Privacy Policy

Version 2.0 • Effective date: May 23, 2026 • Last updated: May 23, 2026

1. Introduction & Scope

SkuFx ("SkuFx", "we", "us", or "our") is operated by 辽阳普维商贸有限公司 (Liaoyang Puwei Trading Co., Ltd.)(the "Company"), a company incorporated in Liaoyang, Liaoning Province, People's Republic of China. We are the data controller for personal information processed under this Policy.

This Privacy Policy describes how we collect, use, store, share, and protect information when you visit skufx.com, use the SkuFx application at app.skufx.com, or authorize SkuFx to access your Amazon Selling Partner API ("SP-API") data.

By using SkuFx, you agree to this Policy. If you do not agree, please discontinue use.

2. Information We Collect

2.1 Information You Provide

• Registration data: name, email address, company name.
• Payment data: billing address and payment method (processed by our payment provider; we do not store full card numbers).
• Communications: messages you send via support, contact forms, or email.

2.2 Amazon Seller Data (via SP-API)

If you authorize SkuFx to connect to your Amazon Seller Central account via Login with Amazon (LWA) OAuth, we retrieve and process the following data to provide Business ERP features:

• FBA inventory data: available units, reserved, inbound, and damaged units per SKU.
• Order data: Order ID, status, amount, fulfillment channel, marketplace, purchase date. Order data may include ship-to city, state, and postal code — treated as PII: stored in separately encrypted fields, automatically deleted 30 days after order delivery, never displayed at individual order level, used only for aggregated regional analytics.
• Sales & traffic reports: sessions, conversion rate, units sold, revenue by date and ASIN.
• Financial events: FBA fees, platform commissions, refunds, promotional discounts, adjustments.
• Settlement records: disbursement amounts and timing.

We do NOT request and do NOT access: buyer names, emails, or street addresses; Direct-to-Consumer Shipping data; Buyer Communications or Solicitation data; Tax Invoice or Tax Remittance data.

We use SP-API data solely to provide SkuFx features to you. We do not aggregate your data across seller accounts, do not use it for our own retail operations, and do not share it with any third party except as described in Section 5.

2.3 Information Collected Automatically

• Technical data: IP address, browser type and version, operating system, referrer URL.
• Usage data: pages visited, features used, timestamps, session duration.
• Cookies: see Section 9 for details.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the SkuFx platform and its features.
• Authenticate your account and maintain session security.
• Process SP-API data to generate keyword analyses, listing audits, inventory insights, ERP dashboards, and other features you have enabled.
• Send transactional emails (account confirmations, billing receipts, alerts you have configured).
• Respond to your support requests.
• Detect, investigate, and prevent security incidents and fraudulent activity.
• Comply with legal obligations.

We do not sell your personal information. We do not use your SP-API data for advertising or train machine-learning models on it beyond the features you have contracted for.

4. Data Storage and Security

Your data is stored on servers located in the United States operated by our hosting provider (see the sub-processor list in Section 5). We implement the following controls:

• Encryption at rest: AES-256 for all SP-API data and personal data stored in our database.
• Encryption in transit: TLS 1.3 for all communications between your browser and our servers.
• Credential protection: Amazon LWA refresh tokens are stored using envelope encryption (Fernet); secrets are stored in a secrets vault, never in plaintext.
• Access control: role-based access control (RBAC), multi-factor authentication (MFA) for all staff, principle of least privilege, and separation of duties.
• Audit logging: all access to production data by staff is logged and retained for one year.
• Vulnerability management: dependency scanning, container scanning, and annual penetration testing. Critical vulnerabilities are remediated within 7 days.

5. Multi-Tenant Data Isolation

SkuFx processes data for many independent sellers as a public solution provider. We guarantee:

• Database isolation: PostgreSQL Row-Level Security ensures queries are always scoped to a single seller. No cross-account data access is technically possible, even for SkuFx engineers.
• No cross-seller analytics: we do not aggregate or benchmark data across seller accounts.
• Engineering access: all production data access by SkuFx staff is audit-logged and requires documented justification.
• No competitive use: we never use your Amazon data for our own retail operations or to benefit other customers.

6. Data Sharing and Disclosure

We do not share your SP-API data or personal information with any third party for commercial purposes. We may share data only in the following circumstances:

• Sub-processors: we engage service providers who process data on our behalf under contractual data processing obligations. See the complete, current list at skufx.com/sub-processors. We notify active customers at least 30 days before adding any new sub-processor that handles Amazon seller data.
• Legal requirements: we may disclose information when required by law, regulation, court order, or lawful government request. Where permitted, we will notify you before complying.
• Business transfers: if SkuFx is acquired or merges with another entity, your information may be transferred. We will notify you by email before your information becomes subject to a materially different privacy policy.

7. Data Retention

We retain different categories of data for different periods:

• FBA inventory snapshots: 1 year (days-of-supply trend analysis).
• Orders (with PII fields): buyer location (city/state/postal code) deleted 30 days after order delivery, in compliance with Amazon's Developer Protection Policy (DPP).
• Order aggregates (no PII): 2 years (sales analytics).
• Sales & traffic reports: 2 years (trend analysis).
• Financial events: 1 year (profit calculation).
• Settlement records: 7 years (tax compliance).
• LWA refresh tokens: retained until you revoke SP-API authorization, then deleted within 24 hours (stored encrypted with Fernet).
• Application logs: 1 year.
• Audit logs: 3 years.
• Backup snapshots: 30 days, encrypted.
• Account data: retained for the duration of your subscription plus 90 days after cancellation, unless you request earlier deletion.

Upon revocation of SP-API authorization(via Seller Central → Apps & Services → Manage Your Apps), we delete all cached SP-API data within 24 hours and send you a confirmation email.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data.
• Right to data portability: request your data in a machine-readable format.
• Right to restrict processing: request that we limit how we use your data.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, email privacy@skufx.com. We will respond within 30 days. To revoke SP-API authorization specifically, go to Seller Central → Apps & Services → Manage Your Apps — we will process deletion within 24 hours.

If you are in the European Economic Area (EEA) and believe we have not handled your request correctly, you have the right to lodge a complaint with your local supervisory authority.

9. International Data Transfers

辽阳普维商贸有限公司 (Liaoyang Puwei Trading Co., Ltd.)is incorporated in the People's Republic of China. Your data is processed and stored on servers in the United States. When we transfer personal data from the EEA or United Kingdom to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46(2)(c) GDPR) as the legal transfer mechanism.

We comply with applicable Chinese data-export regulations, including the requirements under China's Personal Information Protection Law (PIPL) and Data Security Law (DSL) for cross-border data transfers.

For data processing agreements or questions about cross-border transfers, contact privacy@skufx.com.

10. Cookies and Tracking

We use the following cookies on skufx.com and app.skufx.com:

• Strictly necessary cookies: session authentication token, CSRF token, theme preference. Required for the service to function; cannot be disabled.
• Performance cookies: Vercel Speed Insights (anonymous, aggregated page-load metrics; no personally identifiable information is sent). You can disable these in your browser settings.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics platforms that build user profiles. See our full Cookie Policy for details.

11. Children's Privacy

SkuFx is intended solely for business use by individuals 18 years of age or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact privacy@skufx.com and we will delete it promptly.

12. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify active users by email at least 14 days before the change takes effect. Historical versions of this Policy are available on request.

13. Contact Us

Data Controller & Data Protection Officer:
辽阳普维商贸有限公司 (Liaoyang Puwei Trading Co., Ltd.)
Room 1002, 1st Floor, Building D, No. 36-4 Tianfu Road, Wensheng District, Liaoyang City, Liaoning Province, People's Republic of China
privacy@skufx.com

Security concerns: security@skufx.com

General support: support@skufx.com