Privacy Policy

This policy explains what personal data Skurail handles, why, who else is involved, how long it is kept and what rights people have. It covers Skurail Cloud (our hosted service), the Skurail for WooCommerce plugin, and these web pages. Skurail is provided by Bek Service Ltd, a company registered in England and Wales. Contact: [email protected].

1. Who is responsible for what

Under UK data-protection law (the UK GDPR and the Data Protection Act 2018) our role depends on whose data it is:

• Your account and billing data — your name, email address, company details and billing records. Bek Service Ltd is the controller: we decide how it is used, to run your account and bill you.
• Your store data and your buyers’ personal data — the products, stock and orders Skurail moves between your store and the marketplaces, including the names and delivery addresses of people who buy from you on eBay or Amazon. You, the merchant, are the controller of that data, and Bek Service Ltd is your processor: we use it only to provide Skurail to you, on your instructions.

The marketplaces add their own rules. eBay’s data-protection terms treat a service like ours as an independent controller of the eBay data it receives, and Amazon requires us to act as your processor; in both cases we use buyer data only to deliver and administer your marketplace orders, and never for marketing.

If you are a buyer who ordered from a shop that uses Skurail, the shop is responsible for your data. Please contact the shop first; you can also write to us and we will pass your request on and help.

2. What the plugin sends to Skurail Cloud

Nothing is sent until you click Connect in the plugin, and nothing but the pairing request until you approve the connection on Skurail’s consent screen. After that the plugin sends:

• When you connect: your site address, the address Skurail calls back to finish pairing, the plugin version, and a one-time pairing reference and secret. (The connection test sends a signed test message.)
• When a product or its stock changes: the IDs of the changed products and the kind of change.
• When a marketplace order changes in WooCommerce (completed, cancelled, refunded or given tracking): its status, carrier and tracking numbers, and any refund amounts.
• Once a day: a health report with your site address; the plugin, WordPress, WooCommerce and PHP versions; whether HPOS, WP-Cron and an object cache are in use; product and order counts; the sync queue length; and the last connection error.
• When you deactivate, disconnect or delete the plugin: that the connection is paused or gone.

If you switch on product import, the plugin also downloads the pictures of the marketplace listings you confirm, directly from eBay’s and Amazon’s image servers. Those are plain image requests: nothing about your store or your customers is sent with them.

3. What Skurail Cloud reads and receives

• From your store, over a connection signed with your store’s own key: product data (SKU, title, description, prices, stock, attributes, categories, weight and dimensions, image addresses) to build your listings, and the daily health report. Skurail creates your marketplace orders in WooCommerce — with the buyer’s name and delivery address — and adjusts stock after marketplace sales.
• From eBay and Amazon, through the access you grant with the marketplace’s own sign-in: your listings and their status, and your marketplace orders, including the buyer’s name, delivery address, the items, prices and amounts paid. Skurail never sees your marketplace passwords. Marketplace orders are created in WooCommerce as guest orders: Skurail does not create customer accounts and does not copy buyers’ email addresses or phone numbers into your store.
• From you: your account details, your settings, and anything you send us when you ask for help.
• From Stripe: whether a payment succeeded, and the billing name, address, VAT number and card brand, last four digits and expiry you gave Stripe. Stripe holds the card itself; we never see the full number.
• Technical logs: IP addresses and request records from our servers and from Cloudflare, used to keep the service secure and to find faults.

Everything travels over HTTPS. These web pages use no analytics or advertising cookies.

4. Why we use it, and our lawful basis

• To provide Skurail — sync listings, stock, prices and orders: to perform our contract with you; for buyer data, on your instructions as your processor.
• To bill you and keep accounting records: contract and legal obligation.
• To keep the service secure, reliable and supportable, including the health report and logs: our legitimate interest in running a safe service.
• To tell you about your account — failed payments, changes to prices or terms, service problems: contract and legitimate interest. We will only send you marketing if you agree, and you can stop it at any time.

We do not sell personal data, use buyer data for marketing, or use your data to train AI models.

5. Who else handles the data

Where data is processed outside the UK, it is protected by UK adequacy regulations or by the UK’s approved contract clauses (the International Data Transfer Agreement or Addendum). If we add or change a provider that processes your store or buyer data, we will update this list and tell paying customers by email at least 30 days before, so you can object.

6. How long we keep it

• Buyers’ names and addresses: only as long as needed to deliver the order to your store and keep it in step, and removed from Skurail Cloud no later than 30 days after the order is delivered. Order numbers and amounts are kept, without the buyer’s details, so that billing and sync history stay correct. The plugin applies the same 30-day removal to marketplace orders in your store, and supports WordPress’s own personal-data export and erasure tools.
• Product and store data: while your store is connected, and deleted within 30 days after you disconnect or close your account.
• Account data: while your account is open, and deleted within 30 days after you close it.
• Billing records: six years after the end of the financial year they relate to, as UK tax law requires.
• Server and security logs: up to 90 days.

7. Security

Every request between your store and Skurail Cloud is signed with that store’s own key and sent over HTTPS. Marketplace access is held as tokens you can revoke at any time, never as passwords. Access to our systems is limited to the people who need it to run the service. If a breach affects your store or buyer data, we will tell you without undue delay so you can meet your own obligations.

8. As your processor, we also commit to

• process your store and buyer data only on your documented instructions — which are your Skurail settings and these terms;
• make sure everyone who handles it is bound by confidentiality;
• help you answer requests from your buyers to see, correct or delete their data;
• delete or return the data when you close your account, unless the law requires us to keep it;
• give you the information you reasonably need to show you are complying with data-protection law.

The full terms are in our Data Processing Agreement, which forms part of the Terms of Service. If you need a countersigned copy, email [email protected].

9. Your rights

You have the right to ask for a copy of your personal data, to have it corrected or deleted, to object to or restrict how it is used, and to receive it in a portable format. Email [email protected]; we will reply within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would be grateful for the chance to put it right first.

10. Changes to this policy

We will update this page when what we do changes, and change the date at the top. If a change matters to how your data is used, we will email account holders before it takes effect.

11. Contact

Bek Service Ltd, a company registered in England and Wales, company number 12590587. Registered office: 20-22 Wenlock Road, London N1 7GU, United Kingdom. Email [email protected].