What we hold on you,
and why.

Feed API is an online wholesale marketplace connecting suppliers and resellers. This policy applies to all three groups of platform users: suppliers, resellers, and website visitors before registration.

It does not cover a reseller's end customers. Feed API does not interact with end consumers directly. Each reseller is responsible for their own customers' privacy on their own sales channel.

Cognivise Limited is the Data Controller for information collected through Feed API, under UK GDPR and the Data Protection Act 2018.

All payment processing and money movement is handled by Stripe, a PCI-DSS certified processor. We never receive or store raw card details, meaning the full card number or CVV, on our own servers.

What we do store is limited to identifiers and statuses: a Stripe Connect account ID for suppliers, a Stripe customer ID and default payment method for resellers, and the status of each transaction. succeeded, failed, or refunded.

• —Contract performance:processing needed to register your account, place orders, and take payment. The platform's core service is not possible without it.
• —Legitimate interest: fraud prevention, platform security, technical performance improvements.
• —Legal obligation: retaining financial records under UK tax law.

We do not currently run consent-based email marketing. If that changes, this section will be updated.

We do not sell your data. We share it only with the processors below, each essential to running the platform:

We may also disclose information where legally required, such as under a court order.

These figures come from the automated cleanup rules actually running in our system, not estimates:

• —Active account data: for as long as your account is open.
• —Financial and order records: minimum 6 years, as UK tax law requires.
• —Successful webhook delivery logs: 30 days.
• —Failed webhook delivery logs: 90 days, kept longer for troubleshooting.
• —Unused registration verification codes: deleted automatically once expired.
• —Bulk import files: 7 days after processing completes.

• —All data is encrypted in transit over HTTPS and TLS.
• —Database access is scoped to each user's own identity using Row Level Security, so suppliers and resellers can only reach data tied to their own account.
• —Sensitive financial operations, such as refunds and payment status changes, sit behind additional controls a regular user account cannot reach.

• —Access: request a copy of the information we hold about you.
• —Correction: ask us to fix inaccurate information.
• —Erasure: request deletion, subject to the legal retention requirements in section 07.
• —Portability: receive your data in a machine-readable format.
• —Objection: object to processing based on legitimate interest.

Contact us via section 14 to exercise any of these.

Some of our processors, including Stripe, Supabase and Cloudflare, may process data on servers outside the UK. Where that happens we rely on valid legal transfer mechanisms, such as Standard Contractual Clauses.

Three cookies, and this is all of them. None of them profile you, follow you between sites, or feed an advertising network.

We do not use analytics, advertising, heat-mapping or any other third-party tracking cookies, and there are no third-party cookies on the site at all.

That is also why you have not been shown a cookie banner. Consent is required for cookies that are not necessary for a service you asked for — tracking and advertising cookies above all — and we do not set any. If we ever add one, we will ask you before it is set rather than after, and this section will be updated to match.

Feed API is a B2B platform built for businesses, not individuals under 18. We do not knowingly collect information from children.

This is version 1.0, and it will evolve as the platform grows. We will notify you of material changes by email or in-app notice. The “last updated” date at the top of this page always reflects the current version.

If you have questions about how we use your information, or want to exercise any right from section 09, please reach out:

If you believe your concern has not been addressed properly, you can complain directly to the UK's data protection regulator: