Privacy Policy.

1. Controller

MB Online Marketing operates EcomFlips and is the controller for personal data processed on the platform. Contact: privacy@ecomflips.co.

2. What we process, and why (lawful bases)

• Account data (email, name, country, sign-in events) to provide the service (contract, Art. 6(1)(b) GDPR).
• Listing and transaction data (listing details, financial figures, offers, agreement acceptances with timestamp and IP, checklist confirmations, payment and payout records): contract performance and our legitimate interest in a reliable, evidenced marketplace (Art. 6(1)(b), (f)).
• Deal-room messages: contract performance; messages are scanned automatically for contact details to enforce platform rules (legitimate interest, Art. 6(1)(f)); flagged messages are reviewed by our team.
• Audit records: legitimate interest and legal obligations: state transitions and platform actions are kept as an append-only record for dispute resolution and fraud prevention.
• Transactional email (via Resend): contract performance. We log sent notifications.

3. Payments

Buyers pay by bank transfer to EcomFlips, so we process the payment details that reach us with a transfer (the sending account name and any reference) and our own record of what was received and paid out. Our bank processes the transfer itself under its own terms. Deals created before 11 August 2026 were paid through Escrow.com, an independent controller: for those we shared the parties' email addresses and the transaction parameters with them, and their own privacy policy governs that processing.

4. Anonymity between users

Public listings and deal rooms show anonymized handles (e.g. “Seller #S-1042”), never names or emails. Identity is disclosed to the counterparty in the course of the transaction, as described in the Transaction Agreement.

5. Storage, hosting, and retention

• We aim to host EU user data in the EU where practical; current infrastructure: managed Postgres and hosting on EU regions where available.
• Transaction, agreement, and audit records are retained for as long as needed for legal claims and bookkeeping obligations, then deleted or anonymized.
• Accounts inactive for extended periods may be anonymized on request or per retention schedule.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection under GDPR. Email privacy@ecomflips.co; we export or delete your data on request, except records we must keep (e.g. transaction and audit records tied to executed deals). You can lodge a complaint with your supervisory authority.

7. Cookies & analytics

EcomFlips uses only strictly necessary cookies: session authentication and CSRF protection. We set no analytics, advertising, or other non-essential cookies, and nothing non-essential is set before consent. If that changes, we will ask for consent first.

To understand how the site is used, we run privacy-friendly, cookieless analytics (Vercel Web Analytics). It measures aggregate traffic and page performance without setting cookies, without fingerprinting, and without tracking you across other websites. No personal profiles are built and the data is not sold or shared for advertising.