Data Protection Policy

1. Company overview

ChainPilot is a supply chain management platform for Amazon FBA and Shopify sellers doing $500k–$50M in annual revenue. Our platform provides:

• AI-powered inventory forecasting and days of cover calculations
• Automated reorder alerts and purchase order management
• Freight tracking and shipment status monitoring
• Cash flow forecasting and P&L reporting
• Supplier communication and payment workflow management

2. Amazon SP-API data we access

We request access to the following SP-API data types, each with a specific justified purpose:

Data type	API endpoint	Purpose	Retention
Sales reports	Reports API — Detail Page Sales and Traffic	Calculate sales velocity (7/30/90 day) per ASIN to generate inventory forecasts and reorder recommendations	90 days rolling
FBA inventory levels	FBA Inventory API	Display current stock levels and calculate days of cover per product	Current snapshot only — refreshed every 6 hours
Inbound shipments	Fulfillment Inbound API	Track inbound FBA shipments and display status to sellers	Active shipments only — archived after delivery confirmed

We do not request access to and will never access:

• Customer personal data (names, addresses, contact information)
• Customer payment information or financial data
• Product pricing management or listing modification capabilities
• Order management or fulfillment capabilities
• Any data beyond what is listed above

3. How we collect data

Data is collected exclusively through the following authorized mechanism:

• Sellers explicitly authorize our application through Amazon's standard OAuth 2.0 flow in Seller Central
• Authorization is granted per seller account — we never access data without explicit per-account authorization
• Sellers can revoke access at any time through Seller Central → Apps & Services → Manage Your Apps
• Where refresh tokens are used to maintain authorized access, they are held server-side only and are never exposed to the browser, to other accounts or to any third party

4. Data storage and infrastructure

Status note. The Amazon Selling Partner API integration described in this document is not yet live, and ChainPilot does not currently ingest Amazon SP-API data. The controls below describe our infrastructure as it stands today. Section 4.4 lists the additional controls that will be in place before any Amazon data is processed.

4.1 Infrastructure

• All data is stored on DigitalOcean cloud servers located in Frankfurt, Germany (EU)
• Servers run Ubuntu LTS with security patches applied
• Production servers are dedicated — no shared hosting
• Account data is held in per-account server-side stores, each isolated to a single customer account

4.2 Encryption and credentials

• All data in transit is encrypted using TLS 1.2 minimum (TLS 1.3 preferred), with HTTPS enforced across the application
• Account passwords are never stored in readable form — they are hashed with PBKDF2-SHA256 at 600,000 iterations with a per-password salt
• Session cookies are signed, HTTP-only and same-site restricted
• API credentials and secrets are held in a configuration file outside the application source, with filesystem permissions restricted to the service owner — never in source code or version control

4.3 Access controls

• Production server access is restricted to the application owner only
• SSH access requires key-based authentication
• Each customer can only access their own data — every request is resolved to a single account and reads and writes are confined to that account's own data store
• Two-factor authentication is required: TOTP (RFC 6238) for clients, their team members and administrators, who can confirm with a passkey (WebAuthn/FIDO2, such as Touch ID or Windows Hello) instead of a code, and TOTP or one-time email codes for supplier and affiliate partner logins
• Trial accounts set up two-factor authentication before connecting a sales channel
• A device can be remembered for up to 30 days. The password is still required each time, and administrators can’t use this option
• Accounts lock for 30 minutes after 10 failed sign-in attempts in a row

4.4 Controls required before Amazon data is processed

We will not enable the SP-API integration until the following are in place:

• Encryption at rest (AES-256) for all stored Amazon data, including Personally Identifiable Information
• Encrypted, access-controlled backups held separately from the production server
• Mandatory multi-factor authentication for all administrative access
• Retention and deletion controls meeting Amazon's Data Protection Policy requirements, including deletion of PII within 30 days of order completion unless a legal obligation requires otherwise

5. Data usage restrictions

We strictly adhere to the following restrictions on Amazon SP-API data:

• Purpose limitation: Amazon data is used exclusively to provide inventory management and supply chain services to the authorizing seller. It is never used for any other purpose.
• No data selling: We do not sell, rent or trade Amazon data, and we transfer it to a third party only as described in section 8.
• No advertising use: Amazon data is never used for advertising targeting, marketing profiling or any commercial purpose beyond the core service.
• No aggregation for resale: We do not aggregate seller data to create benchmarks, market intelligence reports or any product sold to third parties.
• No unauthorized sharing: Amazon data is never shared with third parties except where strictly necessary to provide the service (e.g. displaying data in the seller's own dashboard, or generating a ChainPilot AI answer the seller asks for).
• Minimum necessary access: We request only the data types required to provide the service — no speculative data collection.

6. Data retention and deletion

Data type	Retention period	Deletion trigger
Amazon sales reports	90 days rolling window	Automatic — older data purged weekly
Inventory snapshots	Current + 7 days history	Automatic — older snapshots deleted daily
Shipment records	Until delivery + 30 days	Automatic after confirmed delivery
All Amazon data	Until access revocation	All data deleted within 30 days of revocation or account closure
API credentials	Until access revocation	Immediately deleted upon revocation

7. Incident response

In the event of a data breach or security incident:

• We will notify affected sellers within 72 hours of becoming aware of a breach
• We will notify Amazon in accordance with SP-API terms within the required timeframe
• We maintain an incident response procedure that includes immediate access revocation, investigation, remediation and disclosure
• Security incidents are logged and reviewed to prevent recurrence

8. Subprocessors

Amazon SP-API data is stored and processed within our own infrastructure. We use the following subprocessors, each bound by contract to use data only to provide their service to us:

• DigitalOcean (United States company; servers in Frankfurt, Germany) — infrastructure hosting. DigitalOcean does not have access to application data.
• Cloudflare (United States) — website hosting, DNS, network security and storage of documents sellers upload (such as invoices). Amazon data is not stored with Cloudflare.
• Resend (United States) — sends ChainPilot's emails: notifications to sellers, and the emails sellers send to their suppliers and partners through ChainPilot. It also receives the emails that suppliers and partners send to each seller's ChainPilot forwarding address, so ChainPilot can file them for that seller, and the alert emails that services such as Amazon and Shopify send to each seller's alerts address. Customer details in those alerts (orders, returns, buyer messages) are not kept. Raw Amazon data is never included in emails.
• Anthropic (United States) — powers ChainPilot AI and translates the app and emails into the language each user chooses. When a seller uses ChainPilot AI, the summary figures needed to answer (such as stock levels and projected stockout dates for that seller's own products) are sent to Anthropic's API to generate the reply. Under its commercial terms, Anthropic does not use this data to train its models. Raw reports and credentials are never sent.
• Stripe (United States and Ireland) — subscription billing. Stripe receives billing details only and never receives Amazon data.
• Terminal49 (United States) — tracks sea containers from the bill of lading or container numbers on a seller's orders. It receives those numbers and order references only, never Amazon data.

Changes to this list. We update this list before a new subprocessor starts handling customer data, and we email account owners at least 30 days in advance so they can object. If a customer objects on reasonable data protection grounds and we can't accommodate the objection, they may cancel their subscription.

Transfers outside the EEA. Some subprocessors process data in the United States. These transfers rely on the provider's certification under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where it applies, or on the European Commission's Standard Contractual Clauses with the UK Addendum and Swiss adaptations. See section 9 of our Privacy Policy.

9. Compliance

• We comply with Amazon's Acceptable Use Policy and Developer Agreement
• We apply the GDPR, the UK GDPR and Swiss data protection law to the personal data of users in those regions — see section 9 of our Privacy Policy
• We honor the privacy rights of California residents under the CCPA — see section 10 of our Privacy Policy
• We comply with applicable data protection laws in the jurisdictions where we operate
• This policy is reviewed and updated at least annually or upon any material change to our data practices

10. Contact for data protection inquiries

For any questions about this Data Protection Policy or our data handling practices: