Privacy Policy

1. Information we collect

• Account information you provide directly. Your name, company name, email address, and login credentials.
• Amazon selling partner data. Data accessed through Amazon's Selling Partner API (SP-API) and, where you choose to connect it, the Amazon Ads API, including orders, fees, refunds, returns, inventory levels, inbound shipments, product listings, and advertising performance data associated with your own Amazon seller account. We access this data only after you authorize SiteForge through Amazon's authorization workflow, and only within the scope of the permissions (roles) you grant.
• Store email data (optional integration). If you choose to connect your store email inbox, SiteForge reads transactional notification emails from that inbox in order to detect delivered orders and shipment events. We parse only the transactional information needed for that purpose and do not use the contents of your inbox for any other purpose. See Section 2 for how we handle data obtained through your email provider's API.
• Data you enter into SiteForge. Product costs (COGS), warehouse and purchase records, business expenses, and similar operational data.
• Usage and device data. When you use SiteForge, our servers automatically record certain technical information in log files, which may include your IP address, browser type and version, operating system, referring pages, the pages and actions taken within the app, and the date and time of access. We use this to operate, secure, and improve the service. See Section 13 (Cookies) for related information.

We do not collect or store payment card numbers. SiteForge does not currently process payments. If we introduce paid plans, payments will be handled by a PCI-DSS compliant third-party payment processor (see Section 5).

2. Amazon buyer PII and data obtained through email provider APIs

Amazon buyer personally identifiable information (PII). SiteForge is a profit, inventory, sourcing, and restocking tool. In normal operation, SiteForge does not access, collect, or store Amazon buyer personally identifiable information, such as buyer names, shipping addresses, phone numbers, or buyer email addresses. We process order, financial, inventory, listing, and advertising data associated with your seller account, not the personal data of your customers.

Where any processing of buyer PII is unavoidable to provide a feature you have enabled, we handle it strictly in accordance with Amazon's Data Protection Policy: we access it only through Amazon-approved mechanisms, use it solely to provide that feature to you, apply the security measures described in Section 6, restrict access to authorized personnel on a need-to-know basis, and retain it for no longer than 30 days after order delivery unless a longer period is required to calculate or remit taxes, comply with legal obligations, or resolve disputes.

Data obtained through email provider APIs (store email integration). When you connect a store email inbox, SiteForge accesses it through your email provider's API (for example, the Microsoft 365 / Microsoft Graph API) using the permission you or your administrator grant. We access only the transactional email data necessary to detect deliveries and shipment events. We do not use this data for advertising, we do not sell it, and we do not transfer it to third parties except as necessary to provide the feature, to comply with applicable law, or as part of a merger or acquisition. Human access is limited to purposes you have explicitly consented to, security investigations, or as required by law. You can revoke this access at any time from within SiteForge or from your email provider's admin or third-party-access settings (see Section 8).

3. How we use information

We use the information above solely to:

• provide, operate, and maintain the SiteForge platform for your account;
• calculate and display the sales, profit, inventory, restocking, sourcing, and advertising data you have authorized us to access;
• communicate with you about your account, security, or the service;
• maintain the security, integrity, and reliability of the platform; and
• comply with our legal obligations.

We do not sell your data. We do not use your Amazon Selling Partner data or Amazon Advertising data for any purpose other than providing the SiteForge service to you, and we do not use it to train third-party models, to build advertising or marketing products, or for any purpose that would violate Amazon's Acceptable Use Policy or Data Protection Policy.

4. Legal basis for processing (EEA / UK)

Where the GDPR or UK GDPR applies, we process personal data on the following legal bases: (a) performance of a contract, to provide the SiteForge service you have signed up for; (b) consent, for optional integrations you choose to connect (such as the store email integration) and where otherwise required, which you may withdraw at any time; (c) legal obligation, for example, to meet tax or accounting requirements; and (d) legitimate interests, to operate, secure, and improve the service, provided these interests are not overridden by your rights.

5. How we share information

We do not share your information with third parties, except:

• Service providers (sub-processors). With vendors who help us operate SiteForge, such as cloud hosting and database infrastructure providers, who process data only on our instructions and under written confidentiality and data-protection obligations.
• Payment processing. SiteForge does not currently process payments. If we introduce paid plans, card payments will be handled by a PCI-DSS compliant third-party payment processor; we will not receive or store your full card details, and we will update this policy to name the processor.
• Legal requirements. When required to comply with applicable law, regulation, legal process, or an enforceable governmental request.
• With your consent. When you have given us explicit permission to do so.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to the protections of this Privacy Policy.

We do not sell, rent, or trade your personal information or your Amazon data.

6. Data security

We use technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• encryption of data in transit using TLS/HTTPS;
• hashing of account passwords using bcrypt;
• limiting access to production systems and your data to authorized personnel on a need-to-know basis; and
• ongoing review and strengthening of our security measures as the Service grows.

No method of transmission or storage is completely secure, and while we work hard to protect your information, we cannot guarantee absolute security.

7. Data breach notification

If we become aware of a security incident that affects your personal information or your Amazon data, we will investigate promptly, take steps to contain and remediate it, and notify you and, where required, the relevant authorities and Amazon without undue delay and within the timeframes required by applicable law and by our agreements with Amazon.

8. Data retention, revocation, and deletion

We retain your information only for as long as your account is active or as needed to provide the service to you.

Revoking authorization. You may revoke SiteForge's access to your Amazon account at any time from Amazon Seller Central (Apps & Services → Manage Your Apps → revoke authorization) or from within SiteForge. If you connected the store email integration, you can disconnect it from within SiteForge or from your email provider's third-party access settings.

Deletion. When you revoke authorization or close your account, we stop accessing your data. You may request deletion of the Amazon Selling Partner, Amazon Advertising, and email-derived data we hold, and we will delete or anonymize it within a reasonable period after your request or account closure, except where retention is required by law or for legitimate business purposes such as tax, accounting, or dispute resolution. Backups are purged on our regular backup-rotation cycle.

9. Your rights and choices

Depending on where you live, you may have some or all of the following rights regarding your personal information: the right to access it, to correct it, to delete it, to restrict or object to certain processing, to data portability, and to withdraw consent.

• All users may request access to, correction of, or deletion of their personal information by contacting us at the email address below.
• European Economic Area / United Kingdom users (GDPR/UK GDPR). You have the rights described above and the right to lodge a complaint with your local data protection authority. A list of EEA authorities is available at edpb.europa.eu.
• California users (CCPA/CPRA). You have the right to know what personal information we collect, to request deletion, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under California law.

We will respond to verifiable requests within the timeframe required by applicable law. We will not discriminate against you for exercising any of these rights.

10. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Analytics that SiteForge computes (such as profit, ROI, or restock recommendations) are business tools presented to you about your own operations; they are not automated decisions made about any individual.

11. International data transfers

SiteForge is operated from the United States, and our service providers may process data in the United States and other countries. If you access SiteForge from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States. Where required, we rely on appropriate safeguards for such transfers.

12. Children's privacy

SiteForge is a business tool and is not directed to, or intended for use by, children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

13. Cookies and similar technologies

We use cookies and similar technologies that are necessary to operate the platform (for example, to keep you signed in) and to understand how the service is used so we can improve it. You can control cookies through your browser settings; disabling necessary cookies may affect how the platform works.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the "Last updated" date above. If the changes are material, we will take reasonable steps to notify you.

15. Contact us

If you have any questions about this Privacy Policy or wish to exercise your rights, contact us at:

41 Star Capital LLC
Miami, FL, United States
sales@41starcapital.com