FlipHunter Back to homepage

Privacy Policy

for FlipHunter, a service of BaDuNi GmbH
Version 1.1 — Last updated: 25 August 2026

This is a translation for information purposes. In the event of any discrepancy, the German version prevails.

This privacy policy applies to fliphunter.de and the FlipHunter web app. Happy Arbitrage and EPR Pilot have their own privacy policies at happyarbitrage.de/datenschutz and epr-pilot.eu/datenschutz.

1 Controller

The controller within the meaning of the General Data Protection Regulation is:

BaDuNi GmbH
Iberg 9
77876 Kappelrodeck
Germany

Managing Director: Sebastian Baßler
Commercial register: Mannheim Local Court, HRB 751614
VAT ID: DE369274875

Contact: support@fliphunter.de

No data protection officer has been appointed, as the statutory requirements of Article 37 GDPR and Section 38 BDSG are not met. Please use the contact addresses above for all data protection matters.

This privacy policy applies to the FlipHunter service. Which personal data is processed and which service providers are involved depends on which offering and which functions are used.

The services are directed exclusively at entrepreneurs and commercially acting customers. The data protection rights of natural persons, in particular sole traders, employees and contact persons of a company, remain unaffected by this.

2 Data Processed

Depending on use and the plan booked, we process in particular the following data:

  • Master data, for example name, company, address and billing data.
  • Contact data, for example email address, Discord username, Discord user ID.
  • Contract data, for example product booked, plan, term, payment status, termination status and support history.
  • Payment data, for example payment status, invoice numbers, VAT identification number and Stripe transaction data. We do not store complete card or account details ourselves.
  • Access and authorisation data, for example login, plan status, assigned roles and activations for community and software.
  • Usage data, for example logins, access events, interactions with tools, community or the FlipHunter web app.
  • Communication data, for example emails, support messages and Discord messages.
  • Technical data, for example IP address, browser information, device data, timestamps, error logs and security events.
  • Business data provided voluntarily by customers, for example ASINs, watchlists, deal analyses, storefronts, filter settings, fee settings or VA process information.
  • For FlipHunter additionally selected marketplaces, individual filters, saved views, access status and the configurations required to provide the deals.

3 Purposes and Legal Bases

  • Conclusion and performance of the contract, billing and granting of access on the basis of Article 6 (1) (b) GDPR.
  • Provision of FlipHunter, Discord access, software functions and supplementary services on the basis of Article 6 (1) (b) GDPR.
  • Operation, security, error analysis and abuse prevention on the basis of Article 6 (1) (f) GDPR.
  • Handling support enquiries and contract-related communication on the basis of Article 6 (1) (b) GDPR.
  • Compliance with commercial, tax and company law obligations on the basis of Article 6 (1) (c) GDPR.
  • Newsletters, tracking and marketing on the basis of consent pursuant to Article 6 (1) (a) GDPR or, to the extent legally permitted, on the basis of legitimate interests.

4 Necessity of Provision

Providing name, company, email address, billing data, entrepreneurial status and payment data is necessary for the conclusion and performance of the contract. Without this information we cannot conclude a contract or provide access. A Discord account is required to use Discord functions.

All further information, in particular voluntarily provided business data and content in community contributions, is voluntary. No disadvantages arise from non-provision, other than that the relevant function then cannot be used or can be used only to a limited extent.

5 No Automated Decision-Making

Automated decision-making including profiling within the meaning of Article 22 GDPR does not take place. The automated calculations and evaluations carried out within FlipHunter and ArbitrageOne relate exclusively to product and market data, not to persons.

6 FlipHunter Landing Page and Vercel

The FlipHunter landing page is provided via Vercel. The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.

When the landing page is accessed, IP address, browser information, device data, referrer, time of access, pages requested and technical log and security data may be processed. The processing serves delivery, stability, security, error analysis and abuse prevention.

The legal basis is Article 6 (1) (f) GDPR.

Further information: https://vercel.com/legal/privacy-notice

7 FlipHunter Web App and A1 Infrastructure

The FlipHunter web app, user accounts, access authorisations, filters and saved views are operated within the technical infrastructure of ArbitrageOne GmbH. The following data may be processed in this context: email address, Discord account information (username and user ID), plan booked and access status, assigned roles and permissions, individual filters, selected marketplaces, fee settings, saved views and technical usage, security and error data.

The legal basis is Article 6 (1) (b) GDPR. Security measures, error analysis and abuse prevention are additionally based on Article 6 (1) (f) GDPR.

8 Server Log Files

When the landing page is accessed, Vercel processes technically necessary log data. Within the FlipHunter web app, the infrastructure partners used there may additionally process technical usage, error and security logs. This may include in particular IP address, date and time, resource requested, referrer, HTTP status code, browser information and volume of data transferred.

The data is processed for delivery, stability, error analysis, IT security and abuse prevention. We do not maintain an additional proprietary log database for the landing page. Log data is deleted or anonymised as soon as it is no longer required for these purposes. Where a specific security incident occurs, the data required for that incident may be retained until the investigation and any legal enforcement are complete.

The legal basis is Article 6 (1) (f) GDPR.

9 Cookies and Storage Technologies

The publicly accessible landing page at fliphunter.de currently sets no cookies or comparable storage technologies. No analytics, tracking or marketing services are used there.

The FlipHunter web app uses exclusively technically necessary cookies and storage mechanisms, in particular for sign-in, session management and protection against cross-site request forgery. These storage operations are necessary for the app function expressly requested by the user.

The legal basis for technically necessary storage is Section 25 (2) no. 2 TDDDG in conjunction with Article 6 (1) (b) or (f) GDPR. A consent banner is therefore currently not required on the landing page.

Should services requiring consent be introduced in future, they will be activated only after prior consent pursuant to Section 25 (1) TDDDG and Article 6 (1) (a) GDPR and described at this point.

10 Stripe

We use Stripe for payments, subscriptions, checkout and invoicing. This applies to payments in connection with FlipHunter.

The provider is Stripe Payments Europe, Ltd. or Stripe Technology Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Stripe processes in particular name, email address, billing address, VAT identification number, payment status, payment method, transaction data and technical payment data. Complete payment data such as card numbers is processed by Stripe and not stored by us.

The legal basis is Article 6 (1) (b) GDPR. We process legally required accounting and invoice data additionally on the basis of Article 6 (1) (c) GDPR.

Further information: https://stripe.com/de/privacy

11 Mailjet for FlipHunter

We use Mailjet, a service of the Sinch email group, for contract-related and transactional emails for FlipHunter. The contractual partner and processor is the company designated in the respective data processing agreement.

This includes in particular payment confirmations, access information, system messages and contract-related communication. Processed data includes in particular name, email address, plan booked, access status, time of dispatch, delivery status and technical dispatch and error data.

The legal basis is Article 6 (1) (b) GDPR. Where processing serves system security, deliverability or error analysis, Article 6 (1) (f) GDPR applies. Promotional emails are sent only on the basis of demonstrable consent.

Further information: https://www.mailjet.com/legal/privacy-policy/

12 Discord, Community and Deal Notifications

We use Discord for community, exchange, support, deal notifications and some calls. The provider for users in the European Economic Area is Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands.

Processed data includes in particular: email address, where provided via the Discord connection used; Discord username; Discord user ID; access status; assigned roles and filter channels; message content and interactions; voice and video data where such functions are used; IP address and technical usage data.

Source of the data. We receive the Discord username, Discord user ID and account information not from you directly but via the Discord connection from Discord Netherlands B.V. as soon as you join our server or link your account with our service. We inform you of this pursuant to Article 14 GDPR.

For FlipHunter, Discord is used in particular for granting access, transmitting deal notifications and providing individual filter channels.

The legal basis is Article 6 (1) (b) GDPR for contractually owed community, access and deal functions. Moderation, security and abuse prevention are additionally based on Article 6 (1) (f) GDPR.

When using Discord, users are additionally subject to Discord's privacy policy and terms of service.

Further information: https://discord.com/privacy

13 Bots and Automations on Our Discord Server

We use bots on our Discord server which process messages, user identifiers, roles and interactions to the extent required in each case.

Own bots. Bots operated by us handle in particular access and role management, delivery of deal notifications, announcements of live calls and support functions. Processing takes place in our own infrastructure. The legal basis is Article 6 (1) (b) GDPR, and additionally Article 6 (1) (f) GDPR for security and moderation functions.

Third-party bots. Where we use bots from external providers, the data arising in the respective channel is transmitted to the provider of the bot. The third-party bots used are listed in the recipient overview in section 16. We conclude data processing agreements pursuant to Article 28 GDPR with these providers where required. The legal basis is Article 6 (1) (f) GDPR in a functioning and secure community operation, and additionally Article 6 (1) (b) GDPR for contractually owed functions.

14 ArbitrageOne GmbH

The technical infrastructure and access management for the FlipHunter web app are provided by ArbitrageOne GmbH, Iberg 9, 77876 Kappelrodeck.

In the course of granting access and providing the service, the following data in particular may be transmitted to and processed by ArbitrageOne GmbH: name, where required for the respective access; email address; Discord username; Discord user ID; plan booked; access status; assigned roles and permissions; individual FlipHunter filters; selected marketplaces; fee settings; saved views; technical usage, security and error data.

The legal basis is Article 6 (1) (b) GDPR. Security measures and abuse prevention are additionally based on Article 6 (1) (f) GDPR.

Where ArbitrageOne GmbH processes personal data on our behalf, this takes place on the basis of a data processing agreement pursuant to Article 28 GDPR. Where ArbitrageOne GmbH processes data for its own purposes, it is itself the controller for that processing.

15 Keepa API and Market Data

FlipHunter obtains product, price, offer and sales rank data via the Keepa API. The provider is Keepa GmbH, Berndorfer Str. 10, 95478 Kemnath, Germany (Weiden i.d.OPf. Local Court, HRB 5942).

For this purpose, product identifiers (ASINs), marketplace parameters and technically necessary API requests in particular are transmitted.

Personal data of FlipHunter customers, in particular name, email address, Discord account, plan status or individual filter settings, is not transmitted to Keepa.

The market data retrieved is used to provide, evaluate and calculate the FlipHunter deals. Where processing is necessary to provide FlipHunter, it is based on Article 6 (1) (b) GDPR.

16 Recipients and Processors

We engage service providers who may process personal data on our behalf or under their own responsibility. These include in particular:

  • Stripe (payment processing)
  • Mailjet / Sinch (contract-related email dispatch)
  • Vercel Inc. (hosting of the FlipHunter landing page)
  • Discord (granting of access, deal notifications, filter channels)
  • Providers of the third-party bots used on our Discord server
  • Keepa GmbH (product and market data)
  • ArbitrageOne GmbH (A1 infrastructure, user accounts and access management)
  • Tax advisers, auditors and legal advisers to the extent legally required
  • Hosting and infrastructure partners

We conclude data processing agreements pursuant to Article 28 GDPR with processors where legally required. Where providers act under their own responsibility, their privacy notices apply in addition.

17 Transfers to Third Countries

Some providers may process personal data in the USA or other third countries outside the European Union and the European Economic Area.

A transfer takes place only where the statutory requirements are met. This may be on the basis of an adequacy decision of the European Commission, a certification under the EU-US Data Privacy Framework, or the standard contractual clauses adopted by the European Commission pursuant to Article 46 (2) (c) GDPR.

This may concern in particular Discord, Stripe and Vercel.

Where standard contractual clauses apply, they are supplemented where necessary by additional technical and organisational measures. You may request a copy of the respective safeguards via the contact addresses listed in section 1.

18 Retention Periods

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

  • Contract, payment and invoice data: in line with statutory retention periods. Accounting vouchers are retained for 8 years (Section 147 (3) of the German Fiscal Code), books, annual financial statements and inventories for 10 years.
  • User accounts, access authorisations and plan data: for the duration of the contractual relationship and thereafter to the extent necessary for billing, evidentiary purposes or legal defence.
  • FlipHunter filters, saved views and fee settings: for the duration of the active user account.
  • Support and communication data: for as long as necessary for contract performance, evidentiary purposes or legitimate interests, at most until the limitation periods expire.
  • Records of consent: for as long as necessary to demonstrate that consent was properly obtained, as a rule until the limitation periods following withdrawal expire.
  • Server log files: deletion or anonymisation as soon as they are no longer required for operation, security and error analysis; where necessary, longer for specific security incidents, see section 8.
  • Technically necessary cookies: for the duration of the session or until the sign-in token expires, see section 9.

Data held in service providers' systems may additionally be subject to their statutory or technically required deletion periods.

19 Data Subject Rights

Data subjects have in particular the following rights in accordance with statutory provisions:

  • Right of access pursuant to Article 15 GDPR.
  • Right to rectification pursuant to Article 16 GDPR.
  • Right to erasure pursuant to Article 17 GDPR.
  • Right to restriction of processing pursuant to Article 18 GDPR.
  • Right to data portability pursuant to Article 20 GDPR.
  • Right to object pursuant to Article 21 GDPR, see sections 20 and 21.
  • Right to withdraw consent given with effect for the future, see section 22.
  • Right not to be subject to a decision based solely on automated processing, Article 22 GDPR. No such decision takes place with us, see section 5.

Please address your enquiries to support@fliphunter.de.

20 Objection to Processing Based on Legitimate Interests

Where we process personal data on the basis of Article 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to such processing.

We will then no longer process the data concerned unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

21 Objection to Direct Marketing

You have the right to object at any time to the processing of your personal data for direct marketing purposes pursuant to Article 21 (2) GDPR. This also applies to profiling to the extent it is related to such direct marketing.

No reason is required for this objection, and no balancing of interests takes place. Following your objection we will no longer process your data for direct marketing purposes.

You may submit your objection informally to the addresses listed in section 1 or use the unsubscribe link in any marketing email.

22 Withdrawal of Consent

You may withdraw consent given at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before withdrawal.

No cookies or tracking services requiring consent are currently used on the publicly accessible landing page. Consent for marketing emails can be withdrawn via the unsubscribe link in the respective email or by message to the contact addresses listed in section 1.

23 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de

24 Changes to This Privacy Policy

We adapt this privacy policy when the services we use, the purposes of processing or the legal situation change. The current version is available on this page and carries a version number and a date.