Privacy Policy¶

Last updated: 31 October 2026

1. Introduction¶

Suppli ("we", "our", "us"), operated by AUKSales LLC, is committed to protecting your privacy. This policy explains what data we collect, how we use it, how long we keep it, and your rights regarding that data. By using Suppli, you agree to the practices described here.

2. Data we collect¶

Suppli stores what the apps you turn on need to do their work. Each category below is kept only for the account that connected it.

Your account

Email address and password — used to identify your account, sign you in and send transactional emails
Business info — the business name, address and shipping profiles you enter for labels and invoices
Billing — your Stripe customer and subscription ids, and your Suppli API credit balance and usage. Card details never reach Suppli

Your suppliers and products

Supplier feed files — the CSV and spreadsheet files your suppliers send or you upload, and the parsed rows
Mailbox credentials — IMAP settings for the mailboxes Suppli reads supplier feeds from, stored encrypted
Supplier API credentials — logins or keys for a supplier's portal or API, stored encrypted, used only to fetch that supplier's stock
Catalog and sync records — your product mappings, stock and price rules, every sync run with its logs, SKU counts, quantities and error messages

Your sales channels

Channel credentials — tokens and key pairs for Shopify, eBay, Walmart, Amazon, Etsy and WooCommerce, stored encrypted and used solely for the integrations you configure
Orders — with Fulfillment on, the orders your store sends us: order number, items, totals, and your customer's name, email, phone and shipping address, kept to buy labels and send tracking back to the store
Sales figures — with Finance on, order totals, fees and refunds pulled from your channels to build profit and loss reports, plus the report files you export
Repricer settings — your costs, margins, fees, floor and MAP prices, and the exchange rates Suppli fetches to convert prices for stores that do not sell in USD

Your mail, messages and contacts

Connected mailboxes — IMAP/SMTP credentials or Gmail / Microsoft OAuth tokens for the mailboxes you connect to Suppli Mail, Leads, Contacts and the Inbox, stored encrypted
Emails — with Suppli Mail on, the sender, subject, a preview of the body and the AI category of each email read from a connected mailbox, kept for 5 days
Conversations — with Suppli DM on, the messages exchanged on Instagram, Messenger, X, Slack, email and your website chat, the replies Suppli drafts or sends, and a visitor id for website chat
Contacts and CRM — the names, email addresses, phone numbers, notes and labels of the people who contact you through any connected channel, and the deals and tasks you keep in the CRM
Leads — with Leads on, the businesses Suppli finds for you (name, address, website, contact details from public sources), the outreach sent from your own mailbox, and the replies

Your content and connections

Social accounts — with Ads on, OAuth tokens for the LinkedIn, Facebook, Instagram, Threads, X, TikTok, Pinterest and YouTube accounts you connect, stored encrypted
Ads content — the briefs, product details, generated text, images and videos of your campaigns, and the results of each post
Booking — Google or Microsoft calendar and Zoom connections, your availability, and each booking's name, email, time and notes
Reseller applicants — the business name, email and application details of resellers who apply through your form
Connected sheets — with Connect on, the Google Sheets you link and their mappings
Assistant chats — your conversations with the Suppli assistant

Technical

Server logs — standard request logs (IP address, path, time) kept by our hosting provider to run and debug the service. Suppli runs no analytics or tracking of any kind.

3. How we use your data¶

Providing and operating the Suppli inventory sync service and the apps you enable
Pushing stock and prices to your channels, buying labels and sending tracking for your orders, building your reports
Reading and replying to messages and emails, finding and contacting leads, posting ads and booking meetings, on your instructions
Sending alert emails and Inbox notifications when something needs your attention
Displaying sync history and error logs on your dashboard
Processing payments via Stripe
Improving the reliability and performance of the service

We do not sell your data to third parties. We do not use your data for advertising purposes.

4. Data storage & retention¶

Your data is stored on Railway infrastructure (US servers) using PostgreSQL databases. Files (supplier feeds, ad images and videos, exported reports, chat attachments) are stored in Cloudflare R2 object storage in a private bucket.

Data is retained for as long as your account remains active, with these exceptions:

Emails read by Suppli Mail are deleted after 5 days
Generated ad images and videos are deleted after the period you choose in Ads (30, 60 or 90 days)
Dropshipping news items are deleted after 3 days
Pending lead inquiries expire after 14 days

Turning an app off keeps its data; nothing is deleted until you ask. If you close your account, we will delete your personal data within 30 days of the request, except where we are legally required to retain it (e.g. payment records). We perform regular backups but cannot guarantee recovery in all failure scenarios.

5. Third-party services we use¶

Suppli uses the following third-party services, each with their own privacy policy. Data goes to each one only when you use the feature that needs it.

Stripe — payment processing. Your card details go directly to Stripe and are never stored on Suppli servers. Stripe is PCI-DSS compliant. stripe.com/privacy
Railway — cloud hosting and database. All application data is stored on Railway's US infrastructure. railway.app/legal/privacy
Cloudflare R2 — file storage (feeds, media, reports). cloudflare.com/privacypolicy
Resend — transactional email delivery (alert emails, sync notifications, sign-in codes). resend.com/privacy
AI providers: Anthropic, OpenAI, Google (Gemini) — Suppli's AI features (Ads, DM, Mail, Leads, CRM and the assistant) send the text, images or product details they need to process to the provider serving that feature, either through Suppli's pooled API credit or your own API keys. Only the content that feature handles is sent, and only when you use it. anthropic.com/privacy, openai.com/policies/privacy-policy, policies.google.com/privacy
Shopify, eBay, Walmart, Amazon, Etsy, WooCommerce — connected via your own API credentials to perform the inventory, price, order and fulfillment actions you configure. No data is sent to these platforms beyond what those actions require. etsy.com/legal/privacy
EasyPost — shipping rates, labels and tracking for Fulfillment and the Repricer's shipping estimates. Your ship-from address and, for labels, your customer's name, address and phone are sent to EasyPost. easypost.com/privacy
Google — Gmail (connected mailboxes), Google Calendar (Booking), Google Sheets (Connect), YouTube (Ads), and Google Places (Leads prospecting searches; no account data is sent). Access is through OAuth consent you grant and can revoke. policies.google.com/privacy
Microsoft — Outlook mail and calendar through Microsoft Graph, when you connect a Microsoft account. privacy.microsoft.com
Meta — Instagram, Messenger, Threads and Facebook, for Suppli DM and Ads, through the accounts you connect. facebook.com/privacy/policy
X, LinkedIn, Pinterest, TikTok — Ads posting and, for X, DMs, through the accounts you connect
Slack — Suppli DM and notifications, through the workspace you connect
Zoom — meeting links for Booking, through the account you connect
Your own mail servers — outreach and replies are sent from the mailboxes you connect (your SMTP/IMAP server, Gmail or Microsoft), never from Suppli's own domain
Your suppliers — Supplier API fetches use the credentials you give for that supplier's portal or API
ExchangeRate-API — daily USD exchange rates for WooCommerce stores that sell in another currency. Only the request for rates is made; no account data is sent. exchangerate-api.com/terms
Content delivery — Suppli's pages load scripts and fonts from cdn.tailwindcss.com, cdn.jsdelivr.net, unpkg.com and Google Fonts, which receive your browser's IP address when a page loads, as any website asset does

Dropshipping news in the assistant is read from public RSS feeds; nothing about you is sent to them.

6. Cookies¶

Suppli uses session and CSRF cookies only. These are strictly necessary for login, keeping you authenticated and protecting forms while you use the app. We do not use tracking cookies, analytics cookies, or third-party advertising cookies of any kind. There is no cookie banner because there is nothing to consent to beyond what is strictly necessary to run the service.

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) gives you the following rights:

Right of access — you can request a copy of all personal data we hold about you
Right to rectification — you can ask us to correct inaccurate or incomplete data
Right to erasure — you can ask us to delete your personal data ("right to be forgotten")
Right to restriction — you can ask us to restrict processing of your data
Right to data portability — you can request your data in a portable, machine-readable format
Right to object — you can object to processing based on legitimate interests

Our lawful basis for processing your data is performance of a contract — we need your data to provide the service you signed up for. To exercise any of these rights, contact us at muneeb@suppli.site. We will respond within 30 days. Note: data is stored on US servers (Railway). By creating an account you consent to this international transfer.

8. CCPA — California Residents¶

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following additional rights:

Right to know — you can request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
Right to delete — you can request deletion of personal information we have collected about you, subject to certain exceptions
Right to opt out of sale — we do not sell personal data to third parties. There is nothing to opt out of.
Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, email muneeb@suppli.site. We will respond within 45 days.

9. Children's Privacy (COPPA)¶

Suppli is not directed at children under the age of 13 and we do not knowingly collect personal information from anyone under 13. If we become aware that a user is under 13, we will immediately delete their account and all associated data. If you are a parent or guardian and believe your child has created a Suppli account, please contact us at muneeb@suppli.site and we will take immediate action.

10. Your rights¶

Regardless of your location, you have the right to access, correct, export, or delete your data at any time. To exercise these rights, contact us at muneeb@suppli.site. We will respond within 30 days.

11. Changes to this policy¶

We may update this Privacy Policy from time to time. We will notify active users of material changes by email. Continued use of Suppli after changes are posted constitutes your acceptance of the revised policy.

12. Contact¶

For privacy-related questions or data requests, email us at muneeb@suppli.site.