Draft, not legally reviewedThis document is an engineering draft. It describes what the SerialFlow application actually does with personal data, and it has not been reviewed or approved by a lawyer. Do not rely on it as a final statement of our legal obligations, and do not publish it as one until counsel has read it and the bracketed placeholders below have been filled in with real values.
1. Who this policy covers
SerialFlow is inventory, purchasing, shipping and returns software for businesses that sell used electronics one unit at a time. This policy explains what personal data the service handles, why, who else sees it, how long it is kept, and how to ask us to show it to you or erase it.
The service is operated by [legal entity name], of [registered address]. It covers three different groups of people, and the difference matters because it decides who you should ask about your data:
Our customers. The businesses that hold a SerialFlow workspace, and the staff members they invite into it. For their account data we are the controller, which means we decide why and how it is used, and requests come straight to us.
Our customers’ buyers and suppliers. The people whose names, addresses and order details appear inside a customer’s workspace, including buyers whose orders were pulled in from a connected marketplace. For that data our customer is the controller and we are the processor: we hold and process it on their instructions. See section 8 for where to send a request about it.
Visitors to this website. Anyone reading these public marketing pages. Section 9 covers what that does and does not involve.
2. The data we collect
2.1 Workspace and account data
When a business signs up we collect the workspace name, and for each staff member a name, an email address and a password, which is stored only as a salted hash and never in a form we can read. We also keep the record of who invited whom, what permissions each member holds, and when sessions were signed in or revoked, because an audit trail of who could do what is part of keeping the account secure.
2.2 The business records you enter
SerialFlow stores whatever a customer puts into their workspace. In practice that includes supplier and customer contact details, purchase orders, sales orders, shipping addresses, device records with their serial numbers or IMEIs, photographs of stock, uploaded documents such as resale certificates, and internal notes. Some of this is personal data about identifiable people, and all of it belongs to the customer whose workspace it sits in.
2.3 Marketplace buyer data from connected sales channels
This is the category worth reading closely. When a customer connects a sales channel such as eBay, SerialFlow pulls their orders from that marketplace on their behalf, and those orders carry the buyer’s personal data. Depending on what the marketplace releases, that can include:
the buyer’s marketplace username and account identifier;
their name, and the email address the marketplace exposes to the seller, which on some marketplaces is a relay address rather than a real inbox;
the full shipping address, including any care-of name and delivery remarks;
the order itself: items, quantities, prices, taxes, fees, and the payment and payout records the marketplace reports back;
tracking numbers and delivery events once the parcel is on its way.
We pull this because it is what makes the order shippable and the books reconcilable. We do not buy marketplace data, we do not enrich it from other sources, and we do not use it to market anything to the buyer.
2.4 Technical and usage data
Our servers and our hosting provider keep the ordinary operational records: IP address, timestamp, the URL requested, the response status, and browser user agent. These are used to run the service, to investigate faults, and to detect abuse. We deliberately do not write personal data such as buyer names or addresses into application logs.
3. Why we use it
To provide the service. Showing a workspace its own stock, orders and documents, importing orders from connected channels, buying shipping labels, printing paperwork, and calculating what a sale actually earned.
To keep accounts secure. Authenticating sign-ins, enforcing permissions, rate limiting, and investigating suspicious activity.
To support customers. Answering questions, which sometimes means looking at the records a customer is asking about, with their knowledge.
To meet legal and tax obligations. Invoices, customs declarations and financial records have retention rules of their own, and those rules can outlast a request to delete the underlying account.
To improve the product. Aggregate, non-identifying measures such as which screens are slow. Not by reading one customer’s records to build a feature for another.
Where the law requires a stated legal basis, ours are the performance of our contract with the customer, our legitimate interest in running and securing the service, and compliance with legal obligations. We do not rely on consent for any of the processing described above, and we do not sell personal data.
4. Marketplace data, and eBay in particular
Marketplace data comes to us under the marketplace’s own rules as well as ours. Where a marketplace’s privacy terms are stricter than this policy, the stricter terms apply to the data that came from it.
For eBay specifically, we handle eBay user data in a manner consistent with the eBay User Privacy Notice. In practice:
We retrieve eBay data only for the seller account that authorised us, only through eBay’s official APIs, and only the fields the seller needs to fulfil and account for their own orders.
We do not disclose eBay user data to anyone other than the seller whose account it came from and the service providers listed in section 5 who are needed to fulfil the order.
We honour eBay’s account closure and deletion notifications automatically. When eBay tells us a user has asked for their data to be deleted, the notification is cryptographically verified and then applied across every workspace on this installation, not just the one that happened to trade with them. Order records are stripped of the buyer’s name, email, username and shipping address, the buyer’s contact record is deleted outright, and only a one-way keyed hash of the identifier is kept so the same notice cannot be processed twice.
A seller who disconnects their eBay account stops any further retrieval immediately. Data already imported into their workspace stays there, because it is their business record, until they delete it or close the workspace.
5. Who we share it with
We do not sell personal data and we do not share it for advertising. We do pass it to the service providers that make the product work, each of them bound by contract to use it only on our instructions:
Hosting and infrastructure. The cloud platform that runs the application, the managed database that stores it, and the object storage that holds uploaded photographs and documents.
Connected marketplaces and sales channels. eBay, and any other channel a customer chooses to connect. Data flows both ways: orders in, and listing, quantity and tracking updates back out.
Shipping and logistics providers. Carriers and label providers such as ShipStation and our rate and label API. Buying a label means giving the carrier the recipient’s name and address, because that is what a label is, and international shipments additionally require customs content declarations.
Payment processors. Subscription billing is handled by a third-party processor. Card numbers are handled by that processor and never reach our servers.
File and photo storage a customer connects. Where a customer links their own storage account, such as Dropbox for device photographs, files move between that account and their workspace at their direction.
Email delivery. Transactional email such as invitations, password resets and order documents.
Authorities, where the law requires it, and any acquirer if the business is ever sold, in which case this policy continues to apply until you are told otherwise.
The definitive, named list of subprocessors is [to be published and kept current here].
6. How long we keep it
Workspace records (inventory, orders, documents, contacts) are kept for as long as the workspace is open, because they are the customer’s operational history. Deleting a record inside the app deletes it from the live database.
After a workspace closes, its data is deleted or anonymised within [retention window, e.g. 30 days], apart from anything we are legally required to keep.
Marketplace buyer data follows the order it belongs to, and is removed earlier than that whenever the marketplace sends us a deletion notice for that buyer. See section 4.
Financial and tax records (invoices, customs declarations, ledger entries) are kept for the period the applicable tax law requires, which is longer than the periods above and can survive an account closure.
Operational logs and backups roll off on their own schedule, currently [log and backup retention window]. A deletion applied to the live database reaches a backup only when that backup expires.
7. How we secure it
Every workspace is isolated at the database level. Rows carry the identity of the workspace that owns them and the database itself refuses a query that reaches across that line, so isolation does not depend on the application remembering to ask the right question.
Traffic is encrypted in transit with TLS, and stored data is encrypted at rest by our hosting and database providers.
Passwords are stored only as salted hashes. Third-party credentials such as marketplace API tokens are encrypted before they are stored.
Access inside a workspace is governed by per-member capabilities, so a member only reaches the modules they have been granted, and revoking someone takes effect on their next request rather than when their session happens to expire.
Incoming webhooks from third parties are cryptographically verified before they are allowed to change anything.
Staff access to production data is limited to what is needed to operate the service and to support customers who have asked for help.
No system is perfectly secure. If a breach affects personal data we will notify affected customers and the relevant supervisory authority as the law requires.
8. Your rights, and how to use them
Depending on where you live you may have the right to ask for a copy of your personal data, to correct it, to have it deleted, to receive it in a portable form, to object to or restrict how it is used, and to complain to your data protection authority. We do not charge for any of this and we will answer within the statutory deadline, which is one month in the UK and EU unless the request is unusually complex.
If you hold a SerialFlow account
Most of it you can do yourself: your own profile is editable in Settings, and an administrator can remove a member from a workspace. For anything else, email us at the address in section 13 from the address on your account.
If your data is inside somebody else’s workspace
If you bought from, or sold to, a business that uses SerialFlow, that business is the controller of your data and is the right first stop: they can find, correct and delete your records directly, and they know the context of your order. Contact them, or contact us at the address in section 13 and we will pass the request on and support them in carrying it out. We will not delete a customer’s business records on a third party’s say-so without verifying the request, because doing so on an unverified request would itself be a data protection failure.
If you are an eBay buyer
You can also exercise your rights through eBay directly. Closing your eBay account or asking eBay to delete your data causes eBay to notify us, and we act on that notice automatically across every workspace, as described in section 4. You do not need to find out which sellers used SerialFlow.
9. Cookies and similar technologies
These public marketing pages set no advertising or analytics cookies, and there is nothing here to consent to.
Inside the application we set one strictly necessary cookie: an encrypted session cookie that keeps you signed in and records which workspace and permissions the session carries. It is HTTP-only and marked secure, so page scripts cannot read it, and it is not used to track you anywhere else. Signing out clears it. Blocking it makes signing in impossible, which is why it is classed as strictly necessary rather than optional.
Some pages use your browser’s local storage to remember interface preferences such as a chosen tab or column layout. That stays on your device and is never sent to us. Where an anti-abuse challenge is shown on a public form, the provider of that challenge sets its own cookie for the duration of the check.
If we ever add analytics or marketing cookies, this section and a consent banner will arrive before they do.
10. International transfers
The service and its providers operate across borders, so personal data may be processed outside the country it was collected in, including in the United States. Where data leaves the UK or the European Economic Area we rely on the appropriate safeguards for that transfer, such as the Standard Contractual Clauses or an adequacy decision. Our primary processing region is [hosting region, to be confirmed].
11. Children
SerialFlow is business software and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, tell us and we will delete it.
12. Changes to this policy
We will update this page when the way we handle data changes, and the date at the top of the page always shows when the text last changed. For a change that materially affects customers we will give notice by email as well, rather than relying on you to re-read this page.
13. Contact us
For anything in this policy, including access and erasure requests, contact us: