Privacy notice

We receive information you give us when you create an account, sign in with Google or GitHub, save or configure a build, place an order, request support, or contact us. We also receive transaction information from payment providers and routine technical information when you use the site.

If you buy through eBay or another marketplace, we receive the identity, contact, delivery, order and message information the marketplace supplies so we can fulfil the contract, provide support and create or securely link your build portal. The marketplace remains responsible for its own processing.

If you use a third-party sign-in service, that provider may send us basic profile and account information in line with the permissions shown during sign-in. Their own privacy notice also applies to their processing.

We share only what is reasonably necessary with service providers that help us run the shop, such as Stripe for payments, hosting and infrastructure providers, Google or GitHub when you use their sign-in option, email providers, couriers and insurers for delivery, approved AI/LLM providers where needed for a requested feature, and professional advisers where needed.

We may also disclose information where required by law, to protect customers or the business, or as part of a sale or reorganisation of the business. We do not sell your personal information.

Hermes sends the question you submit and recent conversation context to our support service, which may use the configured AI/LLM provider to produce a grounded response. Build recommendations also use the workload, budget and configuration choices you provide. Do not enter passwords, card details or sensitive personal information into the chat. General chat does not authenticate you or grant access to private order facts; use your signed-in portal for those.

If you submit photographs, a system report or support evidence, provide only material relevant to the request. Remove unrelated documents, visible personal information and secrets where possible. A system report or screenshot can contain device names, installed software or account information. We use submitted material for the assessment, fulfilment or support purpose, not as automatic permission to publish it in our journal or social channels.

We may show a genuine recent live purchase, the recorded amount paid and a link to the machine or a public purchased-configuration snapshot. The notification feed covers recent qualifying purchases; a linked product or snapshot page may remain accessible after the notification stops appearing. Snapshots are excluded from our sitemap and marked not to be indexed, but they are public links, not private account pages.

We do not include customer contact details, payment identifiers or private order references in this purchase feed. A distinctive configuration, price or time could still be recognisable to someone who already knows about a purchase. Contact us to object or request that activity relating to your purchase is reviewed for removal. We can retain underlying order records where required for the contract or legal obligations.

A separate legacy activity/globe service can process a shipping address through OpenStreetMap Nominatim or a sign-in IP address through ip-api.com to obtain location information. Its older public feed can include a first name and surname initial, activity time and location data. This is separate from the current purchase notification, which does not need geocoding. Contact us if you want to object to identifiable activity being displayed.

Depending on the circumstances, you may ask for access to your information, correction, erasure, restriction, or a portable copy. You may also object to processing based on legitimate interests and withdraw consent at any time. Some rights have legal limits, and we may need to verify your identity before acting on a request.

Your right to objectYou have the right to object to processing based on our legitimate interests. You always have the right to object to direct marketing.

Please contact us first so we can help. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

We normally respond to a data-rights request within one month. If a lawful extension is needed because of complexity or the number of requests, we explain that within the initial month. You do not need to make a complaint to us before contacting the ICO.

We need the contact, delivery, payment-status and order information required to enter and fulfil a contract. Without it, we may be unable to accept or deliver an order. Optional profile, personalization and marketing information is identified separately.

Automated tools may help classify requirements, compare compatible components or draft an explanation. They do not independently decide payment eligibility, statutory rights, warranty outcomes or whether a customer may obtain credit. You can ask for human review of a recommendation.

We use appropriate technical and organisational measures to protect personal information, but no internet service can guarantee absolute security. Please use a strong, unique password and tell us promptly if you think your account has been compromised.

FlipFlop is not directed at children, and we do not knowingly collect personal information from children who cannot lawfully provide it. Please contact us if you believe a child has provided us with personal information.