Privacy Policy

1. Introduction

Sellercharter ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information in compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL").

2. Data Residency (UAE PDPL Article 21)

All user personal data and operational logs are stored exclusively in Google Cloud Region me-central1 (Doha) in compliance with UAE PDPL Article 21 (Data Residency Requirements).

• Data Location: Google Cloud Platform (GCP) me-central1 region
• Physical Location: Doha (Qatar)
• Backup Location: Within UAE boundaries only
• Processing Location: Cloud Run services in me-central1

No personal data is transferred outside the UAE without explicit consent and contractual safeguards.

3. Data We Collect

3.1 Personal Data

We collect the following personal data when you create an account:

• Name: Your full name for account identification
• Email Address: Used for authentication, account recovery, and service notifications
• Encrypted Password: Stored using Firebase Authentication with bcrypt hashing (never stored in plain text)

3.2 Amazon Business Data

With your explicit consent, we access the following data via Amazon Selling Partner API (SP-API):

• Product Catalog Data: ASINs, titles, prices, sales rank
• Sales Metrics: Revenue, units sold, profit margins (aggregated, no buyer PII)
• Inventory Data: Stock levels, FBA/FBM fulfillment status

3.3 What We Do NOT Store

3.4 Technical Data

• Login Timestamps: Recorded for security and audit purposes
• IP Address: Captured during consent acceptance for audit trail
• User Agent: Browser and device information for security
• Session Cookies: __session cookie for authentication (HttpOnly, Secure)

4. How We Use Your Data

We process your data for the following purposes:

• Service Delivery: Provide product research, profit tracking, and analytics features
• Authentication: Manage user accounts and secure access
• Compliance: Maintain audit logs for PDPL Article 30 (Records of Processing)
• Support: Respond to customer inquiries and technical issues
• Service Improvement: Analyze aggregated usage patterns (no individual tracking)

Legal Basis (PDPL Article 9): Your explicit consent is required before we process any personal data. You can withdraw consent at any time by contacting privacy@sellercharter.com.

5. Third-Party Data Processors

We use the following third-party processors, all contractually bound to PDPL compliance:

6. Amazon Data Protection Policy (DPP) Compliance

We adhere to Amazon's Data Protection Policy (DPP). Any incidental Amazon PII (buyer personal information) accessed through Amazon SP-API is:

• Accessed only when necessary for service functionality
• Never stored in our databases
• Automatically deleted within 30 days
• Never shared with third parties
• Protected with encryption in transit (TLS 1.3)

For more information, see Amazon SP-API Data Protection Policy.

7. Data Security (UAE PDPL Article 25)

We implement industry-standard security measures to protect your data:

• Encryption in Transit: TLS 1.2+ for all network communications (TLS 1.3 negotiated when supported)
• Encryption at Rest: AES-256 for all database storage (Firestore and BigQuery)
• Password Security: bcrypt hashing with salts (Firebase Auth)
• Access Control: Role-based access control (RBAC) with multi-tenant isolation
• Audit Logging: Immutable consent logs and access logs (365-day retention)
• Regular Audits: Quarterly PDPL compliance reviews

8. Data Retention

We retain your data for the following periods:

• Account Data: Retained while your account is active
• Operational Logs: 365 days (BigQuery audit logs)
• Consent Records: 7 years (PDPL Article 30 compliance)
• Payment Records: 7 years (UAE tax law requirement)
• Deleted Accounts: All personal data deleted within 30 days of account deletion request

9. Your Rights Under UAE PDPL

Under UAE PDPL, you have the following rights:

To exercise these rights, contact us at:

10. Cookies

We use only essential cookies required for authentication:

• __session: HttpOnly session cookie for authentication (expires after 14 days)
• localStorage: Firebase Auth tokens (cleared on logout)

We do NOT use: Tracking cookies, advertising cookies, or third-party analytics cookies.

11. Children's Privacy

Sellercharter is not intended for individuals under 18 years of age. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a minor, contact us immediately at privacy@sellercharter.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be published on this page with an updated "Last Updated" date. Material changes will be notified via email 30 days in advance.

Consent Version Tracking: Your consent record includes the policy version you agreed to. If we make material changes, we will request new consent upon your next login.

13. Contact Us

For questions about this Privacy Policy or to exercise your PDPL rights: