Privacy Policy
How Scalifo collects, uses, stores, protects, shares and deletes information in Sotrics, including data from Amazon accounts you authorize.
1. Who we are
This Privacy Policy explains how Scalifo LLC (“Scalifo”, “we”, “us”), a limited liability company registered in the Sharjah Media City Free Zone (Shams), United Arab Emirates at Sharjah Media City (Shams), Sharjah, United Arab Emirates, collects, uses, stores, protects, shares and deletes information through the Sotrics application (app.sotrics.com) and the website sotrics.com (together, the “Services”).
Scalifo operates the Services and is responsible for the personal information of website visitors and account users. For business data we retrieve from Amazon on a customer's behalf, we process it only to provide the Services to that customer, and in line with Amazon's policies for developers.
Privacy contact: privacy@sotrics.com.
2. Information we collect
Information you give us
- Account details: name, email address, company name, and a password stored only as a one-way hash (bcrypt).
- Team details: people you invite and the roles you give them.
- Data you enter: product costs, suppliers, purchase orders, research notes and similar information.
- Messages: what you send us through forms or email.
Information from Amazon, with authorization
When an account owner authorizes Sotrics, we retrieve the following through the Selling Partner API and, once available and with a separate authorization, the Amazon Ads API:
| Category | What Sotrics retrieves | Used for |
|---|---|---|
| Sales and traffic | Sales and traffic reports: units, sales, sessions, page views and conversion by product and date | Sales dashboards, trends and forecasts |
| Account | The marketplaces your seller account participates in | Connecting your account and choosing marketplaces |
| Orders (summary only) | All-orders report, used only to count orders and sales by ship-to state and country | Sales-by-region map. Buyer names, addresses, emails and phone numbers are not stored |
| Finances and fees | Financial events: settlements, Amazon fees, refunds, promotions and charges; estimated FBA fees | Profit & loss and fee analysis |
| Inventory | FBA and AWD inventory levels and inbound quantities | Inventory health, days of cover and restock planning |
| Catalog and listings | Your listings report and catalog details for your ASINs/SKUs, and public catalog details for competitor ASINs you choose to track | Product pages, product analytics, competitor tracking and research |
| Pricing | Competitive pricing summaries for your products | Price and competitor tracking |
| Returns and reimbursements | FBA returns (including the return reason and any free-text comment the buyer left) and reimbursement reports, with Amazon order IDs | Returns analysis and reimbursement tracking |
| Customer feedback | Review topics summaries for your products | Product improvement insights |
| Brand Analytics | Search Query Performance, Search Catalog Performance, Repeat Purchase and Market Basket reports (brand owners only) | Search and brand insights |
| Advertising (Amazon Ads API, separate authorization) | Advertising profiles, campaigns, ad groups, keywords, targets, search terms and performance reports (read-only) | PPC analytics (beta) |
We store the Amazon authorization (refresh token and related credentials) encrypted. We never receive Amazon passwords.
Buyer information: Sotrics does not request Amazon's restricted roles for buyer names, addresses, emails or phone numbers, and does not store them. The returns report we retrieve includes Amazon order IDs and the free-text comment a buyer may leave when returning an item; we use these only for returns analysis for the seller concerned and delete them as described in section 7.
Information collected automatically
- Server logs: IP address, browser type, pages requested, time and errors, used for security and troubleshooting.
- Cookies: only those needed to sign in and keep the Services secure. See our Cookie Policy. We do not use advertising trackers. On our public website (sotrics.com) only, we use Google Analytics to measure visits, with consent where the law requires it; the Sotrics app does not use analytics trackers.
3. How we use information
- To provide Sotrics: dashboards, profit and loss, advertising analytics, inventory and research for the account that authorized us.
- To secure, operate, troubleshoot and improve the Services.
- To communicate with you about your account, support requests and important changes.
- To meet legal obligations and enforce our terms.
What we do not do with Amazon data:
- Sell, rent or license it.
- Share one customer's data with another customer.
- Use it for advertising, or to build profiles of buyers.
- Use it for any purpose other than providing Sotrics to the seller who authorized it.
4. Legal bases (where laws such as the GDPR apply)
- Contract: to provide the Services you signed up for.
- Legitimate interests: to secure and improve the Services and answer enquiries.
- Consent: where you authorize an Amazon connection, or where the law requires consent. You can withdraw it at any time.
- Legal obligation: to keep records the law requires.
5. Service providers and sharing
We share information only with providers that help us run the Services, and only as needed for that purpose:
| Provider | Purpose |
|---|---|
| DigitalOcean (App Platform and managed PostgreSQL database), Bangalore data centre (BLR1), India | Hosting the Sotrics application and its database |
| Hostinger | Hosting sotrics.com and scalifo.com, website forms and business email |
| Resend | Sending account emails such as invitations and alerts |
| Google (Analytics) | Visit statistics for sotrics.com only, with advertising features turned off (see our Cookie Policy) |
| Google Fonts | Website fonts (your browser connects to Google and shares your IP address) |
| Amazon | We send API requests to Amazon to retrieve the data you authorized |
We may also disclose information if the law requires it, to protect rights and safety, or as part of a merger or acquisition, in which case this policy continues to apply. We do not sell personal information.
6. Where information is stored
The Sotrics database is hosted with DigitalOcean (App Platform and managed PostgreSQL database), Bangalore data centre (BLR1), India. Because our company is in the UAE and our customers are mainly in the United States, Canada and Europe, information may be processed outside your country. Where the law requires, we use appropriate safeguards for these transfers.
7. How long we keep information
| Information | How long |
|---|---|
| Data retrieved from a seller account | While the account is connected. When you disconnect, the authorization, the reports synced from that account and the records built from them (competitor tracking, alerts and Amazon-detected product change history) are deleted from our database straight away. |
| Advertising data | Sotrics does not hold advertising data yet. Once the Amazon Ads connection is available: while it is active, and deleted straight away when you disconnect it. |
| Buyer return comments and Amazon order IDs | 90 days after the return date, then removed automatically. Return counts, reasons and amounts stay for your reports. |
| Your Sotrics account and the data you entered | For the life of your account. Deleted within 30 days after you ask us to close it, except records the law requires us to keep. |
| Messages and access requests | Up to 24 months after our last contact, unless you become a customer. |
| Backups | Our database provider keeps automatic backups for a limited period. Deleted data disappears from backups as they expire, within 30 days. |
8. How we protect information
Our safeguards include encrypted connections (TLS) for all traffic, verified encrypted connections to our database, encryption of Amazon tokens and secrets before storage (AES-256-GCM), server-side checks that each user can access only their own organization's data, hashed passwords with a 10-character minimum, rate limiting on sign-in, optional two-factor sign-in for customers, and required multi-factor authentication for our administrators. More detail is on our Data Security page.
If a security incident affects Amazon information, we will notify Amazon within 24 hours of detecting it, and we will notify affected customers without undue delay.
9. Your rights and choices
Depending on where you live, laws such as the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Canada's PIPEDA or the UAE's Personal Data Protection Law may give you the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. We will honour these requests from any customer where we reasonably can.
To make a request, email privacy@sotrics.com or use the data request form. We reply within 30 days and may need to verify your identity. We do not sell or “share” personal information for cross-context advertising, and we will not treat you differently for using your rights.
10. Children
The Services are for businesses and are not directed to anyone under 18.
11. Changes to this policy
We will post changes here and update the date above. For material changes, we will notify customers by email or in the app before they take effect.
12. Contact us
Scalifo LLC
Sharjah Media City (Shams), Sharjah, United Arab Emirates
Privacy: privacy@sotrics.com
Security: security@sotrics.com