This Privacy Policy describes how StackCore, operated by QBIT Commerce Inc. (“StackCore,” “we,” “us,” or “our”), collects, uses, stores, and protects information when you use the StackCore application and related services (the “Service”). StackCore is a third-party application that connects to the Amazon Selling Partner API (“SP-API”) with your authorization. By using the Service, you agree to the practices described in this Privacy Policy.
1. Information We Collect
1.1 Information you provide to us
- Account information: name, email address, password, company name, and billing details when you create a StackCore account.
- Support communications: information you provide when you contact us for support.
1.2 Information received from Amazon (Amazon Information)
When you authorize StackCore to access your Amazon Selling Partner account, we receive data from Amazon through the SP-API (“Amazon Information”). Depending on the permissions you grant, this may include order and shipment data, listing and catalog data, inventory levels, financial and settlement reports, and — where a permitted use case requires it — Personally Identifiable Information (“PII”) of your buyers, such as buyer name, shipping address, and contact details.
We access Amazon Information solely through authorized SP-API credentials that you grant and that you may revoke at any time in Amazon Seller Central.
1.3 Information collected automatically
- Usage and log data: IP address, browser type, pages viewed, and timestamps, collected for security, debugging, and service improvement.
- Cookies: we use strictly necessary cookies to keep you signed in and to secure the Service. We do not use Amazon Information for advertising or tracking of any kind.
2. How We Use Information
We use information only to:
- provide, operate, and maintain the Service you have requested;
- perform the specific functions you have authorized through the SP-API (for example, retrieving orders, managing listings, or generating reports);
- fulfill orders, process returns, and calculate taxes where you use those features;
- provide customer support and respond to your requests;
- maintain the security and integrity of the Service; and
- comply with applicable law.
We do not use Amazon Information for advertising, marketing, or profiling; we do not sell, rent, or trade Amazon Information or any personal information; and we do not use Amazon Information to contact buyers outside of purposes you have expressly authorized and Amazon permits.
3. Data Retention
- Buyer PII received from Amazon is retained only as long as necessary to fulfill the authorized purpose and in no event longer than 30 days after order delivery, except where longer retention is required by law (for example, tax or accounting obligations) or is necessary to fulfill orders, calculate taxes, or process returns. Any PII retained under a legal exception is stored as a “cold” or archival copy, is not used for any other purpose, and is protected with the safeguards described in Section 5.
- Non-PII Amazon Information (such as aggregated sales metrics) is retained while your account remains active and is deleted or anonymized when no longer needed.
- Account information is retained for as long as you maintain a StackCore account and deleted within 90 days of account closure, except as required by law.
When retention periods end, data is securely and permanently deleted or rendered irrecoverable in accordance with industry-standard sanitization practices.
4. How We Share Information
We share information only with:
- Service providers (subprocessors) — such as cloud hosting providers — who process data solely on our instructions, only as needed to operate the Service, and who are bound by written agreements imposing confidentiality and data protection obligations at least as protective as this Privacy Policy and Amazon’s Data Protection Policy;
- legal authorities, where required by law, court order, or valid legal process; and
- a successor entity in connection with a merger or acquisition, provided the successor is bound by obligations at least as protective as those in this Privacy Policy. Amazon Information is never transferred in a manner inconsistent with Amazon’s policies.
We never disclose Amazon Information to third parties for their own marketing or commercial purposes.
5. Data Security
We maintain administrative, technical, and physical safeguards designed to protect information, aligned with Amazon’s Data Protection Policy, including:
- encryption of data in transit using TLS 1.2 or higher, and encryption of PII at rest using AES-128 or stronger;
- least-privilege access controls: access to Amazon Information is restricted to personnel who need it to operate the Service, is protected by unique credentials and multi-factor authentication, and is reviewed regularly;
- network protections including firewalls and segregation of systems that store PII from public networks;
- logging and monitoring of access to systems that process Amazon Information, with logs retained for security review;
- secure development practices, vulnerability management, and periodic risk assessments; and
- a documented incident response plan. If we detect a security incident affecting Amazon Information, we will notify Amazon promptly (within 24 hours at security@amazon.com) and cooperate fully, and we will notify affected users and regulators as required by applicable law.
SP-API credentials and tokens are stored encrypted, are never embedded in client-side code, and are rotated or revoked when personnel change or when no longer required.
6. Your Rights and Choices
- Access, correction, deletion: you may request access to, correction of, or deletion of your personal information by contacting us at info@stackcore.app. We honor verified requests within the timelines required by applicable law (including, where applicable, Canada’s PIPEDA, the GDPR, and the CCPA/CPRA).
- Revoking Amazon access: you may revoke StackCore’s access to your Amazon account at any time in Amazon Seller Central (Settings → User Permissions → Third-party developer and apps). Upon revocation or account deletion, we delete Amazon Information in our possession within 30 days, except where retention is required by law.
- Buyer requests: where we process buyer PII on your behalf, we will assist you in responding to buyer privacy requests relating to that data.
7. International Data Transfers
We store and process data in Canada and the United States. Where data is transferred across borders, we use lawful transfer mechanisms (such as Standard Contractual Clauses, where applicable) and apply the same protections described in this Privacy Policy regardless of where the data is processed.
8. Children’s Privacy
The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised effective date and, for material changes, notify you by email or in-app notice before the changes take effect.
10. Contact Us
QBIT Commerce Inc.
724 Caledonia Rd
North York, ON M6B 3X7, Canada
Email: info@stackcore.app
See also our Terms of Use.