Privacy Policy

Effective Date & Last Updated: November 8, 2026

Pinery (“we”, “our”, or “the Application”) values the privacy and confidentiality of Amazon merchants and brand owners. This Privacy Policy describes how Pinery collects, processes, protects, and handles information accessed through Amazon Selling Partner API (SP-API) and Amazon Advertising API.

1. Local-First Architecture & Data Ownership

Unlike conventional multi-tenant cloud ERP software that centralizes confidential financial and commercial data on remote third-party servers, Pinery is built upon a Local-First architecture:

• Confidential Business Data Remains in Your Custody: All sales orders, Cost of Goods Sold (COGS), supplier information, freight rates, inventory levels, and computed profit margins are stored exclusively in the merchant’s isolated private database (SQLite instance: panel.db).
• No Centralized Data Scraping: We do not operate central data warehousing servers that harvest, inspect, or aggregate merchant catalog or financial data.

2. Amazon Selling Partner API (SP-API) Integration

When you connect your Amazon selling account to Pinery:

• Direct communication occurs strictly between your authorized environment and Amazon’s official API endpoints using industry-standard TLS 1.3 encryption.
• Login with Amazon (LWA) credentials and OAuth tokens (Refresh Tokens) are encrypted at rest using AES-256 in your local configuration.
• Tokens are utilized strictly within the scope of permissions granted during the Amazon OAuth consent workflow.

3. Buyer Personally Identifiable Information (PII) Protection

Pinery strictly abides by Amazon’s Data Protection Policy (DPP) and Restricted SP-API Data guidelines:

• The application does not request, retrieve, process, or store any buyer Personally Identifiable Information (PII), such as customer names, residential addresses, phone numbers, or personal emails.
• Product review requests operate exclusively via Amazon’s official Solicitations API (“Request a Review” protocol). Standard Amazon-formatted emails are generated and dispatched directly by Amazon’s infrastructure without revealing buyer contact details.

4. Amazon Brand Analytics (ABA) Data Usage & Protection Policy

For merchants enrolled in Amazon Brand Registry who grant access to the Brand Analytics role, Pinery implements comprehensive protections in compliance with Amazon’s Acceptable Use Policy (AUP):

• Service Exclusively for Verified Brand Owners: Brand Analytics capabilities are offered strictly to merchants verified as Brand Owners under Amazon Brand Registry (or their authorized agents) for their registered brand trademarks.
• Authorized Use on Behalf of Brand Owners: The application retrieves Brand Analytics reports (including Search Query Performance, Top Search Terms, Click/Conversion Share, Repeat Purchase Behavior, and Market Basket Analysis) exclusively on behalf of the authorizing Brand Owner. This data is utilized solely to assist that specific Brand Owner in benchmarking keyword rankings, optimizing ASIN catalog content, analyzing conversion velocity, and informing advertising bid allocations.
• Strict Tenant Isolation & Prohibition of Data Pooling (No Cross-Seller Pooling): Brand Analytics data is isolated strictly to the authorized merchant’s private database. We strictly enforce a zero-pooling policy: Brand Analytics metrics are NEVER aggregated, combined, cross-referenced, or benchmarked across multiple merchants, accounts, or competing brands.
• No Commercial Resale or Competing Products: We never sell, rent, lease, sublicense, transfer, or disclose raw or derived Brand Analytics data to any third-party broker, market research firm, or competitor. Data is never used to develop competing private label goods.
• Immediate Deletion Upon Disconnection: When a merchant disconnects a store or revokes authorization, all cached Brand Analytics tables and report files are permanently and irreversibly purged from local storage.

5. Security Standards & Vulnerability Management

Pinery maintains rigorous security practices:

• Access controls with salted password hashing (PBKDF2/bcrypt) for administrative console accounts.
• Enforced HTTPS/TLS encryption across all network boundaries, equipped with HSTS and security response headers (X-Robots-Tag, X-Frame-Options, X-Content-Type-Options).
• Automated vulnerability scanning against zero runtime npm dependency architecture.

6. Merchant Rights & Contact Information

Merchants maintain absolute ownership of their data and may audit, export, or delete their database at any time. For questions regarding this Privacy Policy or SP-API data practices, contact us at:

Email: [email protected]
Developer Entity: Pinery Software Solutions