Privacy Policy

• Authoritative language: Japanese. This English version is provided as an informational translation. In the event of any discrepancy, the Japanese version prevails.
• Scope: Users of the Seller Atlas application (app.selleratlas.io)
• Operator: Korogaru Ishi, LLC. (hereinafter "we", "us")

1. Introduction

We consider the appropriate protection of users' personal information and the data handled within Seller Atlas (the "Service") to be a core responsibility in providing the Service. This Privacy Policy (this "Policy") sets out how we collect, use, manage, and disclose information in connection with the Service.

This Policy applies to users of the Service. For cookies and analytics on our landing page (selleratlas.io), please refer separately to the Legal Notice.

2. Information We Collect

In providing the Service, we collect the following information.

2.1 Account Information

• Email address
• Authentication credentials (passwords are hashed before storage)
• Display name, language, time zone, and other user preferences

2.2 Amazon Connection Information

When a user connects an Amazon Seller Central account to the Service, we obtain the following through the Amazon Selling Partner API ("SP-API"):

• SP-API refresh token (stored in encrypted form)
• Listing information (ASIN, SKU, price, inventory, listing status, etc.)
• Order information (order ID, items, amounts, shipment information, and regional information processed to a granularity that cannot identify the shipping destination. We do not collect Restricted Data such as buyer name, phone number, or detailed address)
• Shipment, inventory, and return information
• Fees and sales statements
• Seller identifiers (Seller ID, Marketplace ID, etc.)

2.3 Information You Input into the Service

• Purchase records, profit records, research notes, and other information entered by the user
• Uploaded files (CSV, etc.)

2.4 Payment Information

• Subscription plan, billing history, invoice information
• Credit card numbers themselves are not stored by us; they are held by our payment processor (Stripe)

2.5 Usage Logs

• Access timestamps, operation history, IP address, user agent, error logs, and the like

3. Purposes of Use

We use the information we collect for the following purposes. We process data based on valid legal bases, such as the performance of a contract, our legitimate interests (improving services and ensuring security), compliance with legal obligations, or with the user's consent.

• Service Provision & Operation: User authentication, account management, data synchronization with Amazon Seller Central, billing and payment processing, responding to inquiries, and sending important notices.
• Service Improvement & Fraud Prevention: Improving service quality by analyzing usage patterns, and detecting/preventing terms of service violations or unauthorized access.
• Legal Compliance: Meeting statutory obligations such as tax and accounting requirements.
• Marketing (Consent-based): Use of non-essential cookies and specific service information (only where consent has been obtained).

4. Disclosure to and Processing by Third Parties

In providing the Service, we entrust data processing to the following parties. Each party handles information in accordance with its own privacy policy and data protection terms.

We do not provide a user's personal information to third parties other than those listed above, except in the following cases:

• With the user's consent
• As required by law
• When necessary to protect the life, body, or property of a person and it is difficult to obtain the user's consent

Subprocessors may change from time to time as required by our operations. If a change in subprocessors materially affects a user's rights, we will notify users by reasonable means such as amending this Policy or posting a notice within the Service.

5. Cross-Border Data Transfers

As shown in the table in Section 4, the Service uses infrastructure operated by parties located in the United States and elsewhere. Accordingly, user information may be transferred outside Japan and handled in accordance with the laws of the relevant jurisdiction.

We endeavor to ensure an adequate level of protection at the transfer destination by leveraging "Adequacy Decisions" between Japan and the EEA, relying on Standard Contractual Clauses (SCCs) and other appropriate safeguards implemented by our subprocessors in countries without such decisions (such as the United States), and verifying their technical and organizational measures.

6. Data Retention and Deletion

6.1 During the Account's Lifetime

For as long as a user's account is active (whether on a paid plan or in the free (Free) state), we will continue to retain the user's data.

6.2 Upon Account Deletion

When a user deletes their Service account (withdraws), we will delete data tied to that user's tenant in the production database (including account information, input data, Amazon connection information, and SP-API refresh tokens) within 30 days of the date of withdrawal.

The following are exceptions:

• Information subject to statutory retention obligations (invoices, tax records, etc.): retained for the period required by applicable law
• Backups and system logs: retained for a reasonable period for incident response and security auditing, and erased after the retention period elapses
• Master data derived from public information (ASIN, basic product information, Amazon catalog information, etc.): retained in the Service's database with any tenant association removed (once the tenant association is removed, this data no longer identifies any particular user)

6.3 Amazon SP-API Refresh Tokens

If a user disconnects the Amazon integration from within the application, the refresh token will be deleted promptly. In the case of withdrawal, the token will be deleted within 30 days of the date of withdrawal in accordance with Section 6.2.

7. Rights of Users

In accordance with the Japanese Act on the Protection of Personal Information and data protection laws of other jurisdictions (such as the GDPR for EEA/UK residents), users have the right to request disclosure, correction, deletion, or suspension of the use of their personal information.

7.1 Key Rights

• Disclosure, Correction & Deletion: To review, correct, or request the deletion of their information.
• Export (Data Portability): To receive data they have entered in a commonly used format.
• Suspension of Use & Objection: To request the suspension of use or object to specific processing of their information.
• Lodge a Complaint: To lodge a complaint with a data protection authority in their country of residence.

To exercise these rights, please contact the inquiry desk in Section 13. We will respond within a reasonable period after verifying identity.

8. Data Handling Policy (Use in AI and Service Improvement)

We adhere to the following principles with respect to user data:

• We will not divert data tied to a particular user's tenant (orders, inventory, profits, input data, etc.) to any purpose other than that of the tenant in question
• We will not provide data tied to a particular user's tenant for AI model training or learning purposes, including by third-party AI models
• We will not present data tied to a particular user's tenant to other users

The following are exceptions:

• Master data derived from public information (ASIN, basic product information, prices publicly disclosed by Amazon, etc.) is, by its nature, public information and is handled as common reference data across the Service
• Aggregated and anonymized statistical data in a form that does not identify any individual or specific tenant (such as feature usage trends, error rates, and feature-level usage) may be used to maintain and improve the operational quality of the Service

9. Compliance with the Amazon Data Protection Policy

In using the Amazon Selling Partner API, we will take the following measures to comply with the Amazon Data Protection Policy ("DPP"):

• Encryption: encryption at rest for SP-API refresh tokens and personally identifiable information (PII)
• Least privilege: SP-API scopes are limited to those required to provide the Service
• Access control: internal access to such data is limited to what is necessary for business purposes
• Tenant isolation: data access controls between tenants are enforced in accordance with the DPP
• No disclosure to other tenants: we do not provide user data to other tenants
• Deletion procedures: procedures are in place for handling user deletion requests and for deleting data upon withdrawal
• Incident response: procedures are in place for handling security incidents, including reporting to Amazon

10. Security

We take reasonable technical and organizational safety measures to protect user information, including:

• Encryption of communication channels
• Hashing of passwords and other authentication credentials
• Encrypted storage of sensitive information (such as SP-API refresh tokens)
• Minimization of access privileges
• Operation of authentication and authorization mechanisms

Note that the absolute safety of data transmission over the Internet and electronic storage cannot be guaranteed.

11. Cookies

The Service (app.selleratlas.io) uses cookies and similar technologies (such as local storage) to maintain authentication and user preferences. For details on cookies on the landing page and the handling of analytics tools, please refer to the Legal Notice.

12. Children's Privacy

The Service is, in principle, intended for businesses (individuals or entities operating an Amazon selling business) and is not intended for use by persons under the age of 16. We do not knowingly collect personal information from persons under the age of 16.

13. Contact

For inquiries regarding this Policy and to exercise the rights set out in Section 7, please contact:

• Operator: Korogaru Ishi, LLC.
• Representative: Tetsuma Namura
• Address: as published in the Legal Notice
• Contact: support@selleratlas.io

14. Amendments to this Policy

We may amend this Policy as necessary in response to changes in law, changes to the Service, or for other reasons. Where a material change is made, we will provide notice by reasonable means, such as a notice within the Service or notification to the registered email address.