Privacy Policy

1. Introduction

ReplenishIQ by VelvoShopping d.o.o. ("we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains in detail how we collect, use, disclose, and safeguard information when you use:

• our application ("App"), which integrates with Amazon's Selling Partner API (SP-API) to provide inventory management and analytics for authorized Amazon FBA sellers;
• our website at https://landing.replenishiq.app/ (the "Site"); and
• any related services, forms, emails, and communications we provide (together, the "Services").

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

2. Data Controller

The data controller responsible for the processing described in this policy is:

3. Information We Collect

We apply strict data-minimization practices. We collect only the information necessary to operate the Services, described in detail below.

3.1 Information You Provide Directly

• Account Information: When you create an account or sign up for the waitlist, we collect your name, email address, and, if provided, your company name and primary marketplace.
• Amazon Account Connection: When you connect your Amazon Seller Central account, we receive the Selling Partner ID and the associated authorized email address used to complete the connection.
• Workspace and Team Information: When you invite team members or use multi-user workspace features, we collect the names and email addresses of the users you invite so that we can send invitations and manage access permissions.
• Contact and Support Requests: If you contact us by email, submit a support ticket, or book a demonstration meeting, we collect your name, email address, company, and the contents of your message.
• Payment Information: If you subscribe to a paid plan, we collect billing information. Payment card data is processed by our payment processor and is never stored on our servers.

3.2 Amazon Business Data (via SP-API)

When you connect your Amazon Seller Central account, we retrieve limited, non-personal operational data through the Amazon Selling Partner API (SP-API) to provide the analytics and inventory features of the App. This includes:

• Inventory quantities and availability across Amazon fulfillment centers;
• Product SKUs, ASINs, and FNSKUs;
• Inbound and outbound shipment and tracking information;
• Sales performance and financial metrics (for example, sales velocity, pricing, ad spend, and attributed revenue).

We do not collect or process customer Personally Identifiable Information (PII) such as buyer names, shipping addresses, payment data, or customer contact details. We only access the Amazon data types you authorize and that are strictly necessary to provide the Service.

3.3 Information Collected Automatically

• Technical and Usage Data: When you visit the Site or use the App, we may automatically collect device type, browser type, operating system, IP address, referring pages, pages visited, and the date and time of your visit, to maintain security and improve performance.
• Log Data: Our servers and infrastructure providers may record diagnostic information such as error reports, request timestamps, and API usage metrics.
• Cookies and Local Storage: As described in Section 6, we may use cookies and similar technologies to operate and improve the Services.

4. How We Use Information

We use the information we collect solely for the following purposes:

• Providing the Service: To operate, maintain, and deliver the App's inventory tracking, analytics, alerting, and reporting features.
• Account Management: To identify and authenticate you, manage your account, and process waitlist or subscription sign-ups.
• Multi-User Collaboration: To create workspaces, send invitations, and manage role-based access permissions.
• Communications: To send you transactional messages (for example, account confirmations, alerts, and service notifications) and, with your consent, marketing and product-update emails.
• Support: To respond to your inquiries, troubleshoot issues, and provide customer support.
• Security and Fraud Prevention: To detect, prevent, and respond to security incidents, abuse, or unauthorized access.
• Improvement and Analytics: To measure usage, understand user needs, and improve the reliability, functionality, and performance of the Services using aggregated and anonymized data.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable government requests, and to enforce our Terms of Service.

No personal or customer data is ever used for profiling, selling, or any unrelated purpose. Amazon Selling Partner data is used exclusively to provide the Service to the seller who authorized access.

5. Legal Basis for Processing

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under one or more of the following legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the Services you have requested and to manage your account or subscription.
• Legitimate interests (Art. 6(1)(f)): Processing for security, fraud prevention, improving our Services, and communicating administrative information, balanced against your rights and interests.
• Consent (Art. 6(1)(a)): Processing for marketing communications, optional cookies, and similar activities where we ask for your consent, which you may withdraw at any time.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with our legal and regulatory obligations.

6. Cookies and Similar Technologies

We and our service providers may use cookies, web beacons, and local storage to operate and improve the Services. Cookies are small text files placed on your device that help us recognize you and remember your preferences. These include:

• Essential Cookies: Required for core functionality such as authentication and security. These cannot be disabled.
• Analytics Cookies: Used to understand how visitors use the Site so we can improve it (for example, page views, traffic sources).
• Preference Cookies: Used to remember choices you make, such as language or region.

You can control cookies through your browser settings, which allow you to block or delete cookies. However, disabling essential cookies may prevent the Services from functioning correctly. We encourage you to review the privacy policies of any analytics providers we use for more information.

7. How We Share Information

We do not sell, rent, or trade your personal information or Amazon business data. We share information only in the limited circumstances described below:

• Service Providers: We engage trusted third-party providers who process data on our behalf under strict confidentiality agreements and only to the extent necessary to provide the Services. These include cloud infrastructure providers (such as Cloudflare), payment processors, email delivery services (such as Resend), and analytics providers.
• Amazon: Data is exchanged with Amazon through the SP-API solely to provide the features you authorize. Amazon data is never shared with other sellers or unrelated third parties.
• Legal Authorities: We may disclose information when required by law, regulation, legal process, or enforceable government request, or to protect our legal rights, the safety of our users, or the public.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy continuing to apply.
• With Your Consent: We may share information for any other purpose when you have given us your explicit consent.

8. Data Retention

We retain personal and Amazon data only for as long as necessary to provide the Services, fulfill the purposes described in this policy, or comply with legal obligations. Specifically:

• Account and workspace data is retained for as long as your account remains active.
• When you revoke our Amazon access or delete your account, all associated Amazon data and identifiers are automatically purged within 30 days.
• Waitlist and contact-form data is retained until the waitlist or inquiry is resolved, and no longer than 12 months afterward, unless you later create an account.
• Log and diagnostic data is retained in aggregated or anonymized form for security and analytics purposes for no longer than 24 months.
• Where required by applicable law (for example, tax or accounting records), we retain the minimum necessary data for the legally required period.

When retention is no longer necessary, we delete or anonymize the data securely.

9. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest;
• Secure storage of Amazon API credentials and tokens with restricted access;
• Role-based access controls so only authorized personnel can reach operational data;
• Authentication, logging, and monitoring controls;
• Regular review of security practices and incident-response procedures.

While no method of transmission or storage is 100% secure, we strive to protect your data and review our safeguards on an ongoing basis.

10. International Data Transfers

We are based in Croatia (EU). Your information may be processed on servers located in other countries, including through infrastructure providers such as Cloudflare's global edge network. When we transfer personal data outside the EEA or the United Kingdom, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework, to ensure your data is protected to a standard substantially equivalent to that required in the EU.

11. Children's Privacy

The Services are intended for business use by Amazon sellers, agencies, and organizations, and are not directed to children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

12. Your Privacy Rights

12.1 Rights Under the GDPR (EEA / UK)

If you are located in the EEA or the United Kingdom, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erasure ("right to be forgotten") of your personal data;
• Restrict processing in certain circumstances;
• Data portability to receive your data in a structured, machine-readable format;
• Object to processing based on legitimate interests or for marketing;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with your local supervisory authority (in Croatia, the Croatian Personal Data Protection Agency, azop.hr).

12.2 Additional Rights (Other Jurisdictions)

Depending on your location (for example, California under the CCPA/CPRA), you may also have rights to know what personal information we collect, request its deletion, and opt out of the "sale" or "sharing" of personal information. We do not sell personal information. To exercise any of these rights, contact us using the details in Section 16.

12.3 Revoking Amazon Access

You may revoke our access to your Amazon account at any time via Seller Central → Apps & Services → Manage Your Apps. Revoking access does not affect the lawfulness of processing that occurred before revocation.

13. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority as required by applicable law (including under the GDPR) without undue delay after we become aware of the breach, where feasible within 72 hours.

14. Third-Party Links

The Site and App may contain links to third-party websites or services (for example, Amazon Seller Central or our blog). We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party websites you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email or by posting a notice on the Site and in the App. We encourage you to review this policy periodically.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to privacy requests within 30 days. If you are not satisfied with our response, you may also lodge a complaint with your local data protection authority.