6 years after the last payment, as required for tax and accounting.
• Technical Logs: Server and error logs are kept for up to 90 days. Security logs, such as sign-in history and blocked access attempts, are kept for up to 12 months.
• Backups: Encrypted backups are kept for up to 12 months and are used only to restore the service. Deleted data leaves the backups as they age out.

5.2 Data Deletion

When a retention period expires, or when you delete your account, we delete your personal information as described above. Aggregated and de-identified data created as described in Section 4.5 is not personal data and may be retained and used indefinitely, including after your account is closed, as it can no longer be linked back to you.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

6.1 How to Exercise Your Rights

You can download a copy of your data yourself at any time from Settings → Delete Account → Download my data in your FLUF dashboard, and delete your account from the same place. To exercise any other right, please contact us at [email protected]. We will respond to your request within one month.

6.2 Marketing Communications

You can opt out of marketing communications at any time by clicking the unsubscribe link in emails or contacting us directly.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

• Essential Cookies (always on): Needed to run the site and the FLUF Connect app: keeping you signed in, security and fraud protection, your basket and checkout, and remembering your cookie choice and settings such as language. These do not need your consent.
• Analytics Cookies (only with your consent): Help us understand how the site and app are used and how well they perform, so we can find and fix problems.
• Marketing Cookies (only with your consent): Measure the results of our advertising, record which campaign or referral link brought you to us, and show our adverts to people likely to be interested, on other websites and platforms.

7.2 Managing Your Choice

When you first visit we ask you to accept or reject analytics and marketing cookies. Rejecting all is as easy as accepting all, and rejecting does not affect your use of the site. You can change your choice at any time with the Cookie settings link in the site footer. Your choice is remembered for six months, after which we ask again. You can also control cookies through your browser settings.

7.3 Third-Party Tracking

Some analytics and advertising services we use set their own cookies or similar technologies only when you consent to the matching category. Where a service supports consent signalling, we use it so that advertising cookies are not set without your consent. Some conversion events are sent from our own servers and do not depend on cookies stored on your device.

8. Data Security

8.1 Security Measures

• Encryption: Data is encrypted in transit (TLS) on every connection. Your customers' contact details on orders are encrypted in our database (AES-256-GCM), and backups are encrypted
• Access Controls: Strict access controls and authentication requirements
• Security Testing: Regular security reviews of our code and infrastructure
• Hosting: Data is hosted in the European Economic Area

8.2 Data Breach Response

In the unlikely event of a data breach, we will notify affected users and relevant authorities within 72 hours as required by applicable laws.

9. International Data Transfers

We store your data in the European Economic Area, which the UK recognises as providing adequate protection. Some of our service providers, such as our payment processor, analytics and advertising platforms and AI model providers, process data in other countries, including the United States. When personal information is transferred outside the UK or EEA, we rely on one of these safeguards:

• Adequacy: The destination is recognised by the UK or EU as providing adequate protection, including US companies certified under the EU-US Data Privacy Framework and its UK Extension
• Contractual Safeguards: The UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses

10. Children's Privacy

FLUF Connect is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will provide prominent notice on our platform
• We may also notify you via email for significant changes
• Where a change needs your consent, we will ask for it

12. Legal Basis for Processing (GDPR)

Under the UK GDPR and the EU GDPR, we process your personal information on the following legal grounds:

• Contract Performance: To provide FLUF Connect services you've requested
• Legitimate Interest: To improve our services, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws and regulations
• Consent: For marketing communications and optional features (you can withdraw consent at any time)

12.1 When We Act as a Processor for You

This Privacy Policy describes the personal information FLUF handles as a controller — your own account, billing, and usage data.

Separately, when we retrieve your customers' details from a connected marketplace on your behalf — their name, email address, phone number, or shipping address on an order — you are the controller and we are your processor. That processing is governed by our Data Processing Agreement, which sets out our security measures, our sub-processors, how we assist with data subject requests, and how we handle breaches and deletion.