Privacy policy

This Privacy Policy describes how Minted Ltd ("Minted", "we", "us", "our") collects, uses, and shares personal data when you visit our website, create an account, use our products and services, or otherwise interact with us. It applies to the platform available at app.minted.bot and any related services.

"Personal data" means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR / UK GDPR).

The controller responsible for the processing of personal data within the meaning of Art. 4 No. 7 GDPR is:

Minted Ltd
United Kingdom
E-mail: support@minted.bot

Depending on how you interact with us, we may process the following categories of personal data:

• Identification and contact data - name (where provided), e-mail address, country of residence.
• Account data - username, hashed password, two-factor authentication settings, account identifiers, account creation and last-login timestamps, subscription status.
• Contract and transaction data - products purchased, order numbers, purchase history, dates and amounts, payment status, refund history.
• Payment data - transaction identifiers, billing country, and the last four digits of a payment card where transmitted to us by Stripe. Full payment-card data is processed directly by Stripe and is not stored by us.
• Communication data - the content of e-mails, support requests, and other messages you direct to us, including any attachments you provide.
• Content you submit to the platform - information you choose to save in your account (for example inventory records, tracking numbers, third-party API credentials). Sensitive credentials are stored encrypted.
• Integration data - where you connect a third-party service (such as eBay, Discord, Stripe, or Apple iCloud), the access tokens and limited profile information required by that provider's authorisation flow, used only to deliver the connected feature.
• Usage and technical data - IP address, browser type and version, operating system, device type, language settings, time zone, referrer URL, session identifiers, pages visited, and timestamps.
• Security and fraud-prevention data - IP-based risk indicators, login-failure history, indicators of multi-account or abusive activity, and abuse-report records.

We process personal data only where we have a valid legal basis under Art. 6 (1) GDPR / UK GDPR. The principal bases on which we rely are:

• Art. 6 (1)(b) GDPR - Contract. Processing necessary to perform the contract with you (e.g. account provisioning, order processing, customer support) or to take pre-contractual steps at your request.
• Art. 6 (1)(c) GDPR - Legal obligation. Processing necessary to comply with applicable law (e.g. accounting and tax retention obligations, responses to lawful requests by competent authorities).
• Art. 6 (1)(f) GDPR - Legitimate interests. Processing necessary for our legitimate interests or those of a third party, including (i) the secure and stable operation of our platform, (ii) the prevention and detection of fraud and abuse, (iii) the improvement of our services, (iv) direct communication with existing customers about our own similar services, and (v) the establishment, exercise, or defence of legal claims.
• Art. 6 (1)(a) GDPR - Consent. Where you have given consent for one or more specific purposes (e.g. optional analytics or marketing cookies). Consent may be withdrawn at any time with effect for the future.

Right to object (Art. 21 GDPR). Where processing is based on legitimate interests, you have the right to object at any time on grounds relating to your particular situation. Where personal data is processed for direct marketing, you may object at any time without giving reasons.

We process personal data for the following purposes:

• Provision of the service - delivering the website and the platform, account creation, authentication, delivery of updates, and ensuring technical functionality. Legal bases: Art. 6 (1)(b) and (f) GDPR.
• Order processing, billing, and accounting - processing payments via Stripe, issuing receipts, and keeping accounting records. Legal bases: Art. 6 (1)(b) and (c) GDPR.
• Customer support - responding to your enquiries, processing complaints, and documenting support communications. Legal bases: Art. 6 (1)(b) and (f) GDPR.
• Security, fraud, and abuse prevention - detecting and preventing fraudulent orders, account take-over, abusive multi-account activity, sharing of accounts, and breaches of our Terms. Legal bases: Art. 6 (1)(f), (c), and (b) GDPR.
• Service improvement - analysing aggregated and pseudonymous usage data to understand how the service is used and to improve it. Legal basis: Art. 6 (1)(f) GDPR (or Art. 6 (1)(a) GDPR where consent is required).
• Establishment, exercise, and defence of legal claims - including the preservation of evidence and cooperation with our legal advisers. Legal basis: Art. 6 (1)(f) GDPR.

Some tools use automated image-analysis (an AI model provided by Google) solely to classify the visual anti-bot “challenge” images that third-party retail sites present during automated tasks you initiate. Only the challenge image and a short text instruction are sent to the provider; we do not send your account credentials, payment data, contact details, or any other personal data to it, and the provider does not use the submitted content to train its models on our behalf. This processing is necessary to perform the automated task you requested (Art. 6(1)(b) GDPR) and does not produce a legal or similarly significant effect on you within the meaning of Art. 22 GDPR. You can avoid it entirely by not using the tools that rely on it.

We share personal data only with carefully selected recipients, and only to the extent necessary. The principal categories are:

• Processors acting on our behalf under data-processing agreements pursuant to Art. 28 GDPR, including our hosting provider (Railway), our content delivery and security provider (Cloudflare), our payment service provider (Stripe), our automated image-analysis provider (Google, used only to classify anti-bot challenge images as described in section 6a), and other technical service providers necessary to operate the platform.
• Third-party platforms with which you choose to connect your account (such as eBay, Discord, or Apple), to the extent necessary to deliver the feature you requested.
• Professional advisers such as lawyers, accountants, and auditors, under statutory confidentiality obligations.
• Authorities to the extent required by binding law, court order, or other lawful demand of a competent authority.
• Acquirers and counterparties in the event of a merger, acquisition, asset sale, or similar corporate transaction, subject to appropriate confidentiality safeguards.

We do not sell personal data.

In the course of operating the service, personal data may be transferred to recipients located outside the United Kingdom and the European Economic Area, in particular to the United States and other jurisdictions in which our service providers operate. We ensure that any such transfer is subject to appropriate safeguards within the meaning of Chapter V of the GDPR / UK GDPR, including adequacy decisions, the EU and UK Standard Contractual Clauses, the EU-U.S. Data Privacy Framework (where applicable), and supplementary technical and organisational measures such as encryption in transit and at rest.

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. In particular:

• Account data is retained for the duration of the account, and after closure for the period necessary to defend legal claims.
• Contract and transaction data is retained for the periods required by applicable accounting and tax law.
• Communication data is retained for as long as necessary to handle the relevant matter and any related dispute.
• Server log data is generally retained for a maximum of 30 days, except where a specific incident requires longer retention.
• Security and fraud-prevention data is retained for as long as the underlying risk persists and for the period necessary to defend legal claims.
• Consent records are retained for evidentiary purposes.

Under the UK GDPR and the GDPR, you have the following rights in relation to your personal data:

• Right of access (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to erasure (Art. 17 GDPR), subject to legal exceptions.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR), including the unconditional right to object to direct-marketing processing.
• Right to withdraw consent (Art. 7 (3) GDPR), without affecting the lawfulness of prior processing.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). In the United Kingdom this is the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, please contact us at support@minted.bot. We may require reasonable verification of your identity before responding to a request, in order to protect your data from unauthorised access.

Our website uses cookies and comparable technologies (e.g. local storage). We distinguish between:

• Strictly necessary technologies, which are required to provide the service expressly requested by you (e.g. session, authentication, security). Legal basis: PECR / § 25 (2) No. 2 TDDDG and Art. 6 (1)(f) GDPR.
• Optional technologies (e.g. analytics, marketing), which require your prior, voluntary, specific, informed, and unambiguous consent. Legal basis: Art. 6 (1)(a) GDPR. Consent is requested via our consent banner and may be reviewed or withdrawn at any time.

We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Art. 32 GDPR). These include, in particular, the use of TLS encryption for the transmission of confidential content, encrypted storage of credentials, access controls, and the engagement of service providers with appropriate security standards.

Our services are not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our processing activities, in the legal framework, or in the technical environment. The current version is always available on our website. Where the changes are material, we will inform you appropriately (e.g. by e-mail or a prominent notice on our website).

For any questions about this Privacy Policy or about the processing of your personal data, please contact us at:

Minted Ltd
E-mail: support@minted.bot