UltraFeeds1. Who we are
UltraFeeds (ultrafeeds.online) is operated by BS Management, VAT number BG207472831, 19 Georgi Benev St., 6000 Stara Zagora, Bulgaria (“we”, “us”). Contact for all privacy matters: office@ultrafeeds.online.
2. Two roles: controller and processor
We are the controller for the data of people who visit our website, create an UltraFeeds account or write to us.
We are a processor for the personal data of your buyers on eBay, Shopify and Kaufland (for example names and shipping addresses in orders). We process that data only on your instructions and only to provide the service, under our Data Processing Agreement, which is part of our Terms. For that data you, the seller, are the controller.
3. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: e-mail, name, company, password (stored only as a bcrypt hash), time you accepted the Terms | Create and run your account, sign you in, contact you about the service | Art. 6(1)(b) — contract |
| Session data: a random session token, IP address and time of sign-in | Keep you signed in, protect accounts against misuse | Art. 6(1)(b) and 6(1)(f) — security |
| Connected channels: eBay user ID, username and encrypted OAuth tokens; Shopify store address and encrypted app keys; Kaufland encrypted API keys and storefront | Act on the channels for you: create listings and products, read settings, products and orders | Art. 6(1)(b) — contract |
| Your feeds and items: feed URL or uploaded file, product data, sync history | Create and update your eBay listings | Art. 6(1)(b) — contract |
| Orders from eBay, Shopify and Kaufland, including buyer name or username, shipping address and phone number where the channel provides them | Show you your orders in one place (as your processor) | Your instructions under the DPA (Art. 28) |
| Activity log: what happened in your account and why an action was refused | Support, security, proving what happened | Art. 6(1)(f) — legitimate interest |
| E-mails you send us | Answer you | Art. 6(1)(b) or 6(1)(f) |
| Technical server logs: IP address, time, requested address | Operate and secure the servers | Art. 6(1)(f) — legitimate interest |
We do not sell personal data, we do not use it for advertising and we do not use analytics or tracking tools on the website or in the app.
4. Data we receive from the channels
When you connect an eBay account you approve access on eBay's own page. We receive only what the approved permissions allow: your listings and inventory (sell.inventory), your business policies (sell.account), your orders (sell.fulfillment) and the identity of the connected account (commerce.identity.readonly). We use eBay data only to provide UltraFeeds to you, in line with the eBay API License Agreement. Details: eBay data & deletion.
When you connect a Shopify store or a Kaufland account you give us API keys from your own account. We use them only to read and write what the service needs: products and inventory (Shopify), offers and product data (Kaufland), store settings, and orders. Shopify and Kaufland remain independent controllers of the data in their systems.
5. How long we keep data
- Account data — until you delete your account (Account → Delete account) or ask us to. Deletion is immediate.
- Tokens and keys, feeds, items and orders of a connected channel account — until you disconnect that account, delete your UltraFeeds account, or (for eBay) eBay notifies us that the eBay account was deleted. They are then deleted immediately.
- Buyer data in orders — as above; in addition, when eBay notifies us that a buyer deleted their eBay account, we remove that buyer's personal data from the stored orders at once.
- Password reset links — valid for one hour, single use.
- E-mails to us — as long as needed to handle your request and any follow-up.
- Invoicing data — as long as Bulgarian accounting and tax law requires.
6. Who helps us (recipients)
| Recipient | What for | Where |
|---|---|---|
| Hostinger International Ltd. | Server hosting (virtual server) for the website, app and database | Data centre in Frankfurt, Germany (EU) |
| Hostinger International Ltd. | E-mail: our mailbox office@ultrafeeds.online and system e-mails such as password resets | Hostinger's e-mail infrastructure |
| eBay, Shopify, Kaufland | Receive what you tell us to send (listings, products, offers, inventory). Each is an independent controller under its own privacy notice. | — |
We may disclose data to authorities where the law requires it.
7. Transfers outside the EEA
Where a recipient processes data outside the European Economic Area, the transfer is based on the European Commission's Standard Contractual Clauses or an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified). You can ask us for a copy of the safeguards.
8. Security
- Encrypted connections (HTTPS/TLS) for the website, app and all calls to the channels.
- Channel tokens and API keys and mailbox passwords encrypted at rest with AES-256-GCM; user passwords stored only as bcrypt hashes.
- Session cookies that are HTTP-only and secure; all sessions end immediately when a password is changed or an account is disabled.
- Every account sees only its own data; access checks are done on the server for every request.
- Limits against password guessing; an activity log of refusals and important actions.
If a personal data breach happens, we notify the supervisory authority and affected users as the GDPR requires, and eBay where the eBay API License Agreement requires.
9. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. Write to office@ultrafeeds.online; we answer within one month. Many rights you can use yourself in the app (edit profile, disconnect eBay accounts, delete your account).
If you are a buyer whose data we hold for a seller, please contact the seller first — they are the controller. We will help them answer you.
You may complain to a supervisory authority, in Bulgaria the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, or the authority where you live or work.
10. Cookies
We use one strictly necessary cookie to keep you signed in. No analytics or advertising cookies. See the Cookie Policy.
11. Changes
We update this policy when the service or the law changes. The date at the top shows the current version; for important changes we inform account holders by e-mail in advance.