Privacy Policy

"Personal Information"

Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your household. This includes, but is not limited to, your email address, IP address, device identifiers, and online activity data.

"Business Data"

Data that relates to your business operations on third-party sales channels, including product listings, pricing data, sales metrics, competitive offer data, fee calculations, and price change history. While Business Data may be processed through the Service, it is distinct from Personal Information and is primarily governed by our Terms of Service.

"Organization"

A business entity or group created within the Service under which users, channel accounts, listings, and billing are managed. Each Organization operates with complete data isolation from all other Organizations.

"Channel"

A third-party sales platform integrated with the Service, such as Amazon, Walmart, Shopify, or BigCommerce.

"Processing"

Any operation performed on Personal Information, whether automated or manual, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.

3.1 Account information

When you create an account, we collect your email address. We use passwordless authentication (magic links sent to your email), so we do not require or store passwords. Your email address serves as your primary identifier and login credential. We also automatically detect your timezone from your browser (for example, "America/New_York") and store it in your user profile so that dates and times throughout the Service are displayed in your local time. You can change your timezone at any time in your account settings.

3.2 Google sign-in data

If you choose to sign in using Google (via OAuth or Google One Tap), we receive your email address, display name, and profile photo URL from Google. Your display name and profile photo are stored in your user profile and displayed within the Service. You can modify or remove this information at any time through your account settings. We do not receive or store your Google password. Google sign-in is optional; you can always use email-based magic links instead.

3.3 Organization and team data

When you create or join an Organization, we store your organization name, reporting currency preference, team membership, role assignments (Owner, Admin, Manager, or Analyst), and team invitation records (invitee email, inviter identity, invitation status).

3.4 Seller account data

When you connect a sales channel (such as Amazon Seller Central), we access and store data through the channel's official API. This includes: your product catalog (titles, descriptions, brands, images, SKUs, fulfillment type); current and historical pricing data; competitive offer data and Buy Box status; marketplace fees (referral fees, fulfillment fees); daily sales metrics (orders, revenue, refunds, units sold); price change history and repricing results; and Buy Box ownership summaries. We only access data necessary to provide the repricing service.

3.5 Channel account credentials

When you connect a Channel Account, your authentication credentials (such as Amazon SP-API refresh tokens) are stored in an encrypted vault using AES-256 encryption. These credentials are decrypted only at the moment of API use and are never logged, cached in application memory, or accessible through the user interface. You can disconnect a Channel Account at any time, which permanently destroys the stored credentials.

3.6 Payment information

All payment processing is handled by Stripe, Inc. We do not receive, process, or store your credit card number, debit card number, bank account number, or any other financial account credentials. We store only Stripe reference identifiers (customer ID, subscription ID, payment method ID) and billing metadata such as your billing status, current subscription tier, and invoice history. You manage your payment methods directly through Stripe's secure hosted portal.

3.7 Usage and analytics data

We collect usage data to understand how the Service is used and to improve the user experience. This includes: pages viewed and features used, clicks and interactions within the application, browser type, operating system, and screen resolution, device type, referring URLs, and general geographic location (country/region level, derived from your IP address). We use product analytics tools to process this data. In production, we identify authenticated users by their user ID and email to associate usage events with accounts. We also record Organization-level metadata (Organization name, subscription tier, and billing status) for aggregate analytics purposes. Anonymous visitors are not tracked with individual profiles.

3.8 Performance and error data

We use error monitoring and performance tracking tools to identify and resolve software issues. When an error occurs, we may collect: error messages and stack traces, the page or action where the error occurred, browser and device information, your IP address, your user ID and email (to help our support team assist you), and session recordings with all text and form inputs masked for privacy. These recordings never capture readable text, passwords, or form data; however, images visible on the page at the time of the recording (such as product images) may appear in the replay. If you submit feedback through the in-app feedback widget, we collect the text you provide along with your name and email so we can respond. Performance data includes page load times, network timing, and Web Vitals metrics.

3.9 Security and login data

For security purposes, we record certain information when you sign in to the Service, including your IP address, browser user agent (device type and browser name), the date and time of the login, and your approximate timezone. This information is used to send you new-login security alerts by email and to detect potentially unauthorized access to your account.

3.10 Import and export data

When you import data (such as product costs or prices from CSV/XLSX files), we temporarily store the uploaded files and their contents for processing. When you export data, we generate and temporarily store the export files for download. Export files are accessible via signed download links that expire after 7 days, and the files themselves are automatically deleted shortly thereafter. Import files are removed after processing completes. If you configure scheduled imports from external URLs, the source URL is stored in your Organization's settings.

3.11 Real-time data connections

When you are actively using the Service, your browser maintains an authenticated WebSocket connection to our database provider to receive live updates (for example, when a price change is applied or a catalog sync completes). These connections are encrypted, authenticated with your session token, and scoped to your Organization's data. No additional personal data is collected through these connections beyond what is described elsewhere in this policy.

3.12 Communication records

We maintain logs of transactional emails sent to you through the Service, including the recipient address, email category, subject line, delivery status, and timestamp. We retain these records to troubleshoot delivery issues, fulfill your notification preferences, and comply with applicable communication regulations.

3.13 Information we do not collect

We do not collect: passwords (we use passwordless authentication), social security numbers or government-issued IDs, health or biometric data, date of birth or age, physical addresses or phone numbers, financial account numbers (handled entirely by Stripe), or any information from children under 16 years of age.

Providing the Service

Authenticate your identity, manage your account, synchronize your product catalog, calculate fees, execute repricing rules, submit price changes to connected Channels, and deliver the core functionality of the platform.

Billing and subscription management

Process subscription payments through Stripe, manage your billing status, calculate your GMV-based subscription tier, generate invoices, and handle payment failures and retries.

Communication

Send you transactional emails related to your account activity, including welcome messages, billing notifications, team invitations, channel alerts, export/import confirmations, security alerts (new login notifications), and subscription status changes.

Security and fraud prevention

Detect and prevent unauthorized access, monitor for bot activity using CAPTCHA verification, enforce rate limiting, send login alerts with IP and device information, and maintain audit logs for security investigations.

Product improvement

Analyze aggregated usage patterns to improve features, fix bugs, optimize performance, and develop new functionality. We use product analytics and error monitoring tools for this purpose.

Legal compliance

Comply with applicable laws, regulations, legal processes, and government requests. Enforce our Terms of Service. Protect the rights, privacy, safety, and property of Repricing, Inc., our users, and the public.

Performance of a contract (GDPR Art. 6(1)(b))

We process account information, seller account data, channel credentials, payment references, and communication records as necessary to provide the Service under our Terms of Service. Without this processing, we cannot deliver the Service to you.

Legitimate interest (GDPR Art. 6(1)(f))

We process usage and analytics data, performance and error data, and security and login data based on our legitimate interest in improving the Service, ensuring its security, detecting fraud, and resolving technical issues. We have performed a balancing test and determined that these interests do not override your fundamental rights and freedoms, particularly because: we minimize data collection to what is functionally necessary, we mask all text and form inputs in session recordings, we limit analytics tracking to authenticated users in production, and you can contact us to object to processing based on legitimate interest.

Legal obligation (GDPR Art. 6(1)(c))

We process certain billing records, audit logs, and communication records as necessary to comply with applicable tax, accounting, and regulatory requirements.

Consent (GDPR Art. 6(1)(a))

Where we use non-essential cookies or analytics tracking that requires consent under applicable law, we will obtain your consent through a cookie consent mechanism before activating such technologies. You can withdraw consent at any time through the cookie settings or by contacting us.

Infrastructure and service providers

We use the following categories of service providers (sub-processors) to operate the Service. Each provider processes data only as necessary to perform its specific function and is contractually bound to protect your data:

Sales channel APIs

When you connect a Channel Account, we exchange data with that Channel's API on your behalf. This includes reading your product catalog, pricing, and sales data, and submitting price updates. We only send data that is required to perform the actions you have authorized by connecting the Channel.

Legal and compliance disclosures

We may disclose your information if we believe in good faith that disclosure is necessary to: comply with a legal obligation, law, regulation, subpoena, or court order; protect and defend the rights, property, or safety of Repricing, Inc., our users, or the public; detect, prevent, or address fraud, security issues, or technical problems; or enforce our Terms of Service.

Business transfers

If Repricing, Inc. is involved in a merger, acquisition, reorganization, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will notify you by email and through the Service before your Personal Information is transferred and becomes subject to a different privacy policy.

With your consent

We may share your information in ways not described in this Privacy Policy if we have obtained your explicit consent to do so.

Aggregated and de-identified data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. For example, we may publish aggregated statistics about platform usage trends. This data is not considered Personal Information.

Transfer safeguards for EEA/UK/Swiss users

When we transfer Personal Information from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the primary transfer mechanism. Our sub-processors (listed in Section 6) each maintain their own Data Processing Agreements with Standard Contractual Clauses or similar approved transfer mechanisms, including participation in the EU-US Data Privacy Framework where applicable.

Your transfer rights

By using the Service, you acknowledge and consent to the transfer of your information to the United States. If you are located in a jurisdiction where such consent is required for cross-border data transfers, your continued use of the Service constitutes that consent. Nothing in this section limits your rights under applicable local data protection laws where such rights cannot be waived by agreement.

Core account and business data

Your account information, organization data, product listings, repricing rules, price change history, and daily sales data are retained for as long as your account is active. When you delete your Organization, this data is permanently deleted immediately through cascading database deletion.

Operational data with automated cleanup

Certain operational data is automatically deleted on a rolling basis: competitive offer snapshots are retained for 7 days; price change processing records are retained for 90 days; Buy Box ownership summaries are retained for 90 days; internal system logs are retained for 7 days; webhook processing records are retained for 30 days; data export files expire approximately 7 days after generation and are automatically removed; rate limiting records (which may temporarily store your user ID or IP address) are deleted within 24 hours; and import error details are retained for 7 days.

Communication records

Email delivery logs (recipient, category, subject, delivery status) are retained for the duration of your account. These records allow us to troubleshoot email delivery issues and honor your notification preferences.

Billing and financial records

Billing history, invoice records, and payment transaction data are retained as required by applicable tax and accounting laws, even after account deletion. This will typically be the longer of 7 years or the period required by your local jurisdiction.

Security and audit data

Admin audit logs (recording administrative actions along with the acting user's email, IP address, and user agent) are retained for as long as the Organization exists. After Organization deletion, audit log entries recording the deletion event itself are retained as required by law.

Analytics data

Usage and analytics data processed by our third-party analytics providers is retained according to each provider's own data retention policies. We configure our analytics tools to retain data for the minimum period necessary for product improvement purposes.

Data deletion on account termination

When an Organization Owner deletes their Organization, the following occurs immediately: the Stripe subscription is canceled with proration; all files in storage (imports, exports) are permanently removed; all Organization data (listings, repricing rules, price history, team members, connected accounts, billing periods, incidents) is permanently deleted through cascading database deletion; and Channel Account credentials stored in the encrypted vault are permanently destroyed. An email notification is sent to all former Organization members confirming the deletion.

User account data

If you wish to have your user account (email and profile) completely removed from our authentication system after deleting all your Organizations, please contact us at privacy@repricing.app. We will process your request within the timeframes required by applicable law (see Sections 10 and 11).

Categories of personal information collected

In the preceding 12 months, we have collected the following categories of personal information: identifiers (email address, user ID, IP address); internet or electronic network activity (browsing history within the Service, interactions with features, device and browser information); commercial information (subscription tier, billing status, transaction history); professional or employment-related information (business name via Organization name); and inferences drawn from the above to improve the Service.

How we collect personal information

We collect personal information directly from you (account creation, profile settings, import uploads), automatically through your use of the Service (usage data, cookies, analytics), from third-party sign-in providers (Google, when you choose Google login), and from connected Channel APIs (seller account data, on your authorization).

Your CCPA rights

As a California resident, you have the right to: know what personal information we have collected about you and how it has been used and shared; request deletion of your personal information, subject to certain legal exceptions; correct inaccurate personal information we hold about you; opt out of the sale or sharing of your personal information (see Section 13); and not be discriminated against for exercising any of these rights.

Sale and sharing of personal information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.

Sensitive personal information

We do not collect or process sensitive personal information as defined under the CCPA/CPRA (such as social security numbers, financial account numbers with credentials, precise geolocation, racial or ethnic origin, religious beliefs, biometric data, health data, or sex life information).

Authorized agents

You may designate an authorized agent to submit a privacy request on your behalf. We may require the agent to provide proof of authorization and may require you to directly verify your identity with us.

How to submit a request

To exercise your CCPA rights, email us at privacy@repricing.app. We will verify your identity by confirming your email address. We will respond to verified requests within 45 days. If we need additional time (up to 45 more days), we will notify you in writing with the reason for the extension.

Metrics

As required by the CCPA, we will make available annual metrics regarding the number of requests we receive and our response times, upon request.

Our role under GDPR

For the purposes of GDPR, Repricing, Inc. acts as a data controller for your account information, usage data, and billing data. When we process your seller account data (product listings, pricing, sales metrics) on your behalf, we act as a data processor. The legal bases for our processing activities are detailed in Section 5.

Data Protection Officer

For questions about our data protection practices or to exercise your GDPR rights, contact our privacy team at privacy@repricing.app. We will respond to your request within 30 days, as required by GDPR Article 12(3).

Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority in the EU/EEA member state where you reside, work, or where the alleged infringement occurred.

Brazil (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including the right to access, correct, delete, port, and anonymize your personal data. To exercise these rights, contact us at privacy@repricing.app.

Canada (PIPEDA)

If you are located in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including the right to access and challenge the accuracy of your personal information held by us. We will obtain meaningful consent for the collection, use, and disclosure of your personal information.

Australia (Privacy Act 1988)

If you are located in Australia, you have rights under the Privacy Act 1988 and the Australian Privacy Principles (APPs), including the right to access and correct your personal information. If you believe we have breached the APPs, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Japan (APPI)

If you are located in Japan, you have rights under the Act on Protection of Personal Information (APPI), including the right to request disclosure, correction, or cessation of use of your personal information.

Other U.S. state privacy laws

Several U.S. states have enacted comprehensive privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and others. If you are a resident of one of these states, you may have rights similar to those described in Section 10, including the right to access, correct, delete, and opt out of certain uses of your data. To exercise these rights, contact us at privacy@repricing.app.

Essential cookies (strictly necessary)

These cookies are required for the Service to function and cannot be disabled. They include: authentication session cookies that maintain your signed-in state (set by our authentication provider, stored as HTTP-only secure cookies); PKCE code verifier cookies used during the secure login flow (temporary, removed after authentication completes); active Organization cookies that remember which Organization you are currently working in (set as an HTTP-only secure cookie for up to one year); and CAPTCHA challenge cookies set temporarily during bot protection verification on the login page.

Analytics and performance (functional)

We use product analytics tools to understand how the Service is used. These tools use browser local storage (not cookies) to maintain session and device identifiers. Analytics tracking is active only in the production environment and only for authenticated users. Anonymous visitors are not tracked with individual profiles. Analytics traffic is routed through our own domain to ensure accurate performance measurement.

Theme preferences

Your light/dark mode preference is stored in your browser's local storage (not a cookie) and is used to render the correct visual theme when you load the Service. This data never leaves your browser.

Data Grid preferences

Basic table layout preferences (column visibility, column widths, density settings) are stored in your browser's local storage and never leave your device. If you choose to create named "Saved Views" (custom filter and column configurations), those views are stored in our database, associated with your account and Organization, and can optionally be shared with your team members.

Marketing and conversion measurement (opt-in)

With your explicit consent (via our cookie banner), we load Google Ads conversion tracking (gtag.js) to measure whether our advertising campaigns lead to sign-ups. This sends a single conversion event to Google when you create an account. Google may set cookies prefixed with _gc and _gac to attribute the conversion to an ad click. No personal details, product data, or seller account information is included in the conversion event. You can withdraw consent at any time through the cookie preferences accessible from the footer of our website, which will immediately stop loading the Google tag and clear any associated cookies.

What we do not use

We do not use cross-domain tracking cookies, social media tracking pixels, or fingerprinting techniques. We do not participate in behavioral advertising networks or allow third parties to place cookies for ad targeting on our site. We do not load fonts or resources from third-party CDNs that could be used for tracking (our fonts are self-hosted, and product images are proxied through our own domain).

Cookie consent

Where required by applicable law (such as the EU ePrivacy Directive), we will present a cookie consent mechanism that allows you to accept or decline non-essential cookies before they are activated. Essential cookies that are strictly necessary for the Service to function do not require consent and cannot be disabled.

Managing cookies

You can manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or alert you when a cookie is being set. Please note that disabling essential cookies may prevent the Service from functioning correctly, as authentication depends on them.

Notification preferences

You can manage your email notification preferences from your account settings. Each notification category can be individually enabled or disabled. Some notifications are mandatory and cannot be disabled because they relate to critical account events:

Unsubscribe

Every email includes an unsubscribe link and a List-Unsubscribe header for one-click unsubscription. Unsubscribe links are cryptographically signed to prevent unauthorized changes to your preferences. Unsubscribing from a notification category does not affect mandatory notifications or your ability to use the Service.

No marketing emails

We do not currently send marketing, promotional, or advertising emails. All emails from the Service are transactional and directly related to your account activity, billing, security, or team management. If we introduce marketing communications in the future, we will obtain your opt-in consent first.

Encryption

All data in transit is encrypted using TLS 1.3 with HSTS (HTTP Strict Transport Security) enforced with a max-age of two years, including subdomains and HSTS preloading. All data at rest is encrypted using AES-256 encryption managed by our database provider. Channel Account credentials (such as API tokens) are stored in a dedicated encrypted vault with AES-256-GCM encryption and are decrypted only at the moment of use.

Authentication and access control

We use passwordless authentication (magic links) to eliminate password-related attack vectors such as credential stuffing, brute force attacks, and password reuse. CAPTCHA protection prevents automated login attempts. Role-based access control (Owner, Admin, Manager, Analyst) ensures that team members can only access the features and data appropriate to their role within an Organization.

Data isolation

All database tables enforce row-level security (RLS) policies that ensure complete data isolation between Organizations. A user in one Organization cannot access, view, or modify any data belonging to another Organization. This isolation is enforced at the database level and applies to every query.

Security headers

Our web application enforces strict security headers including: Content Security Policy (CSP) with nonce-based script sources to prevent cross-site scripting (XSS); X-Frame-Options to prevent clickjacking; X-Content-Type-Options to prevent MIME sniffing; a strict Referrer-Policy; and a Permissions-Policy that disables access to device features (camera, microphone, geolocation, payment API, and others) that the Service does not use.

Rate limiting

We implement rate limiting at multiple levels: API-level rate limiting for external service calls (Channel APIs), server action rate limiting to prevent abuse of application endpoints, and CAPTCHA verification to prevent automated attacks on the authentication flow.

Monitoring and incident response

We use error monitoring and performance tracking tools to detect and respond to security incidents in real time. All text and form inputs are automatically masked in any session recordings to protect user privacy. We maintain audit logs for administrative actions to support security investigations.

Limitations

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the security of your email account, which serves as your authentication credential, and for promptly revoking access for team members who should no longer have it.

Investigation and containment

We will promptly investigate the breach, take steps to contain it, and assess the nature and scope of the affected data.

User notification

We will notify affected users by email with details about the breach, including: what information was involved, what we are doing to address it, what steps you can take to protect yourself, and how to contact us for further information.

Regulatory notification

We will notify applicable regulatory authorities as required by law. For Florida residents, notification will be provided no later than 30 days after determination of the breach, in compliance with Florida Statute 501.171. For EU/EEA residents, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33 and will notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms. For California residents, we will comply with California Civil Code 1798.82 notification requirements.

Other jurisdictions

Where other jurisdictions impose breach notification requirements (including but not limited to Canada's PIPEDA, Australia's Notifiable Data Breaches scheme, Brazil's LGPD, and various U.S. state laws), we will comply with the applicable timelines and procedures.