Privacy Policy

1. Who we are

FollowUpStock is an inventory and fulfillment management platform built for prep centers and the Amazon sellers they serve. It is currently operated by Martín Zárate as an individual, doing business as "FollowUpStock", pending incorporation of a formal legal entity.

2. Scope of this policy

This Privacy Policy applies to everyone who uses the Service: prep center staff and the Amazon sellers ("clients") they work with. It does not apply to Amazon's own systems, or to any other website you may reach through a link on this Service.

3. Information we collect

• Account information: your name and email address, and your password — never stored in plain text, handled entirely by our authentication provider.
• Two-factor authentication: if you enable it, a TOTP factor is managed by our authentication provider; we never see or store the underlying secret.
• Business information you provide: your organization's or client's name and the basic business details you enter into the platform.
• Operational data you create: work orders, inventory records, lot and expiration dates, evidence photos, and shipping labels you upload.
• Amazon Seller Central data, only if you choose to connect it (see Section 4 below).
• Technical data: the IP address and browser user-agent your device normally sends, and an audit log of sensitive actions taken on your account.

4. Your Amazon Seller Central data

If you choose to connect your Amazon Seller Central account, you authorize us through Amazon's standard OAuth (Login with Amazon) flow — we never see or store your Seller Central password.

Amazon issues us a refresh token so we can act on your behalf. This token is encrypted and stored in a dedicated secrets vault, never in a plain database table, and is used only to request a short-lived access token when a sync you triggered needs one.

Through Amazon's Selling Partner API (SP-API) we request read-only access to: your FBA inventory levels, your order status and line items (SKU and quantity), and aggregated historical sales figures.

We do not request or access your buyers' personal information — names, shipping addresses, or tax identifiers require a separate Restricted Data Token, which this integration does not use.

You can disconnect your Amazon account at any time from the Amazon integration screen. Disconnecting immediately and permanently deletes all data synced through that connection (inventory snapshots, orders, sales history, and any Amazon-issued identifiers) from our systems — we only keep a record that the connection existed and was revoked, for audit purposes.

5. How we use your information

• To operate the Service: manage work orders, inventory, receiving, and fulfillment workflows.
• To sync with Amazon on your behalf, only while a connection you authorized is active.
• To generate the alerts, reports, and dashboards you request.
• To secure your account and investigate suspicious activity.
• To comply with legal obligations.

6. Who we share information with

We do not sell your information to anyone. We only share it with:

• Amazon, through the SP-API, limited to what you authorize via OAuth.
• Other users within your own organization or client relationship on the platform — the platform's multi-tenant design lets a prep center's staff see the data of the clients they serve, but one client can never see another client's data.
• The infrastructure providers that host our database, authentication, and file storage, under their own confidentiality and security commitments.

7. How we protect your information

• All traffic to the Service is encrypted in transit (HTTPS/TLS).
• Your Amazon refresh token is never stored in plain text — it's encrypted in a dedicated secrets vault, separate from our regular database tables.
• Data is isolated per organization and client at the database level, enforced on every request, not just in the application layer.
• Optional two-factor authentication (TOTP) is available on every account, and can be required organization-wide.
• Sensitive actions are recorded in an audit log.
• We monitor our software dependencies for known vulnerabilities on an ongoing basis.

8. Data retention and deletion

We retain your information for as long as your account is active.

If you revoke your Amazon connection, all data synced through that connection is deleted immediately, as described in Section 4.

If you want your account and its associated data deleted entirely, contact us at the email below and we will process your request.

9. Your rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, and to object to certain uses of it. You can exercise most of these rights directly from your account settings, or by contacting us.

10. Cookies

We use a single, strictly necessary cookie to keep you signed in. We do not use advertising or third-party analytics cookies.

11. Children's privacy

The Service is intended for business use by prep center operators and Amazon sellers, and is not directed at children.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the last update.

13. Contact us

If you have any questions about this Privacy Policy, or want to exercise your data rights, contact us at: