Data Processing

Purpose

We process Amazon information only to reconcile a seller’s FBA inventory and payments, prepare evidence, file and follow up on eligible reimbursement claims, and track the reimbursements and reversals that result. We do not use it for any other purpose, and we never use one seller’s data for another seller.

Access we use

• Selling Partner API, authorised by the seller, to read the FBA inventory, reimbursement, inbound, returns, removals, listings and fee reports the audit needs.
• Seller Central User Permissions, granted by the seller, to create, view and reply to Seller Support cases about FBA inventory and reimbursement discrepancies.
• Documents the seller sends us, such as invoices and proof of delivery, used as claim evidence.

Data minimisation

We request only the reports the reconciliation needs. We do not request Amazon’s restricted reports or buyer contact details: no buyer names, shipping addresses, phone numbers or email addresses. We do not gather Amazon customer, product or business information from non-Amazon sources.

Security controls

• Encryption in transit with TLS for every connection.
• Amazon authorisation tokens encrypted with AES-256-GCM before storage; databases and file storage encrypted at rest.
• Credentials kept in our hosting provider’s secret store, never in source code.
• Access limited to the people working a seller’s account; every record is scoped to the seller it belongs to.
• Request logs retained for monitoring and investigating suspicious activity.

Retention and deletion

Amazon information is kept only while it is needed to audit the account and to file, track and reconcile claims. When a seller disconnects, closes their account or asks us to, we delete their Amazon information and uploaded files within 30 days, keeping only the invoice and payment records that Indian tax law requires.

Sub-processors

We do not share seller information with other customers, partner companies or outside organisations. We use only these service providers, which process data on our instructions:

• Cloudflare: hosting, databases, file storage and logs.
• Clerk: sign-in and account management.
• Google Workspace: business email and scheduling.

Incident response

• Escalate to the incident lead and record the detection time.
• Contain: restrict affected systems and revoke compromised credentials and access.
• Preserve logs and evidence, assess which Amazon information is affected, and investigate the cause.
• Notify Amazon at security@amazon.com within 24 hours of detection, with the information available at the time.
• Fix the cause, validate recovery and monitor for recurrence.
• Notify affected sellers, and authorities where the law requires, and document corrective actions.

Organisational changes

We notify Amazon within 30 days of any organisational change, or any event that changes our need for or use of Amazon information, and update our Solution Provider Portal profile to match.

Contact

Security reports and data requests go to Madhav Vats at madhav@sellerreclaim.com. See also our Privacy Policy.