Privacy Policy

This policy explains how MultiLister (“we”, “us”) collects, uses, and protects personal data when you use our multi-channel e-commerce listing and order-management service (the “Service”).

There are two kinds of personal data here and they are treated differently. For your account data we are the data controller. For the buyer data that arrives with your orders — your customers’ names and addresses — you are the controller and we are your processor: it is your data, we hold it to run the Service you asked for, and we do nothing else with it. Our data processing agreement sets that out in full.

Information we collect

• Account data — your name, email address, and billing details (handled by our payments provider).
• Channel connections — the API credentials and OAuth tokens for the sales channels you connect, stored encrypted so we can operate the Service on your behalf.
• Catalogue data — your products, prices, stock, suppliers, and related information.
• Order data — orders pulled from your connected channels, including the buyer’s name, delivery and billing address, email address and phone number, used to fulfil and dispatch those orders.
• Security records — sign-ins, failed sign-ins, sign-ins from a device not seen before, password changes, exports, and every occasion on which our staff open or change your account. You can read all of it yourself at Settings → Sign-ins & access.
• Usage data — basic technical logs needed to run and secure the Service.

Order and customer data from your sales channels

When you connect Shopify, eBay, Etsy, WooCommerce or Wix, we read your orders from that channel. Orders contain your buyers’ personal data, and we process it for one reason: to help you fulfil the sale. In practice that means picking lists, invoices, postage labels, customs declarations for international parcels, tracking sent back to the channel, and your own customer and sales reports.

Shopify in particular. Shopify classes order and customer data as protected customer data. We request only the fields the Service needs — name, address, email and phone, which are what a label, a customs form and a tracking notification require — we use them only for the purposes above, and we do not use them to build profiles, to make automated decisions about buyers, or for any kind of marketing. We do not sell data, to anyone, ever. Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) are implemented: a request that arrives on one is passed to you, the merchant, rather than acted on silently — erasing a buyer’s details would rewrite a completed sale you are legally required to keep for six years, so the decision has to be yours.

How we use your data

To provide the Service: importing your catalogue, publishing listings to your connected channels, syncing stock, managing orders, generating invoices and dispatch labels, and supporting your account. We do not sell your data and we do not use your catalogue, orders or buyers to train AI models.

Service providers we share data with

We use a small set of processors, each strictly to run the Service:

• Supabase — database and sign-in. Your data is stored in the EU (Ireland).
• Vercel — application hosting, function logs, and the encrypted restore snapshots.
• Stripe — subscription billing. We never see or store full card details.
• Royal Mail Click & Drop and Parcel2Go — where you buy postage through MultiLister, the recipient’s name and address are sent to create the label.
• Anthropic — the optional AI title, description and keyword tools. Off unless you switch them on, and they send product text only: no order, buyer or credential data is ever included in an AI request.
• Your sales channels — Shopify, eBay, Etsy, WooCommerce, Wix. Data moves between them and MultiLister at your instruction. Those are your own accounts and your own agreements with them.

How your data is protected

• Encrypted in transit, and encrypted at rest by our database host.
• Your channel credentials and carrier API keys are encrypted by the application as well, with keys held outside the database, so a copy of the database alone does not yield them.
• Restore snapshots are encrypted under a separate key and reachable only through short-lived private links.
• Every account is isolated at the database level, not only in our code.
• Our staff can approve an account, change its plan and change its email address. They cannot read your catalogue, orders or buyers through the admin tools, and any time a member of staff opens or changes your account it is written to your own security log, which no one can edit.
• Administrator access requires a second factor.

How long we keep it

Buyer personal data: you choose the period, at Settings → Buyer data. Once set, a nightly job removes the buyer’s name, address, email and phone from settled orders older than that period, while keeping the sale itself — what sold, for how much, and the tax on it — because UK tax records must be kept for six years and none of that needs a name. We suggest 24 months, which outlasts returns, warranty claims and chargebacks. Nothing is deleted until you have chosen a period: we will not destroy your customer records on a default you never agreed to. Setting one is your responsibility as the controller, and we ask for it during setup.

Everything else is kept while your account is active. When you delete your account it goes, including the encrypted restore copies held outside the database. Deleted data may persist in encrypted platform backups until they age out in the normal course.

Getting your data out, and deleting it

At Settings → Account you can download everything in your account as a single file at any time (credentials and carrier keys are excluded from it, deliberately), and you can delete the account outright. Deletion removes your rows and your restore snapshots, and it cannot be undone.

One honest limit: deleting your account destroys our copy of your channel credentials, so MultiLister can no longer act on your shops — but it does not revoke the authorisation at the channel itself. eBay and Etsy publish no way for an app to revoke its own access, and a Shopify app is uninstalled by the merchant. The final screen names each channel you are connected to and where to remove access yourself.

International transfers

Your data is stored in the EU (Ireland). Where data is transferred outside the UK/EEA — some of the processors above operate in the US — we rely on appropriate safeguards, being the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision where one applies.

Your rights

Under UK GDPR you have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise them, use the export and deletion tools in Settings → Account, or contact us below. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

If one of your buyers exercises their rights with you, that request is yours to answer — they are your customer — and MultiLister gives you the tools to do it: find the order, correct it, export it, or remove the buyer’s details from it.

Security incidents

If personal data in MultiLister is breached, we will tell the affected sellers without undue delay and within 48 hours of becoming aware, with what we know and what we have done, so that you can meet your own 72-hour duty to the ICO. Where a breach reaches data from a connected channel, we notify that channel too.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above, and significant ones will be told to you in the app.

Contact

Questions, data requests, or a security report: privacy@multilister.co.uk.