Privacy Policy

Last Updated: 29th October, 2026

Introduction

This policy explains what BulkPoint collects when you use bulkpoint.com or the BulkPoint iOS app, why we collect it, who we share it with, and what you can ask us to do about it. It covers both the website and the app; where the two differ, the difference is called out.

You can browse the whole catalogue, and check out as a guest, without creating an account.

Information You Give Us

Information you provide and when
Information	When we collect it
Name, email address, password	When you create an account. Passwords are stored only as a bcrypt hash; we never hold the password itself.
Phone number, business name	When you add them to your profile, or when an order or enquiry needs them.
Shipping and billing address	When you save an address or place an order.
Order contents and totals	When you check out.
Messages you send us	Through the contact form, a pallet pricing request, or the support chat.
Email address alone	When you subscribe to our list or enter the giveaway.

Information Collected Automatically

Visit records: the pages you view, the page you arrived on, the website that referred you, any campaign tags in the link you followed, and whether the device is mobile or desktop. These are tied to a visitor identifier stored in a cookie, and to your account if you are signed in.
Your IP address and browser user-agent string, captured when you place an order and stored on that order record for advertising measurement. See Advertising and Measurement below.
Standard server logs kept by our hosting provider.

We do not collect your precise location, and we do not use your device’s camera, microphone, contacts or photo library.

Payment Information

Payments are processed by Stripe. Your card details go directly to Stripe from your browser or device and are never sent to, seen by, or stored on BulkPoint’s servers. What we keep against your order is Stripe’s payment identifier and whether the payment succeeded. Stripe handles your card data as a controller under its own privacy policy.

Cookies and Local Storage

Cookies and browser storage used by BulkPoint
Name	Purpose and lifetime
bp_session	Keeps you signed in. Set only after you sign in, and expires after 30 days.
bp_vid	A random visitor identifier used to count returning visits. Expires after 1 year.
bp_sid	A random identifier for the current visit. Expires after 30 minutes of inactivity.
bulkpoint-cart, bulkpoint-wishlist	Stored in your browser, not sent to us as cookies. They keep your cart and wishlist across visits on that device.
bp-giveaway-popup	Stored in your browser so the giveaway popup stops reappearing once you enter or dismiss it.
_fbp, _fbc and Hotjar cookies	Set on the website only by the third-party tags described under Advertising and Measurement. They are not set in the iOS app.

The first three are strictly functional or first-party analytics cookies. You can clear or block cookies in your browser settings; blocking bp_session will sign you out and keep you from signing back in.

How We Use Information

To take, fulfil, ship and support your orders, and to contact you about them.
To operate your account, including signing you in, verifying your email address and resetting your password.
To answer your questions through the contact form and the support chat.
To understand how the store is used, which pages and products people look at, and where our visitors come from.
To send you marketing email, if you asked for it or entered the giveaway.
To measure advertising, as described below.
To meet our legal, tax and accounting obligations, and to detect and prevent fraud and abuse.

Who We Share It With

We do not sell your personal information for money. We share it with the service providers that run parts of the store for us, and each one only receives what it needs:

Service providers and what each receives
Provider	What it receives
Stripe	Payment details and the order amount, to take payment.
Airtable	Order records, including your name, email address, phone number, shipping address and the items ordered. This is where our operations team works the orders.
MongoDB Atlas	Your account, saved addresses, cart, wishlist and visit records.
Vercel	Hosting for the site, and storage for product images.
Resend	Your email address and the message, to send transactional email such as order, verification and password-reset messages.
Klaviyo	Your email address, to send marketing email you have asked for.
Intercom	If you are signed in: your account identifier, name and email address, so the support chat knows who it is talking to.
Hotjar and Meta	Website only. See Advertising and Measurement.

We may also disclose information where the law requires it, to enforce our terms, or as part of a merger or sale of the business, in which case we will say so before your information becomes subject to a different policy.

Advertising and Measurement

On the website, we load Google Tag Manager, which carries the Meta (Facebook) pixel, and Hotjar, which records how pages are used so we can improve them. These are third-party tags: they set their own cookies and receive information about your visit directly.

When you place an order we also store, on that order record, your IP address, your browser user-agent string, any Meta advertising cookies present in your browser, and a one-way SHA-256 hash of your email address. These are kept so that a purchase can be matched to the advertising that led to it. The hash cannot be reversed back into your email address, and your plain email address is not included in that record.

You can stop the third-party tags by blocking third-party cookies or using a tracking-blocker in your browser, and you can ask us to delete the advertising information stored against your orders by emailing support@bulkpoint.com.

The BulkPoint iOS App

The iOS app does not load Google Tag Manager, the Meta pixel, or Hotjar. No third-party analytics or advertising tag runs inside the app, and none of the cookies those tags set are created there. This is why the app asks for no tracking permission: it does not track you across other companies’ apps and websites.

Everything else in this policy applies to the app as it does to the website, including the order information described above.

Marketing Email

If you subscribe, enter the giveaway, or opt in at checkout, we add your address to our marketing list, which is run through Klaviyo. Every marketing message has an unsubscribe link, and unsubscribing takes effect for all marketing email. We will still send you transactional messages about orders you have placed and about your account, because those are not marketing.

How Long We Keep It

Account information: for as long as your account exists, and until you ask us to delete it.
Order records: for as long as we need them for accounting, tax and warranty purposes, which is normally several years, even after an account is closed.
Visit records: retained as part of our analytics history.
Email-verification and password-reset tokens: deleted automatically as soon as they expire.
Marketing subscriptions: until you unsubscribe, after which we keep a record of the unsubscribe so we do not email you again.

Your Choices and Rights

You can see and change your name, phone number, business name and saved addresses from your account at any time. For anything else, email support@bulkpoint.com and we will action it:

Ask for a copy of the personal information we hold about you.
Ask us to correct information that is wrong.
Ask us to delete your account and the personal information attached to it. There is no self-service delete button yet, so this is handled by email. We may keep order records where the law requires it.
Ask us to stop sending marketing email, or use the unsubscribe link in any message.

We will not treat you differently for exercising any of these rights.

California Residents

If you live in California, you have the rights described above, plus the right to know the categories of personal information we collect, the purposes we collect them for, and the categories of third parties we disclose them to. Those are all set out in this policy.

We do not sell personal information for money. However, using the Meta pixel on our website may count as “sharing” personal information for cross-context behavioural advertising under California law. To opt out, block third-party cookies in your browser or email support@bulkpoint.com with the subject line “Do Not Sell or Share My Personal Information”. The iOS app does not share information this way, because it loads no advertising tags.

Children's Privacy

BulkPoint is a wholesale store intended for adults, and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email support@bulkpoint.com and we will delete it.

Security

The site and the app are served over HTTPS. Passwords are stored only as bcrypt hashes, session cookies are HTTP-only, and card details never reach our servers. No system is perfectly secure, so we cannot guarantee absolute security, but if a breach affects your personal information we will notify you as the law requires.

Changes to This Policy

If we change this policy we will update the date at the top of this page. If a change materially affects how we use information we have already collected from you, we will tell you directly.