About this policy
This policy explains what personal data MANTA Motion collects when you use mantamotion.co, buy from us on eBay or contact us, why we collect it, who gets it, how long we keep it and your rights.
We are based in the UK, so UK data protection law applies, including the UK GDPR, the Data Protection Act 2018 and the rules on cookies and browser storage (PECR).
We currently deliver to UK addresses only. This policy applies to everyone who uses our website, wherever they are.
Who we are
MANTA Motion is a small UK online shop selling Sur-Ron and Talaria electric-bike parts and custom bikes. It is run by one person, the owner. The business responsible for your personal data (the "controller") is:
- MANTA MOTION LTD, trading as MANTA Motion
- Address: Lawn Farm Barns, Shaftesbury Road, Gillingham, Dorset, SP8 5QP, United Kingdom
- Company number: 17341114 (registered in England and Wales)
- Email: info@mantaparts.co.uk
The owner can give staff accounts to people who help run the shop. Staff can see customer accounts, orders, messages, return requests and notes, and can download customer and order lists.
We have not appointed a Data Protection Officer, as we do not need one.
The short version
- We collect what we need to sell to you, run your account and answer your messages.
- You enter card details on Stripe's page or in your wallet app. We never see your full card number.
- We do not sell your data. We do not use advertising cookies, Google Analytics or social media pixels.
- We do not set cookies ourselves, but Stripe's script can set cookies on our checkout and product pages. We use browser storage for the basket, sign-in, some features and visit counts.
- To see, correct or delete your data, email info@mantaparts.co.uk.
What we collect and where it comes from
When you place an order
- Your name and email address.
- Your delivery address. Stripe always asks for your billing address on card payments. We use it only if no delivery address is available.
- Your phone number, if you pay with a wallet such as Apple Pay or Google Pay (on our checkout page or a product page) and the wallet provides it. We use it for delivery.
- What you ordered, any discount code and the total paid.
- From Stripe: whether the payment succeeded, the amount, Stripe's payment reference and, for wallet payments, the method used (for example Apple Pay).
- Your account ID, if you were signed in. If you were not, we may record a random anonymous sign-in ID instead.
- Delivery progress and the tracking number, any refund (amount and reason), and private notes our staff add to your order.
You give us most of this at checkout. If you pay by card, you enter your card details, name, email and addresses on Stripe's page, and Stripe passes what we need back to us. If you pay with a wallet (Apple Pay, Google Pay, Link, PayPal or Amazon Pay), the wallet passes your name, email, phone and address to Stripe and, for most wallets, to our page too. We use Stripe's copy where we can.
When you use the custom bike builder
We collect the frame colour and parts you choose, the price, an automatic summary of your build, and the rider body weight you enter. The builder will not continue without a rider weight. We use it only to set up your bike.
If you order a custom bike, your build, including the weight, is saved with your order, where our staff can see it. It is also kept in our backups and can appear in our server logs. If you save a build while signed in, it is saved to your account. The build share link contains your parts and rider weight, so anyone you send it to can see them.
When you create or use an account
- If you sign up with email: your name, email address and postal address. Your password is handled by Google Firebase Authentication. We never see your actual password.
- If you choose "Continue with Google": your name and email address from your Google account. Google Firebase Authentication, which runs our sign-in, also keeps your Google account ID and a link to your Google profile picture. We do not use the picture.
- When you last signed in, changes to your name or delivery address, and your saved builds.
- A list of your orders. When you open your account page, we also link earlier guest orders placed with the same email address, once you have confirmed that address.
If you are not signed in, our pages may give your browser a random anonymous ID through Google Firebase so they can talk to our server. It does not include your name or email.
When you contact us
The contact form collects your name, email address, subject and message. If you email us, we receive whatever you include.
When you sign up for new-stock news
The "Email for new stock" box at the bottom of our pages sends your email address to our inbox. We do not use a mailing tool. If you give us your email for new-stock news, we keep it in our inbox to tell you when stock arrives, and you can ask us to remove it at any time by emailing us or replying to one of our emails.
When you ask for a return or refund
We collect your name, email address, order number, the product, the reason, any notes, and any photos or videos you upload. The files are kept in our Google Firebase file storage, and only our staff can open them. Files sent from 12 October 2026 are stored under a random name (we do not keep your own file names); files sent before then keep their original names until the return is deleted. Please upload only what is needed to show the problem, and avoid showing faces, number plates or your home.
When you search or browse
- We count page views and visits per day. We do not store your IP address, account ID or which pages you viewed.
- We keep a list of the words typed into our search boxes, with a count and the date each was last searched. They are not linked to you. Please do not type personal details into search.
If you apply for a job
Applications are sent by email to info@mantaparts.co.uk. We receive your CV, covering note and anything else you include.
Our eBay connection
We also sell on eBay. Our eBay connection keeps our website stock in line with eBay sales, lists the eBay orders still to post, and works out our sales figures. For this it stores eBay order numbers, item numbers, quantities, order dates and posting status, and, for our sales figures, the amounts of each order (price, postage, discounts, eBay's fees and refunds) without the order number, how often our eBay listings were viewed and watched, and our eBay seller level. eBay's order details include the buyer's details; our connection discards them before anything is saved. It never stores buyer names, usernames, user IDs, addresses, email addresses or phone numbers.
If you bought from us on eBay
We post most eBay orders with a Royal Mail label bought through Sendcloud, which is connected to our eBay account. Sendcloud receives the order details eBay shares with shipping services, including your name, delivery address, the items, any note you left at checkout and, if eBay provides them, your email address and phone number. Sendcloud puts your name and delivery address on the Royal Mail label and sends the tracking number back to eBay. Some orders are posted with a label bought on eBay instead. Sendcloud doesn't email eBay buyers, and neither do we: eBay shows you the tracking. If eBay provides your email address or phone number, Royal Mail receives them too, only to send you delivery messages. Before we buy a label, our system checks Sendcloud's copy of your order (for example, that the items match) without saving your details. Apart from the label file, we don't copy your details into our own records. The label file, which shows your name and address, is deleted from our Google file storage soon after Royal Mail scans the parcel, and at most 2 days after we buy the label; a file that prints several labels at once is deleted about an hour after it is made. Google may keep a deleted file for up to 7 more days.
Do you have to give us your data?
No law requires you to give us personal data, but we need some to make and carry out a contract with you:
- To place an order: your name, email address, delivery address and payment details. If you pay with a wallet on our checkout page, also a phone number. Without these, we cannot take or deliver your order.
- To order a custom bike: also the rider's body weight.
- To ask for a return: your name, email address and order number, so we can find your order.
Everything else is optional: an account, saved builds, the contact form, new-stock news and job applications.
Why we use your data and our lawful basis
The law says we must have a lawful basis for each use of your data. These are ours.
| What we do | Data used | Lawful basis |
|---|---|---|
| Take payment, deliver your order, and email you about its progress (packed, dispatched, out for delivery and delivered). The last three go automatically when the courier reports them. | Name, email, delivery address, phone (wallet payments), order and payment details, tracking number | Contract |
| Build your custom bike | Build choices, build summary, rider weight | Contract |
| Handle returns, faults, refunds and warranty claims | Return details, photos and videos, order and refund records | Contract and legal obligation (Consumer Rights Act 2015) |
| Keep sales and accounting records | Order, payment and refund records | Legal obligation: tax law requires us to keep business records for 6 years from the end of the financial year in which you ordered. |
| Run your account, save builds and show your orders (including guest orders with the same email) | Account details, saved builds, order list | Contract |
| Answer your messages | Name, email, subject, message | Legitimate interests: replying to people who contact us. Contract if it is about an order. |
| Tell you when new stock arrives, if you asked us to | Email address | Consent. You can withdraw it at any time. |
| Alert the owner by email and phone notification: new orders, return requests, a morning summary, low stock and stuck parcels | Orders: name (or email), items, amount, and delivery address (email only). Return requests: the order number, product and reason; your name, email and notes by email only. Morning summary, low-stock and stuck-parcel alerts: counts, product names, website and eBay order numbers, and tracking numbers only | Legitimate interests: dealing with orders, returns and parcels quickly |
| Keep private staff notes about customers and orders | Notes linked to your email address or order | Legitimate interests: consistent service |
| Prevent fraud | Payment and device information collected by Stripe | Legitimate interests: protecting you and us |
| Keep the site working and recover from failures (server logs, backups and copies we download) | Any of the data above | Legitimate interests: running a reliable shop |
| Count visits and search words | Visit counts, and search words (which could include personal details if you type them) | Legitimate interests: improving the shop |
| When our eBay connection is on: keep website stock in line with eBay sales, list the eBay orders still to post, and work out our sales figures | eBay order numbers, item numbers, quantities, order dates, posting status; order amounts, eBay fees and refunds (without the order number); listing view and watch counts; our seller level. No buyer details. | Legitimate interests: running the shop, including not selling items we no longer have |
| Post orders bought on eBay | Your name, delivery address and the items, held by Sendcloud; your email and phone number, if eBay provides them; your name and address on the postage label; the tracking number | Contract: sending what you bought. Passing your email or phone number to Royal Mail for its delivery messages: legitimate interests (letting you know when your parcel will arrive) |
| Consider job applications | Your CV and anything you send | Legitimate interests, and steps before a contract |
| Comply with the law, for example requests from HMRC or the police | Whatever the request lawfully requires | Legal obligation |
Where we rely on legitimate interests, you can object at any time (see "Your rights").
Who we share your data with
We use these providers to run the shop. Some, such as Stripe, also use some data for their own purposes under their own privacy policies.
| Who | What they receive | Why |
|---|---|---|
| Stripe | What you enter on Stripe's page or in your wallet (card details, name, email, addresses, and phone for wallets), and device information from Stripe's script (see "Cookies and browser storage"). From us: items and prices, our order reference, your account ID or an anonymous sign-in ID, and any discount code. Not your custom build or rider weight. | Payments, refunds and fraud prevention. See Stripe's privacy policy. |
| Wallet providers (Apple Pay, Google Pay, Link, PayPal, Amazon Pay) | Your payment and contact details, if you pay with them | Completing a wallet payment |
| Google (Firebase and Google Cloud) | All the data we store, including backups and server logs | Hosting our website, database, files, sign-in, backups, server code and logs. Firebase also sends account verification and password-reset emails for us, and Google handles "Continue with Google". See Google's privacy policy. |
| Google Workspace (our email, Gmail) | Order-progress emails (packed, dispatched, out for delivery, delivered): your name, email, order reference, items and tracking number. Our new-order alerts: your name, email, items, amount and delivery address. Our morning summary: counts, product names, website and eBay order numbers, and tracking numbers. Copies of contact messages, return requests and new-stock sign-ups. | Sending and storing our emails |
| Pushover | For each new order: your name (or email if we have no name), the amount, and the items and quantities. For each return request: the order number you gave, the product and the reason (not your name or email). For the morning summary and the low-stock and stuck-parcel alerts: counts, product names, website and eBay order numbers, and tracking numbers only (not your name, email address, phone number or delivery address) | Alerts to the owner's phone: new orders, return requests, a morning summary, low stock and stuck parcels |
| Couriers (currently Royal Mail; we may also use DPD or Evri) | Your name and delivery address (through Sendcloud). For website orders, not your email address or phone number. For eBay orders, your details reach Sendcloud from eBay, and Royal Mail may also receive your email address or phone number, if eBay provides them, to send you delivery messages. | Delivering your order |
| Sendcloud (our shipping-label service) | Your name and delivery address, the parcel's weight and our order reference. For website orders, not your email address or phone number. For eBay orders, Sendcloud receives from eBay the order details eBay shares with shipping services (including your name, delivery address, items, any checkout note, and your email and phone number if eBay provides them), and sends the tracking number back to eBay. Sendcloud doesn't email eBay buyers. | Buying and printing the postage label and passing your parcel's details to the courier. The tracking link in our dispatch and out-for-delivery emails opens Sendcloud's tracking page. For website orders, we check Sendcloud's tracking so we can email you when your parcel is dispatched, out for delivery and delivered. |
| eBay | Nothing about our website customers. When our eBay connection is on, we read our own eBay orders as described above. For eBay orders, Sendcloud sends eBay the tracking number. Our sales figures read the amounts of our own eBay orders. | Keeping stock in line with eBay sales, posting eBay orders and working out our sales figures |
We may also share data when the law requires it, for example with HMRC, the police or a court.
International transfers
- Google: our database is hosted in the United States, and our server code runs in Belgium and the United States. Google may also handle our data in other countries where it operates.
- Stripe may transfer data to its group companies in the United States.
- Pushover is based in the United States.
- Sendcloud is based in the Netherlands.
- Google Workspace, which handles our email, may store emails outside the UK, including in the United States.
Belgium and the Netherlands are in the European Economic Area, which has UK "adequacy" status. The US companies of Google and Stripe are certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), which covers transfers to them. You can ask us for more details.
How long we keep your data
Some deletions happen automatically. Others we carry out by hand.
| Data | How long we keep it |
|---|---|
| Checkout requests from your browser (basket and, while a payment is being set up, your custom build and, for wallet payments, your email, name, delivery address and phone) | Your details are removed as soon as the request has been handled (usually within a minute); the rest is deleted within about an hour |
| Our server's priced copy of your basket (including any custom build, your account ID if signed in and, for wallet payments, your name, email, phone and delivery address) | Deleted automatically after 14 to 15 days |
| Orders and what is linked to them: delivery and build details, refunds, staff notes, admin records (such as resent emails), and new-order alerts, morning summaries and parcel alerts in our mailbox and on the owner's phone | 6 years from the end of the financial year in which you ordered. Pushover keeps its own copy under its own rules. |
| Account details and saved builds | While your account is open. If you ask us to close it, we delete them within 30 days. |
| Anonymous sign-in IDs | Kept in Google Firebase until we delete them. They contain no name or email. |
| Contact messages, return requests (including photos and videos), staff notes about customers, related emails, and return alerts on the owner's phone | 2 years after our last contact with you. Google may keep a deleted photo or video for up to 7 more days. Pushover keeps its own copy under its own rules. |
| New-stock sign-ups | Until you ask us to remove your email |
| Job applications | 6 months after we make a decision |
| Server logs (these can include delivery addresses, emails, order details and custom builds, including rider weight) | 30 days (Google Cloud's standard setting) |
| Automatic database backups | We keep the 30 most recent, which covers about 30 days or fewer. Google may keep a deleted backup for up to 7 more days. Data we delete from our live database may stay in backups until they are replaced. If we stop using eBay's API, we remove eBay information from these backups within 10 days. |
| Backups and customer or order lists downloaded to our own devices | Deleted within 30 days. If we stop using eBay's API, copies that hold eBay information are deleted within 10 days. |
| Search words | 12 months after the word was last searched |
| Postage label files (your name and delivery address) | For website orders: kept with your order so we can print the label again, then deleted automatically 7 days after the parcel is posted (within a day if the label is cancelled), and never kept longer than 60 days. For eBay orders: deleted soon after Royal Mail scans the parcel, and at most 2 days after the label is bought; a file printing several labels at once is deleted about an hour after it is made. Google may keep a deleted file for up to 7 more days. Sendcloud keeps its own record of the shipment under its own rules. |
| eBay order numbers and quantities | Deleted automatically from the sync's records after 18 months. Our list of eBay orders to post drops each order 30 days after it is posted or cancelled, and any other order once it is 120 days old and hasn't changed for 30 days. Our stock history also notes the eBay order number for each stock change, and is kept with our order records (6 years). Our postage record for an eBay order (its tracking number and Sendcloud references) is deleted about 60 days after the label is bought, or once the order leaves our list of eBay orders to post if that is later. What each label cost is kept with our sales figures, under Sendcloud's shipment number. |
| eBay sales figures (order amounts, fees, refunds and label costs; no buyer details and no eBay order numbers) | Kept with our accounting records (6 years). Deleted within 10 days if we stop using eBay's API. |
| eBay listing views, watchers and seller level | Kept with our sales figures. |
| Payment records held by Stripe | Kept by Stripe under its own rules |
Cookies and browser storage
We do not set any cookies ourselves. We do store some information in your browser ("local storage", "session storage" and IndexedDB), which the law treats like cookies. Session storage is cleared when you close the tab. Local storage stays until it is removed or you clear your browser's data for our site.
Basket, checkout and sign-in
We treat these as strictly necessary, which means the law does not require your consent.
| Name | What it does | How long |
|---|---|---|
| mantaCart | Holds your basket | Until you check out or clear it |
| mantaBuyNowItem | Holds an item you are buying with Buy Now or from the bike builder | Removed after payment. If you leave checkout without paying, it stays until you clear site data. |
| pendingCustomBuild | Carries your custom build (parts, frame colour, price and rider weight) through checkout | As for mantaBuyNowItem |
| mantaCustomBuilderFlow, mantaCheckoutSource | Note where checkout started and which basket to empty after payment | End of browser session |
| completedOrder (session storage) | Holds your order number, items, total and email so the confirmation page can show a summary | Until you close the browser tab |
| firebaseLocalStorageDb (IndexedDB) | Keeps you signed in (account ID, email and sign-in tokens; with Google sign-in, also your Google account ID and profile picture link), or holds a random anonymous ID | Until you sign out or clear site data |
| Google sign-in cookies | Set by Google only if you choose "Continue with Google" | Set by Google |
Stripe
Stripe's script runs on our checkout page and on every product page, where the Apple Pay and Google Pay buttons are. When you visit those pages, Stripe may set its own cookies (for example __stripe_mid and __stripe_sid) and collect device information, even if you do not buy. Stripe uses these to process payments and prevent fraud.
Features you use
These are needed to provide features you choose to use, so we do not ask for consent for them.
| Name | What it does | How long |
|---|---|---|
| mantaSavedBuilds, savedCustomBuild | Your last 10 saved builds (including rider weight), and a build you saved while signed out or opened from your account | Until you clear site data |
| selectedBike, selectedCategory, selectedProduct, selectedProductId | Remember the bike model and category you picked, and pass the product you clicked to its page | Until you clear site data |
| mantaRecentSearches | Your last 6 searches, shown back to you on this device | Until you tap "Clear recent searches" or clear site data |
| mantaShopReturn | Powers the "Back to results" link | End of browser session |
Other storage
These are set automatically. There is no switch on our site to turn them off.
| Name | What it does | How long |
|---|---|---|
| mantaRecentlyViewed | Remembers products you viewed on this device, to show them again | Until you clear site data |
| mantaparts_products_cache, mantaparts_categories_cache, mantaparts_cache_timestamp | A copy of our public product list, so pages load faster. No personal data. | Until replaced or you clear site data |
| mantaSes, mantaSearchLogged | Make sure your visit, and each search word (up to 30), is counted only once per visit. The counts do not identify you. | End of browser session |
You can clear or block site data in your browser settings. If you block all storage for our site, the basket, checkout and sign-in will not work.
How we keep your data safe
- Card payments are handled by Stripe. Your card number never reaches our website.
- Your password is handled by Google Firebase Authentication. We never see your actual password.
- Our back office needs a staff sign-in. Only admins can issue refunds, manage staff and download backups.
- Changes made in our back office are recorded in an activity log, kept for about 90 days.
- We back up our database every night.
- Return photos and videos can only be opened by our staff.
- Access by email address (to your orders, or to our back office) only works once that address has been confirmed.
No system is completely secure. We will report a breach to the ICO within 72 hours where the law requires, and tell you without delay if it is likely to put your rights at high risk.
Automated decisions
We do not make decisions about you using only automated means. Stripe's automated fraud checks can decline a payment. If your payment is declined and you think this is wrong, contact us and a person will look at it. Stripe is responsible for its own fraud checks.
Your rights
- Access: ask for a copy of your personal data.
- Rectification: ask us to correct wrong or incomplete data. You can update your name and delivery address on your account page, but this does not update every copy our staff see, so please also email us.
- Erasure: ask us to delete your data. We may need to keep some records, such as orders, for tax rules.
- Restriction: ask us to limit how we use your data, for example while we check it is correct.
- Objection: object where we rely on legitimate interests. You can object to marketing emails at any time, and we will stop.
- Portability: ask for data you gave us in a machine-readable format, or sent to another organisation.
- Withdraw consent: for new-stock news, at any time. This does not affect what we did before.
How to use your rights
Email info@mantaparts.co.uk or write to Lawn Farm Barns, Shaftesbury Road, Gillingham, Dorset, SP8 5QP, United Kingdom. It is free. We will reply within one month, or tell you if a complex request needs up to two more months. We may ask you to prove who you are.
To close your account, email us, as there is no delete button on the site. We will delete your account details and saved builds within 30 days, and keep order records only as long as the law requires. Copies in our automatic backups are replaced within about 30 days, and Google may keep a replaced copy for up to 7 more days. To stop new-stock news, email us and we will remove your email.
Complaints
If you are unhappy with how we use your data, please contact us first at info@mantaparts.co.uk. We will acknowledge your complaint within 30 days and tell you the outcome.
You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk, helpline 0303 123 1113.
Children
Our shop is meant for adults. We do not knowingly collect children's data. If you think a child has given us their details, contact us and we will delete them unless the law requires us to keep them.
Changes to this policy
We may update this policy when our shop or the law changes, and will change the "Last updated" date. If the changes are significant, we will show a notice on the site and, where we can, tell you directly.
Contact us
Email info@mantaparts.co.uk or write to MANTA MOTION LTD, Lawn Farm Barns, Shaftesbury Road, Gillingham, Dorset, SP8 5QP, United Kingdom.