flista Privacy Policy

1. Scope

This policy applies to information processed through flista. Marketplace websites, Stripe, OpenAI, Google, and other third-party providers have their own privacy policies and are responsible for their own independent processing.

2. Information flista collects

Account information

• username and email address;
• a securely hashed version of your password;
• account, subscription and credit status;
• flista settings and saved preferences; and
• messages and information you provide when requesting support.

flista does not store your account password in readable form.

Marketplace connection information

• eBay OAuth access or refresh tokens needed to provide authorised functions;
• marketplace usernames, seller identifiers or account identifiers;
• marketplace item numbers, listing URLs and listing status; and
• information returned by a marketplace when flista performs a request authorised by you.

flista does not receive or store your eBay password. flista browser extensions do not ask for or store your Vinted or Etsy password.

Listing and inventory information

• product titles and descriptions;
• photographs and uploaded images;
• SKUs and inventory references;
• categories, brands, models, MPNs and item specifics;
• condition, measurements, colours, materials and other listing details;
• prices, quantities, offers and listing state;
• dates associated with importing, creating, updating or listing an item; and
• generated or edited listing content.

Technical, diagnostic and security information

flista may record limited technical information needed to deliver and protect the service, such as:

• IP address;
• browser type and user-agent information;
• request dates and times;
• login and account-security events;
• server, API and extension error information; and
• actions required to diagnose faults or prevent misuse.

flista does not use this information to build advertising profiles or track users across unrelated websites.

3. flista browser extensions

flista extensions may read and interact with supported flista and marketplace pages when necessary to perform an action requested by you. This can include:

• reading details from the listing or marketplace page currently being processed;
• entering titles, descriptions, categories, prices, tags, SKUs and other listing information;
• uploading product photographs;
• reading listing status and confirmation messages; and
• returning the result of the requested action to flista.

Extension permissions are used to provide supported listing functions. flista does not intentionally collect a general history of websites you visit, personal communications, or keystrokes unrelated to a flista action.

4. AI-assisted processing

flista may use OpenAI, Google AI or another identified AI provider to analyse product photographs and listing information, and to suggest titles, descriptions, categories, item specifics, prices, tags or similar listing content.

When an AI feature is used, the photographs and listing information reasonably needed for that feature may be sent to the AI provider for processing. flista does not send marketplace passwords or complete payment-card information to an AI provider.

Do not upload photographs or enter listing text containing unnecessary names, addresses, shipping labels, financial information, health information or other sensitive personal information.

5. Payments

Stripe processes flista payments. flista may receive:

• payment success or failure status;
• your plan and subscription status;
• Stripe customer, payment or subscription references; and
• invoice and transaction information required for support, accounting or legal compliance.

flista does not receive or store your complete card number, card-security code or online-banking credentials.

6. Why flista uses information

flista uses information to:

• create, authenticate and administer accounts;
• provide subscriptions, credits and requested flista functions;
• import, create, edit, save and transfer listings;
• connect to eBay and work with supported marketplace pages;
• process photographs and generate listing suggestions;
• process payments and maintain appropriate billing records;
• provide support and respond to enquiries;
• prevent fraud, abuse and unauthorised access;
• diagnose errors and maintain service reliability; and
• comply with legal, accounting and regulatory obligations.

7. Lawful bases

Depending on the activity, flista relies on the following lawful bases:

• Contract: processing needed to create your account, provide paid or requested functions, manage credits and subscriptions, and perform listing actions you initiate.
• Legitimate interests: securing the service, preventing misuse, diagnosing faults, providing support and maintaining reliable operation, balanced against your rights.
• Legal obligation: processing or retention needed for tax, accounting, court, regulatory or other legal requirements.
• Consent: where flista specifically asks for permission for optional processing. Consent can be withdrawn at any time, although this does not affect processing already carried out lawfully.

8. Who information is shared with

flista does not sell, rent or trade personal information. Information is shared only where needed to provide the service, comply with law or protect legitimate rights. Recipients may include:

• eBay: when you authorise account access or ask flista to import, create or manage eBay listing information.
• Vinted and Etsy: when the flista extension enters or reads listing information on those services at your request.
• OpenAI, Google AI or another identified AI provider: when an AI-assisted feature processes listing text or photographs.
• Stripe: for subscription and payment processing.
• Hosting, storage, backup and email providers: where necessary to operate flista and deliver essential communications.
• Professional advisers, courts, regulators or public authorities: where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights, investigate misuse or protect users and systems.

Providers acting for flista are expected to process information only for the relevant service and under appropriate data-protection obligations.

9. International processing

Some providers may process information outside the United Kingdom. Where this is a restricted transfer under UK data-protection law, flista will rely on an appropriate safeguard, such as a UK adequacy regulation, approved contractual clauses or another lawful transfer mechanism.

10. How long information is kept

• Active accounts: account information, settings and saved data may be retained while the account is active.
• Unfinished listings: listings that have not been uploaded or deleted may be removed after 30 days, together with associated temporary files.
• Cancelled accounts: account data may normally be retained for up to three months to allow reactivation and for legitimate administration, security and legal purposes.
• Immediate deletion requests: information no longer required will be deleted or anonymised without undue delay after identity checks, subject to lawful retention requirements.
• Technical logs: diagnostic and security logs are retained only for a reasonable period needed to investigate faults, misuse or security events.
• Financial records: invoices and transaction records may be retained for the period required by tax, accounting and legal obligations.
• Backups: deleted information may remain temporarily in secure backups until those backups are overwritten in the normal cycle.

11. Cookies and browser storage

flista uses essential cookies and browser storage needed for login, sessions, security, settings and communication between flista and its browser extensions.

flista does not currently use analytics, advertising or behavioural-tracking cookies. If that changes, this policy and any required cookie choices will be updated before non-essential tracking is enabled.

12. Security

flista uses reasonable technical and organisational measures appropriate to the information processed. These include HTTPS encryption in transit, hashed passwords, account authentication, access controls and restricted handling of marketplace authorisation tokens.

No internet service is completely secure. You should protect your password, marketplace accounts and devices, and notify flista promptly if you suspect unauthorised access.

13. Your data-protection rights

Depending on the circumstances, you may have the right to:

• request access to your personal information;
• have inaccurate or incomplete information corrected;
• request deletion of information;
• request restriction of processing;
• object to certain processing;
• receive information you provided in a portable format, where applicable;
• withdraw consent where consent is the lawful basis; and
• complain to a data-protection regulator.

These rights can be subject to legal conditions and exceptions. flista may need to confirm your identity before providing, changing or deleting account information.

Send requests to support@flista.net. flista will respond without undue delay and normally within one calendar month.

14. Children

flista is intended for adult resellers and is not intended for anyone under 18. flista does not knowingly collect account information from children.

15. Changes to this policy

This policy may be updated when flista, its providers or legal requirements change. The date at the top will be updated. Material changes will be brought to users' attention where reasonably practicable.

16. Contact and complaints

Email: support@flista.net

You may also complain to the Information Commissioner's Office. Information about making a complaint is available at ico.org.uk/make-a-complaint . flista would appreciate the opportunity to address your concern first.