Privacy Policy

1. Who we are

ChainPilot is a supply chain management platform built for Amazon FBA and Shopify sellers. We provide inventory forecasting, automated reorder management, freight tracking, and cash flow planning tools.

For questions about this policy, contact us at: privacy@chainpilot.app

2. Information we collect

We collect the following types of information:

Account information

• Name, email address and business name provided when you apply or register
• Billing information processed securely through our payment provider
• Communication preferences and support correspondence

Amazon Selling Partner data (with your explicit authorization)

• Sales reports — units ordered per ASIN, revenue data
• FBA inventory levels — current stock quantities per product
• Inbound shipment data — shipment IDs, status, quantities
• We access only the data categories you explicitly authorize via Amazon's OAuth flow
• We do not access payment information, customer personal data, or any data beyond what is needed to provide the service

Shopify store data (with your explicit authorization)

• Product inventory levels and sales history
• Order counts and revenue data for forecasting purposes
• We do not access customer personal data or payment information

Supply chain operational data

• Purchase order details, quantities and supplier information you enter
• Shipment tracking information from your freight forwarder
• Payment documentation you upload (invoices and payment proofs)
• Product settings including pricing, costs and packaging specifications

Usage data

• Log data including IP address, browser type and pages visited
• Actions taken within the platform for security and improvement purposes

3. How we use your information

We use the information we collect to:

• Provide, operate and improve the ChainPilot platform
• Calculate inventory forecasts, days of cover and reorder recommendations
• Send automated alerts, order approvals and payment notifications
• Communicate with suppliers and freight forwarders on your behalf
• Generate cash flow forecasts and P&L reports for your business
• Respond to your support requests and service communications
• Comply with legal obligations and prevent fraud

We do not sell your data to third parties. We do not use your Amazon or Shopify data for advertising or marketing purposes.

4. Amazon SP-API data usage

We access your Amazon Selling Partner data solely to provide the inventory management and supply chain services described in this policy. Specifically:

• Sales data is used exclusively to calculate sales velocity and inventory forecasts for your account
• Inventory data is used exclusively to display your current stock levels and trigger reorder alerts
• Shipment data is used exclusively to track your inbound FBA shipments
• We do not share your Amazon data with any third party except as required to provide the service (e.g. displaying it in your dashboard)
• You may revoke our access to your Amazon data at any time through Amazon Seller Central → Apps & Services → Manage Your Apps
• Upon revocation or account termination, we will delete your Amazon data within 30 days

5. Data storage and security

Your data is stored on secure servers hosted on DigitalOcean infrastructure in the EU (Frankfurt, Germany). We implement the following security measures:

• All data transmission is encrypted using TLS 1.2 or higher (HTTPS), enforced across the application
• Passwords are never stored in readable form — they are hashed with PBKDF2-SHA256 at 600,000 iterations with a per-password salt
• Session cookies are signed, HTTP-only and same-site restricted
• Each customer's data is held in its own server-side store; every request is resolved to a single account and cannot read or write another account's data
• Access to production systems is restricted to authorized personnel only
• Regular security reviews and dependency updates
• API credentials and secrets are held in a configuration file outside the application source with restricted filesystem permissions, never in source code or version control
• Two-factor authentication (TOTP) is available on ChainPilot accounts

6. Data retention

• Account data is retained for the duration of your subscription plus 90 days after cancellation
• Amazon and Shopify data is deleted within 30 days of access revocation or account closure
• Payment documentation (invoices and proofs) is retained for 7 years for legal and tax compliance
• You may request deletion of your data at any time by contacting us

7. Third-party services

We use the following third-party services to operate the platform:

• DigitalOcean — cloud hosting and infrastructure
• Google Workspace / Gmail — transactional email delivery
• Amazon Selling Partner API — sales and inventory data (with your authorization)
• Shopify API — sales and inventory data (with your authorization)
• Stripe (planned) — subscription billing

Each third-party service has its own privacy policy and data handling practices.

8. Your rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your personal data
• Portability — receive your data in a machine-readable format
• Objection — object to certain types of processing
• Withdrawal — withdraw consent for data processing at any time

To exercise any of these rights, email us at privacy@chainpilot.app. We will respond within 30 days.

9. Cookies

We use essential cookies only — strictly necessary to keep you logged in and maintain your session. We do not use advertising cookies, tracking cookies or analytics cookies that follow you across other websites.

10. Children's privacy

Our service is designed for business use and is not directed at children under 18. We do not knowingly collect personal data from minors.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify active users by email at least 14 days before material changes take effect. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or requests: