Privacy Policy

1. Introduction

Suppli ("we", "our", "us"), operated by AUKSales LLC, is committed to protecting your privacy. This policy explains what data we collect, how we use it, how long we keep it, and your rights regarding that data. By using Suppli, you agree to the practices described here.

2. Data we collect

We collect the following categories of data:

• Email address — used to identify your account and send transactional emails
• IMAP credentials — mailbox settings used to retrieve supplier feed emails, stored encrypted in our database and never shared with third parties
• API credentials — tokens for Shopify, eBay, Walmart, Amazon, and other connected channels, stored encrypted and used solely to perform the integrations you configure
• Sync logs — records of each inventory sync run including timestamps, SKU counts, quantities, and error messages
• Feed files — CSV files received from your suppliers and processed by Suppli
• Usage analytics — anonymous page views and feature usage for improving the product (no third-party tracking, no advertising)

3. How we use your data

• Providing and operating the Suppli inventory sync service
• Sending alert emails when inventory thresholds are breached or errors occur
• Displaying sync history and error logs on your dashboard
• Processing payments via Stripe
• Improving the reliability and performance of the service

We do not sell your data to third parties. We do not use your data for advertising purposes.

4. Data storage & retention

Your data is stored on Railway infrastructure (US servers) using PostgreSQL databases. Data is retained for as long as your account remains active. If you close your account, we will delete your personal data within 30 days of the request, except where we are legally required to retain it (e.g. payment records). We perform regular backups but cannot guarantee recovery in all failure scenarios.

5. Third-party services we use

Suppli uses the following third-party services, each with their own privacy policy:

• Stripe — payment processing. Your card details go directly to Stripe and are never stored on Suppli servers. Stripe is PCI-DSS compliant. stripe.com/privacy
• Railway — cloud hosting and database. All application data is stored on Railway's US infrastructure. railway.app/legal/privacy
• Resend — transactional email delivery (alert emails, sync notifications). resend.com/privacy
• Anthropic — optional AI features within the Workflow engine. Only used if you enable AI actions and provide your own Anthropic API key; no data is sent to Anthropic without your explicit configuration. anthropic.com/privacy
• Shopify, eBay, Walmart, Amazon — connected via your own API credentials to perform inventory updates you configure. No data is sent to these platforms beyond what is required for the sync actions you initiate.
• Etsy — connected via your own API credentials to perform inventory updates you configure. No data is sent to Etsy beyond what is required for the sync actions you initiate. etsy.com/legal/privacy

6. Cookies

Suppli uses session cookies only. These are strictly necessary for login and keeping you authenticated while you use the app. We do not use tracking cookies, analytics cookies, or third-party advertising cookies of any kind. There is no cookie banner because there is nothing to consent to beyond what is strictly necessary to run the service.

7. GDPR — EU & UK Users

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) gives you the following rights:

• Right of access — you can request a copy of all personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your personal data ("right to be forgotten")
• Right to restriction — you can ask us to restrict processing of your data
• Right to data portability — you can request your data in a portable, machine-readable format
• Right to object — you can object to processing based on legitimate interests

Our lawful basis for processing your data is performance of a contract — we need your data to provide the service you signed up for. To exercise any of these rights, contact us at muneeb@suppli.site. We will respond within 30 days. Note: data is stored on US servers (Railway). By creating an account you consent to this international transfer.

8. CCPA — California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following additional rights:

• Right to know — you can request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to delete — you can request deletion of personal information we have collected about you, subject to certain exceptions
• Right to opt out of sale — we do not sell personal data to third parties. There is nothing to opt out of.
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, email muneeb@suppli.site. We will respond within 45 days.

9. Children's Privacy (COPPA)

Suppli is not directed at children under the age of 13 and we do not knowingly collect personal information from anyone under 13. If we become aware that a user is under 13, we will immediately delete their account and all associated data. If you are a parent or guardian and believe your child has created a Suppli account, please contact us at muneeb@suppli.site and we will take immediate action.

10. Your rights

Regardless of your location, you have the right to access, correct, export, or delete your data at any time. To exercise these rights, contact us at muneeb@suppli.site. We will respond within 30 days.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify active users of material changes by email. Continued use of Suppli after changes are posted constitutes your acceptance of the revised policy.

12. Contact

For privacy-related questions or data requests, email us at muneeb@suppli.site.