Question 1

What personal data does WholesaleUp™ collect?

Accepted Answer

Nine categories, per Privacy Policy §1: identity and business data (name, company, VAT ID, subscription tier), contact data (email, phone, address, social handles), buyer profile data (categories, volumes, sourcing preferences, target markets), supplier profile data (supplier type, catalogue, certifications, MOQs, payment terms, Incoterms), transactional and behavioral data (deal views, saved deals, supplier visits, searches, impressions — raw events retained 7 days then aggregated into anonymised daily statistics; collected for both registered users and visitors), technical and account data (IP, browser, device, cookies, session tokens, login history, OAuth tokens, push subscriptions and delivery logs), communication preferences (newsletter and notification settings), uploaded content (files, images, logos), and AI chat conversations (stored 90 days by default, with email addresses, phone numbers, and card numbers auto-scrubbed before storage). Full details in our [Privacy Policy](/legal/privacy).

Question 2

How is my data used?

Accepted Answer

Seven purposes, per Privacy Policy §2: to provide and manage your access (contract), improve services (legitimate interests), personalise newsletters, browsing, and product recommendations (consent), send promotional updates (consent / legitimate interests), protect security and prevent fraud — including bot detection, rate limiting, login monitoring, and password-breach checking (legitimate interests), generate aggregated anonymised statistics on platform usage and category trends (legitimate interests), and display a real-time "online now" presence indicator to peers you're in active contact with (only a derived ten-minute boolean flag is shared, never the underlying timestamp — legitimate interests). We never sell or rent your data.

Question 3

What are my rights under GDPR?

Accepted Answer

You have the right to:

• Access your data
• Rectify inaccuracies
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing (including direct marketing)
• Withdraw consent at any time

[Contact us](/contact) to exercise any right. Complaints can be filed with the AEPD (Spain) or ICO (UK).

Question 4

How long is my data retained?

Accepted Answer

Retention is tiered, per Privacy Policy §7 and §1.9:

• Core personal data (profile, contact details, uploaded content) — kept while your account is active
• AI chat conversations — 90 days by default, with email addresses, phone numbers, and card numbers auto-scrubbed before storage; if a chat escalates to a support ticket, the ticket's retention applies instead
• Raw behavioral events (individual deal views, supplier visits, search impressions) — 7 days, then aggregated into anonymised daily statistics and the raw records are permanently deleted
• Account-deletion requests — processed within 30 days of receipt (GDPR Article 12; may extend by up to two months for complex or high-volume requests, with notice)

We also periodically review and securely delete data no longer required.

Question 5

Is my data shared with third parties?

Accepted Answer

Only with vetted sub-processors under GDPR-compliant terms, per Privacy Policy §4:

• Hosting, database, CDN — Vercel
• Email delivery — Resend
• Traffic control & DDoS protection — Cloudflare
• Rate limiting & caching — Upstash
• AI assistant — Anthropic (conversation content you submit)
• Payments — Stripe, PayPal (full card details handled directly by the provider; we only receive a transaction reference plus last-four digits and card brand)
• Analytics — Google Analytics (pseudonymised usage, IP truncated where supported)
• Authentication (OAuth) — Google, Apple, Facebook (only if you choose social sign-in)
• Anti-fraud — Google reCAPTCHA, HaveIBeenPwned (partial password-hash prefix only; your actual password is never transmitted)
• Legal authorities — only if required by law, court order, or regulatory obligation

We do not sell, rent, or lease your data. International transfers outside the EEA / UK are protected by Standard Contractual Clauses (SCCs).

Question 6

What cookies does WholesaleUp™ use?

Accepted Answer

Four consent categories:

• Essential — session, security, consent state, form-draft autosave (always on)
• Personalisation — sidebar preferences, display currency, profile-completion progress (requires consent)
• Analytics — Google Analytics _ga / _gid for usage data (requires consent)
• Marketing/Advertising — ad-platform and affiliate cookies (requires consent)

No marketing cookies are currently active on the site. When our affiliate programme launches, a first-party cookie (wup_aff_ref) will store referral attribution for 60 days (or 90 days for top-tier affiliates) under the Marketing category — and only if you've accepted marketing cookies. You choose which non-essential categories to allow via the cookie banner. Full details in our [Cookie Policy](/legal/cookies).

Question 7

How do I manage my cookie preferences?

Accepted Answer

Click "Cookie Settings" in the website footer at any time to reopen the consent panel. You can accept all, reject all, or pick individual categories. Your choice is stored for 12 months, then we'll re-ask with your previous preferences pre-selected. You can also control cookies via your browser settings.

Question 8

Why does WholesaleUp track my device fingerprint?

Accepted Answer

Paid subscriptions are licensed to one user, so we hash a few browser properties (user-agent, language, screen, time-zone, platform) one-way to detect when the same device suddenly logs in to multiple paid accounts. The hash never leaves WholesaleUp, isn't used for advertising, and is kept for 90 days. Legal basis: Article 6(1)(f) UK GDPR legitimate interest, per [Privacy Policy §1.10](/legal/privacy). You can object via service@wholesaleup.com.

Question 9

What is "impossible-travel" detection and how does it affect me?

Accepted Answer

We compare the country (inferred from IP, country-level only) of two consecutive sign-ins on your account. UK→Mumbai inside an hour fires the check. New accounts (14-day warm-up), frequent travellers, VPN users, and corporate IPs are exempted. We never auto-suspend on this signal alone — appeals are reviewed individually if the system is wrong.

Question 10

How long is my login + device-fingerprint data kept?

Accepted Answer

Device-fingerprint hashes: 90 days. Behavioural aggregates: 90 days. Raw login records: 12 months. Abuse-event audit rows: indefinitely (legal compliance). Older rows are auto-pruned by cron — we don't hoard data. Right to erasure under Article 17 UK GDPR applies, but abuse-audit rows fall under the Article 17(3)(b) legal-compliance exemption.

Question 11

What if I'm flagged for license-sharing by mistake?

Accepted Answer

Detection layers are weighted (no single signal triggers suspension). Tier 0 is just a warning email. Tier 1 is a 24-hour auto-lift. Tier 3+ (30-day) suspensions surface an appeal form on [/suspended](/suspended) — fill it in, our team reviews within 1 business day, and we reverse + pro-rata-credit any false-positive case.

Privacy & Data Protection

Ready to Increase Your
Reseller Profits?

Privacy & Data Protection

Ready to Increase Your
Reseller Profits?

Trust, Safety & Disputes›Privacy & Data Protection

Still have questions?

Privacy & Data Protection

Ready to Increase YourReseller Profits?

Privacy & Data Protection

Ready to Increase YourReseller Profits?

Trust, Safety & Disputes›Privacy & Data Protection

Still have questions?

Ready to Increase Your
Reseller Profits?

Ready to Increase Your
Reseller Profits?