Privacy Policy

1. Introduction

This Privacy Policy explains how Kenderson Tripaldi (sole proprietorship, VAT IT13063450012), whose registered address is Via Ettore Fico 7, 10090 Castiglione Torinese (TO), Italy (hereinafter "we", "us", "our"), collects, uses, stores, transfers, and protects personal data when you use MarginLock (the "Service") — a fulfillment management platform for Amazon FBA sellers.

This Policy complies with:

• Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by D.Lgs. 101/2018;
• The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) (Cal. Civ. Code §§ 1798.100–1798.199.100);
• Other applicable US state privacy laws where relevant.

By accessing or using the Service you acknowledge that you have read and understood this Policy. If you do not agree, you must discontinue use of the Service.

2. Data Controller

The Data Controller (as defined by the GDPR) is:

For all privacy-related requests — including the exercise of data subject rights — please contact us at the e-mail address above. We will respond within the timeframes required by applicable law (ordinarily 30 days under the GDPR; 45 days under the CCPA, with a possible one-time 45-day extension).

3. Data We Collect

4. Purposes and Legal Bases for Processing

We rely on the following legal bases under Article 6 GDPR:

Where we rely on legitimate interests (Art. 6(1)(f)), we have carried out a balancing test and concluded that our interests are not overridden by your rights, given the limited scope of the data and the technical safeguards in place. You may object to processing based on legitimate interests at any time (see Section 9).

5. How We Process Amazon SP-API Data

MarginLock operates as an Amazon Selling Partner application. When you authorise the connection:

• Amazon issues us an LWA (Login with Amazon) refresh token. We store this token encrypted at rest using AES-256-GCM with a key managed separately from the database (see Section 10). The token is decrypted only in memory for the duration of an API request and never logged.
• Short-lived access tokens (TTL: 1 hour) are obtained on demand and held only in server memory; they are never persisted.
• All catalog, shipment, and notification data retrieved from Amazon is stored exclusively within your merchant account in our database. Strict tenant isolation ensures that no data from your account is ever accessible to other merchants.
• We do not share, sell, or monetise your Amazon data in any way beyond what is necessary to provide the Service.
• You may disconnect your Amazon account at any time via Settings. Upon disconnection, your refresh token is immediately deleted from our database.

6. Data Retention

7. Sharing Your Data

We do not sell your personal data. We share data only with:

• Infrastructure providers: cloud hosting, database, and CDN services (e.g. Vercel, Supabase / cloud PostgreSQL). These act as Data Processors under Article 28 GDPR and are bound by data processing agreements. They process data only on our instructions.
• Amazon.com, Inc.: We send API requests to Amazon's SP-API on your behalf. Amazon's own privacy policy governs data held within Seller Central.
• Google LLC (analytics, if consented): Google Analytics 4 receives pseudonymised usage data with IP anonymisation enabled. Google may process this data in the United States (see Section 8).
• Law enforcement / legal process: We may disclose data when required by applicable law, court order, or governmental authority, or to protect our legal rights.

We require all third-party processors to implement appropriate technical and organisational security measures and to process personal data solely for specified, legitimate purposes.

8. International Data Transfers

We are based in the EU (Italy). Some of our service providers, including Google LLC and certain cloud infrastructure providers, process data in the United States or other third countries outside the European Economic Area (EEA).

We ensure that any transfer of personal data outside the EEA is subject to appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914), supplemented where necessary by a Transfer Impact Assessment;
• The EU–US Data Privacy Framework (where the recipient is certified).

You may request a copy of the applicable transfer safeguards by contacting us at privacy@marginlock.io.

9. Data Security, Anonymisation, and Pseudonymisation

We apply the following technical and organisational measures to protect your data:

Despite these measures, no transmission over the internet or storage system can be guaranteed to be 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours (Art. 33 GDPR) and, where required, notify affected individuals without undue delay (Art. 34 GDPR).

10. Your Rights Under the GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten", Art. 17): request deletion of your data, subject to our legal retention obligations.
• Right to restriction of processing (Art. 18): request that we restrict how we use your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format (applies to data processed on the basis of consent or contract).
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing purposes (if applicable).
• Right to withdraw consent (Art. 7(3)): withdraw any consent you have given at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Art. 22): we do not make solely automated decisions that produce legal or similarly significant effects.

To exercise any of these rights, contact us at privacy@marginlock.io. We may ask you to verify your identity before processing your request. We will respond within 30 days (with a possible 2-month extension for complex requests, with notice).

You also have the right to lodge a complaint with the competent supervisory authority. In Italy this is:

11. California Residents – CCPA / CPRA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, grants you the following rights. These rights are in addition to, and do not limit, your GDPR rights where both frameworks apply.

12. Cookies

We use the following types of cookies:

You can manage your cookie preferences at any time by clicking Cookie Settings in the application. Withdrawing analytics consent stops future cookie placement; it does not affect cookies already set before withdrawal.

For information about Google Analytics data practices, see Google's Privacy Policy.

13. Children's Privacy

The Service is directed to business users (Amazon sellers) and is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by e-mail or by posting a prominent notice within the Service at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects the date of the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact: