Privacy Policy - FlowCart

Last updated: August 1, 2026

1. Information We Collect

We collect information that you provide directly to us when you register for an account, create or modify your profile, set preferences, or make purchases. This information may include your name, email address, phone number, billing information, and product information.

We also automatically collect certain information when you visit our site, such as your IP address, browser type, operating system, referring URLs, access times, and pages viewed.

2. Amazon Seller Data

When you connect your Amazon seller account to FlowCart, we access data through Amazon's Selling Partner API (SP-API). This section describes how we handle Amazon seller data in compliance with Amazon's Data Protection Policy (DPP).

Data we access:

Order data (order IDs, order status, item details, delivery dates) for review campaign targeting and analytics;
Financial events (transactions, fees, settlements) for profit analytics;
Catalog information (product titles, ASINs, categories) for listing optimization;
Messaging and solicitation capabilities for buyer communication features (delivered through Amazon's APIs without exposing buyer contact details to FlowCart);
Seller account information (marketplace participations, performance metrics) for dashboard and analytics.

Buyer personal information:

FlowCart does not collect buyer personal information. We do not request, receive, or store Amazon buyer names, email addresses, or shipping addresses. We do not request Restricted Data Token (RDT) / restricted PII roles, and we do not call createRestrictedDataToken. Review requests are sent through Amazon's Solicitations API, which delivers the message on Amazon's side without exposing buyer contact details to us.

Data security:

All Amazon seller data is encrypted in transit (TLS 1.2+) and encrypted at rest;
Access to Amazon seller data is restricted to authorized personnel and systems required to provide FlowCart's services;
We maintain security logs for a minimum of 90 days;
We do not sell, rent, or share Amazon seller data with third parties for their own purposes.

Data retention and deletion:

Amazon seller data we store is limited to non-buyer-PII fields needed to provide FlowCart's services (for example order IDs, order status, item details, delivery dates, financial events, and catalog information);
When you disconnect your Amazon account or close your FlowCart account, we delete all stored Amazon seller data within 30 days;
You may request deletion of your Amazon seller data at any time by contacting support@flowcartapp.com.

Security incidents:

In the event of a security incident affecting Amazon seller data, we will notify Amazon within 24 hours of becoming aware of the incident, and we will notify affected users promptly in accordance with applicable laws and Amazon's Data Protection Policy.

2A. Amazon Ads Data

When you authorize FlowCart to access your Amazon advertising account through the Amazon Ads API (Login with Amazon OAuth), we access advertising data solely to provide Sponsored Products management and reporting for your authorized advertising profiles. This notice is provided in accordance with Amazon Ads Partner Network Policies §4.14.

Advertising data we may access:

Campaign, ad group, and keyword configuration and status for Sponsored Products;
Bids, budgets, and targeting settings you authorize FlowCart to read or update;
Performance reporting metrics (such as impressions, clicks, spend, and attributed sales) for the authorizing advertiser's own campaigns;
Advertising profile and account identifiers needed to scope access to your authorized profiles.

How we use advertising data:

We use Amazon Ads data only to operate FlowCart's advertising tooling for the authorizing advertiser — reporting, recommendations (including bid and negative-keyword suggestions grounded in the seller's own margin data where available), and gated write actions that require your explicit approval before any change is applied through the Amazon Ads API. We do not sell, rent, or share Amazon Ads data with third parties for their own purposes. We do not operate as a comparison shopping engine, demand-side platform, marketplace, or competitive ad network.

Authorization and deletion:

Access is granted only after you complete Amazon's authorization flow and can be revoked at any time from Amazon Ads / Login with Amazon;
We request only the minimum Ads data needed for Sponsored Products management and reporting for the authorizing advertiser;
When you disconnect advertising access or close your FlowCart account, we delete stored Amazon Ads data within 30 days, except where retention is legally required.

Data security and incidents:

Amazon Ads data is encrypted in transit (TLS 1.2+) and encrypted at rest;
OAuth access and refresh tokens are stored encrypted and are never written to application logs;
In the event of a security incident affecting Amazon Ads data, we will notify Amazon within 24 hours of becoming aware of the incident, and we will notify affected users promptly in accordance with applicable laws and Amazon's policies.

The Amazon Ads integration is in application and is not yet available for third-party seller OAuth. This section describes how FlowCart will handle Ads data once that access is approved and you authorize it.

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services, including automated review campaigns, profit analytics, listing optimization, buyer communication, and Amazon Ads / Sponsored Products management;
Process transactions and send related information;
Send technical notices, updates, security alerts, and support messages;
Respond to your comments, questions, and requests;
Develop new products and services;
Monitor and analyze trends, usage, and activities in connection with our services.

4. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described below:

With vendors, consultants, and service providers who need access to such information to perform services on our behalf;
In response to a legal request if we believe disclosure is required by law;
To protect the rights, property, and safety of FlowCart, our users, or others;
In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

5. Data Retention

We will retain your information for as long as your account is active or as needed to provide you services. We will also retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. For Amazon seller data and Amazon Ads data, see the specific retention and deletion commitments in Sections 2 and 2A above.

6. Your Rights

You may access, correct, or delete your personal information by contacting us. Note that we may retain certain information as required by law or for legitimate business purposes.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.