Cookie Policy

Cookies are small text files that are placed on your computer or mobile device when you visit a website. They help websites work more efficiently and provide information to site owners about how visitors use the site.

In addition to cookies, we use your browser’s local storage (localStorage) to store certain data on your device. Local storage works similarly to cookies but can store larger amounts of data and does not expire automatically. Under applicable EU and Spanish privacy law, local storage is treated the same as cookies, and we apply the same consent rules described in this policy.

We use cookies and similar technologies to improve your browsing experience, analyze site traffic, and understand where our visitors are coming from. We obtain your explicit consent before placing any non-essential cookies or local storage data on your device, as described in this policy.

This Cookie Policy is provided in compliance with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection (LOPDGDD), the Spanish Information Society Services Act (LSSI-CE), and — for our UK users — the UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

Strictly Necessary Cookies (Essential – No Consent Required). These cookies and local storage items are essential to operate our website. They enable basic functionality such as page navigation, login access, secure areas, form draft auto-save, and security features. The website cannot function properly without them, and they cannot be disabled. Essential items include your authentication session cookie (which keeps you logged in), form draft storage (which prevents data loss if your browser closes unexpectedly), push notification subscription state, last login security information, and your consent preferences record.

Personalisation Cookies (Optional – Consent Required). These cookies and local storage items remember your preferences to provide a more personalised experience. For example, they remember whether you have collapsed or expanded sidebar panels, your preferred display currency, and your profile completion progress. If you withdraw personalisation consent, any push notification subscription active in this browser will also be deactivated.

Analytics Cookies (Optional – Consent Required). These cookies help us understand how users interact with our website by collecting anonymous usage data such as pages visited and user flows. We use Google Analytics for third-party analytics; this data may be processed on Google’s servers in the United States, and we rely on safeguards such as the EU–US Data Privacy Framework and Standard Contractual Clauses approved by the European Commission to protect these transfers. We also collect anonymous first-party usage data including deal page views, supplier profile views, and product listing impressions to help suppliers understand the performance of their listings. This first-party data is processed on our own servers and is not shared with third-party analytics providers.

Our Google Analytics integration uses Google Consent Mode v2 in its advanced configuration. Until you accept analytics cookies, the Google Analytics tag stores no cookies on your device and sends only anonymous, cookieless "pings" to Google — these contain no cookies and no personal identifiers (your IP address is truncated) and are used by Google solely to build aggregate, non-identifying conversion and behavioural models. No _ga or other analytics cookie is placed on your device, and no cookie-based analytics takes place, until you give your explicit consent. If you reject analytics cookies, full analytics tracking does not run; rejecting analytics cookies in the banner is the appropriate choice if you would prefer that nothing at all is sent to Google. The user- and event-level data that Google Analytics retains on our behalf is held for a maximum of 14 months.

Targeting and Advertising Cookies (Optional – Consent Required). These cookies are used to deliver advertising relevant to you and your interests and to measure the effectiveness of our advertising campaigns. As of the effective date of this policy, WholesaleUp does not deploy any third-party advertising cookies or ad pixels, and has not installed a tag manager such as Google Tag Manager. If we introduce advertising platforms in future — which may include Google Ads, Meta Ads (Facebook and Instagram), X (formerly Twitter) Ads, LinkedIn Ads, Pinterest Ads, Microsoft Advertising (Bing), or TikTok Ads — we will update this policy, notify you, and re-solicit your consent before any such cookies are set. No advertising cookies will be activated without your explicit consent.

Affiliate Tracking Cookie (Optional – Marketing Category). If we operate an affiliate referral programme and you arrive via an affiliate link (e.g. wholesaleup.com/r/CODE), we may set a first-party cookie (wup_aff_ref) to attribute your visit to the referring affiliate. This cookie would store only the affiliate’s referral code and the timestamp of the click, and would expire after 60 days (or 90 days for top-tier affiliates). It would be used to calculate commissions owed to the affiliate if you subsequently register and make a purchase. It falls under the Marketing consent category and would be set only if you have accepted marketing cookies. As of the effective date of this policy the affiliate referral cookie is not yet active on the website. No personal data is shared with the affiliate — they see only aggregate conversion statistics in their dashboard.

Essential (No Consent Required). next-auth.session-token (HTTP-only cookie): Keeps you logged in. Expires after 30 days, or 90 days if you check ‘Keep me signed in’. • wup-cookie-consent (localStorage): Stores your consent choices and timestamp. • wup-draft-account-profile, wup-buyer-profile-draft, wup-supplier-profile-draft, wup-deal-draft-new (localStorage): Auto-save form drafts to prevent data loss; cleared on successful submission. Sensitive fields such as passwords and tokens are never stored. • wup_last_login (localStorage): Records your last login time, browser, and OS for security awareness. • wup-push-permission-asked, wup-push-subscription (localStorage): Tracks push notification UI state and subscription status.

Personalisation (Consent Required). wup-sidebar-collapsed (first-party cookie; 1-year expiry): Remembers whether you have collapsed the left navigation sidebar. The cookie is only set if you have accepted personalisation cookies; without consent your toggle is remembered in memory only for the current page. • wup-account-collapsed, wup-tips-collapsed, wup-filter-collapsed, wup-contact-collapsed, wup-buyer-profile-collapsed (localStorage): Remember your account, tips, filter, contact, and buyer-profile panel collapse preferences. • wup-contact-optional-collapsed (first-party cookie; 90-day expiry): Remembers whether you have collapsed the “optional fields” section in the supplier contact modal. Only set if you have accepted personalisation cookies. • wup-header-currency (first-party cookie; 180-day expiry): Remembers your selected display currency so prices render in your preferred currency on every page, including the very first paint. Any pre-existing browser-storage entry by the same name from prior versions of the site is treated as legacy and is cleared if you withdraw personalisation consent. • wup-account-profile-pct, wup-buyer-profile-pct, wup-supplier-profile-pct, wup-deal-form-pct (localStorage): Legacy profile and form completion progress entries from prior versions of the site. No longer written by current versions; any pre-existing browser-storage entry is cleared if you withdraw personalisation consent.

Analytics (Consent Required). These cookies are set only after you accept analytics cookies — under Google Consent Mode v2 (advanced configuration), no analytics cookie is placed on your device before consent (see clause 2.3). _ga, ga* (first-party cookies set by Google Analytics): Visitor and session identification for traffic analysis. 2-year expiry.

Marketing (Consent Required). As of the effective date of this policy, no marketing cookies are active on the WholesaleUp website. If we activate marketing cookies in future, they will be added to this inventory and consent will be re-solicited before they are set. Cookies we may add in future include: wup_aff_ref (first-party cookie) for affiliate referral attribution with a 60-day or 90-day expiry; _gcl_au, _gcl_aw (first-party cookies set by Google Ads) for conversion attribution with a 90-day expiry; _fbp, _fbc (first-party cookies set by Meta) for Facebook/Instagram conversion tracking with a 90-day expiry; tt* (first-party cookies set by TikTok) for TikTok conversion tracking; li_fat_id (first-party cookie set by LinkedIn) for LinkedIn ad attribution with a 30-day expiry; _pin_unauth (first-party cookie set by Pinterest) for Pinterest conversion tracking with a 365-day expiry; and _uetsid, _uetvid (first-party cookies set by Microsoft Advertising) for Bing Ads conversion tracking with 30-day / 13-month expiries.

Fraud and Abuse Detection (No Consent Required — Strictly Necessary). These cookies and similar storage items support our license-abuse detection layers. They are classified as strictly necessary under regulation 6(4)(b) of the Privacy and Electronic Communications Regulations (PECR) and Article 5(3) of the e-Privacy Directive (transposed into UK law) because they are required to deliver the security service you have explicitly requested by signing in to a paid subscription. The European Data Protection Board's Guidelines 2/2023 on Article 5(3) confirm that one-way device fingerprinting performed within a single first-party context, used solely to detect account abuse (no cross-site tracking, no advertising profiling, no re-identification across companies), falls within this exemption. They are also disclosed here for transparency. • __wup_st (HTTP-only first-party cookie; up to 30 days; HttpOnly + Secure + SameSite=Lax): SESSION_TRUST grant token. Marks this device as a “trusted” slot so the single-active-session check does not sign you out when you log in from another device. Capped at 2 active grants per account; managed by you on /dashboard/account-access. • __wup_td (HTTP-only first-party cookie; up to 30 days): 2FA-trust device marker. Used by the two-factor-authentication flow + reused as a device-correlation signal during license-abuse detection. • wup-evicted (short-lived first-party cookie; cleared on next page load): One-shot signal set when our system has just signed your older session out because a new one was opened elsewhere. The middleware reads it once to redirect you to the explanation banner (/register?notice=evicted) and then deletes it. • wup-fp-enriched-v1 (sessionStorage entry; cleared when you close the browser): Used internally to ensure we only enrich your fingerprint hash with browser-only signals (screen size, time-zone, navigator.platform) once per browser session. No personal data is stored in this entry — it holds the literal value “1” as a per-session flag. None of the above are shared with third parties. None are used for advertising or cross-site tracking. The hash itself is computed and stored server-side; the cookies above are short-lived, opaque tokens — they do not encode your raw browser fingerprint. See §1.10 of our Privacy Policy for the full retention schedule and the Article 6(1)(f) UK GDPR legitimate-interest assessment that supports this processing.

AI Message Translation (No Cookies — Server-Side Only). The AI translation feature in /dashboard/messages uses NO cookies and NO browser-side storage of its own. Your translation preferences (preferredLanguage and translationOptOut) live on your User row in our database and are surfaced via your account-profile settings — you toggle them once on /dashboard/account-profile → Contact Options → Communication Preferences and the value persists server-side across every device you sign in from. Translation requests, the cached translated message bodies, the source-language detection, and the daily cost-budget counter all live entirely on the server (Postgres + Redis). Because no client-side storage is involved, the feature does not require cookie consent and does not appear on the cookie banner. Should a future ship introduce a client-side cookie (e.g. wup_translation_opt_out as a defensive cache when the user is signed out), it would be classified as strictly necessary (essential to delivering the user's documented opt-out preference without re-prompting on every page load) and would be added to §3.1 above. See §1.11 of our Privacy Policy for the full data-flow + retention details + Article 6(1)(b) UK GDPR contract-performance basis.

We use a cookie banner to request your consent before any non-essential cookies are set. You are presented with the following options: "Reject All" (only essential cookies remain active), "Preferences" (where you can manage individual cookie categories), and "Accept All" (enables all cookie categories).

Our website implements Google Consent Mode v2: your consent choices for analytics and advertising storage are transmitted to Google's tags so they automatically adjust their behaviour to match your decision. In its advanced configuration, the Google Analytics tag sends only anonymous, cookieless pings until you consent, and sets no analytics cookie before then (see clause 2.3).

You may update or withdraw your consent at any time by clicking on the "Cookie Settings" link in the footer of our website. This will reopen the preferences panel, allowing you to change your choices.

We use opt-in consent for all non-essential cookies and trackers. You will be asked to provide explicit consent before we place non-essential cookies. You may update your preferences at any time via our cookie settings panel.

You can control cookies in the following ways: use our Cookie Settings panel to select or deselect cookie categories.

Adjust your browser settings to block or delete cookies. Most browsers allow you to refuse or accept cookies, delete existing cookies, and set preferences for certain websites.

Use browser tools such as Incognito/Private Mode to limit tracking while browsing. Note: We do not currently respond to ‘Do Not Track’ browser signals, as there is no universally accepted standard for how these should be interpreted.

Should we deploy third-party advertising platforms in future (see clause 2.4), you may additionally opt out at source using the following tools: Google Ads Settings (ads.google.com/settings), Meta Ad Preferences (facebook.com/ads/preferences — covers Facebook and Instagram), X Privacy Center (x.com/settings/privacy_and_safety), LinkedIn Ad Preferences (linkedin.com/psettings/advertising), Pinterest Privacy Settings (pinterest.com/settings/privacy), Microsoft Advertising Opt-Out (about.ads.microsoft.com/en-us/resources/policies/opt-out-of-the-microsoft-advertising-network), TikTok Ad Settings (tiktok.com/setting/ads), or the Network Advertising Initiative opt-out page (optout.networkadvertising.org).

Please note: Disabling cookies may affect certain functionality, but essential services will remain accessible.

Our analytics cookies involve transferring data to servers operated by Google (Google Analytics), some of which are located outside the European Economic Area (EEA). Google Analytics data may be processed on Google’s servers in the United States. If we introduce advertising platforms in future (Google Ads, Meta (Facebook and Instagram), X (Twitter), LinkedIn, Pinterest, Microsoft, or TikTok), those transfers would be subject to the same safeguards described below, and we would update this policy and re-solicit consent before any such transfer begins.

We ensure such transfers are protected by appropriate safeguards, including Standard Contractual Clauses approved by the European Commission and, where applicable, the EU–US Data Privacy Framework. For transfers to the UK, we also rely on the UK International Data Transfer Agreement or UK Addendum to the EU SCCs.

We will remember your cookie preferences for 12 months from the date you provide or update your choices. After that period, you will be prompted to reconfirm your preferences. When you are re-prompted, your previous preferences will be pre-filled so you can review and adjust them rather than starting from scratch.

You can change your cookie preferences at any time by using the Cookie Settings link in the footer of our website.

We may update this policy from time to time to reflect changes to the cookies we use or legal requirements. Any updates will be posted on this page with an updated effective date.

We encourage you to review this Cookie Policy periodically to stay informed about how we use cookies.

For questions about this Cookie Policy or our data protection practices, contact us at: Tradegenius SL, Calle Villalba Hervas 2, 4-2, Santa Cruz de Tenerife, 38002, Spain. You may also reach us via the contact form on our website. For more information about how we process your personal data, please see our Privacy Policy.

If you are unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority. As we are established in Spain, our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD) at www.aepd.es. If you are based in the United Kingdom, you may also contact the UK Information Commissioner’s Office (ICO) at www.ico.org.uk, or any other competent data protection authority in the EU/EEA.