Privacy Policy
What we collect, why we hold it, and what you can make us do with it.
- Version
- 1.1
- Effective
Draft, pending legal review
This document is published in draft while it is reviewed by counsel. It is not yet binding and may change before the Launch Program opens. Questions: support@inspic.io.
This policy explains what personal data Inspic.io collects, why, how long we keep it, and the rights you have over it. It covers https://inspic.io and the Inspic.io dashboard at https://dash.inspic.io.
[LEGAL ENTITY NAME] is the data controller for that data. We are established in Egypt and process personal data under Law No. 151 of 2020 on the Protection of Personal Data. Where a user is in the European Economic Area or the United Kingdom, we also apply the GDPR standard described below.
1. What we collect
Four categories, and nothing outside them.
| Category | What it is | Where it comes from |
|---|---|---|
| Account data | Name, email address, password hash, workspace name, team members you invite, your role. | You, at signup and in Settings. |
| Seller verification evidence | Amazon Merchant Token, storefront name and URL, and, on the manual path only, a screenshot of your Seller Central account information page. | You, during verification. |
| Amazon seller data | Orders, inventory, advertising spend and account metadata for the Amazon selling account you connect. See section 3. | Amazon's Selling Partner API, with your authorisation. |
| Product usage | Pages viewed, searches and research requests you run, features used, API calls, IP address, browser and device type, and error diagnostics. | Automatically, as you use the product. |
We also keep what you send us directly: feedback submissions, support messages, and anything you write into the product such as watchlist notes or supplier records.
We do not collect payment card details. During the Launch Program no payment is taken at all, and when paid plans open, card data is handled by our payment processor and never reaches our servers.
2. Why we process it, and on what basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing the product, estimates, research, alerts, dashboards. | Account data, Amazon seller data, product usage. | Performance of our contract with you. |
| Verifying that you sell on amazon.eg before granting access. | Seller verification evidence. | Performance of our contract, and our legitimate interest in the integrity of the data set. |
| Keeping the service secure, abuse detection, rate limiting, audit logs. | Product usage, account data. | Legitimate interest in protecting the service and its users. |
| Improving the product, including the monthly feedback the Launch Program asks for. | Feedback, product usage. | Legitimate interest, and consent where the feedback is voluntary. |
| Sending service email, verification, invoices, alerts you configured. | Account data. | Performance of our contract. |
| Sending product news and marketing. | Account data. | Consent. Every such message carries an unsubscribe link, and unsubscribing does not affect your account. |
| Meeting accounting and tax obligations. | Account data, invoices. | Legal obligation. |
3. Amazon seller data
If you connect an Amazon selling account, we retrieve data about that account through Amazon's Selling Partner API. This is the most sensitive data we hold and it is subject to specific commitments, which we make here and keep in the code.
- Authorisation is yours to give and yours to withdraw. Disconnecting the account in Settings, or revoking our access in Seller Central, stops all further retrieval immediately.
- The credential that lets us retrieve your data is encrypted with AES-GCM before it is written to the database, and is decrypted only inside the single background process that calls Amazon. No part of the web application can read it back.
- Personally identifiable information belonging to your customers, buyer names, shipping addresses, phone numbers, is not retained. Where it appears in an Amazon response it is discarded during processing and never written to durable storage. Order records we keep are aggregate and item-level, not buyer-level.
- Your Amazon seller data is used to serve you, inside your workspace. It is never sold, never shared with another workspace, and never used to build a product for anyone else.
- Aggregated market statistics we publish across the platform, category-level sales estimates, price ranges, keyword volumes, are derived from publicly visible marketplace pages, not from any connected seller account.
- Access to production systems is limited to named staff, requires individual credentials, and is logged.
If we ever have to change one of these commitments, we will tell connected sellers by email before the change takes effect, not after.
5. International transfers
Some of the processors above operate outside Egypt. Where personal data is transferred across a border we rely on the transfer mechanisms available under Law 151 of 2020 and, for data subject to the GDPR, on Standard Contractual Clauses or an adequacy decision. You can ask us for details of the mechanism covering a specific transfer.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as the account exists, then 90 days, then deleted. |
| Verification screenshots | 90 days after the verification decision, then deleted. The decision itself is kept as a record. |
| Amazon seller data | While the account is connected, and 30 days after disconnection. |
| Research requests and their results | For as long as the account exists. You can delete any request yourself. |
| Feedback submissions | Retained after account closure in a form not linked to you, because it informs the product. |
| Invoices and accounting records | Five years, or longer where tax law requires. |
| Security and audit logs | 12 months. |
7. Security
- All traffic is encrypted in transit with TLS.
- Passwords are stored as salted hashes, never in a recoverable form.
- Amazon credentials are encrypted at rest with a key held only by the process that needs it.
- Every workspace's data is isolated at the database level by row-level security, enforced by the database rather than by application code. A bug in our code cannot return another workspace's rows.
- Administrative actions against a workspace are recorded in an audit log with the staff member responsible.
No system is perfectly secure. If a breach affects your personal data we will notify you and the competent authority within the timeframes the law sets, and we will tell you what was affected rather than describing it vaguely.
8. Your rights
Under Law 151 of 2020, and under the GDPR where it applies to you, you may:
- Ask what personal data we hold about you and get a copy of it.
- Have inaccurate data corrected.
- Have your data erased, subject to records we must keep by law.
- Object to processing we carry out on the basis of legitimate interest.
- Ask us to restrict processing while a dispute is resolved.
- Receive the data you gave us in a portable, machine-readable format.
- Withdraw consent at any time, where consent is the basis we rely on.
- Complain to the Egyptian Personal Data Protection Centre, or to your local supervisory authority.
Write to privacy@inspic.io. We answer within 30 days. We will not charge you for a request, and we will not make you justify it.
9. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.
10. Changes to this policy
When we change this policy we bump its version and update the effective date at the top of this page. For a change that materially affects your rights we will email you before it takes effect and ask you to accept the new version when you next sign in. We keep a record of which version you accepted and when.
11. Contact
[LEGAL ENTITY NAME], [REGISTERED ADDRESS, CAIRO, EGYPT]. Data protection enquiries: privacy@inspic.io. Everything else: support@inspic.io.