Privacy Policy
Version 1.2, 26 Oct 2026
Effective date: 27 October 2026. Last materially changed: 26 October 2026. Who we are: Sloan Software LLC, a Delaware limited liability company trading as Box Boss Repricer, operated from Sheffield, England. Contact: privacy@boxbossrepricer.com; post: 8 The Green, Ste B, Dover, DE 19901.
1. The short version
- We run a repricing service for Amazon sellers. Our customers are businesses.
- We hold account data about the people who sign up (name, business, email, login, billing status) and Amazon data that our customers authorize us to fetch to run the service (their listings, prices, offers, orders, costs).
- For Amazon data we act on the customer's instructions only (as a "service provider" or "processor"). We never pool customers' data, never use it to set another customer's price, and never use it to train a model. Our own founder sells on Amazon; customer data never informs our own selling or pricing, and the founder's selling account is kept on a separate system.
- We do not sell or share personal information, and we use no advertising trackers on the product.
- We do not ask Amazon for buyer names, addresses or contact details, and the order reports we read do not carry them.
- You can ask what we hold, correct it, or have it deleted, by emailing privacy@boxbossrepricer.com.
2. What we collect, why, and for how long
| Data | Source | Why (purpose) | Kept for |
|---|---|---|---|
| Account data: name, business name, email, password hash, two-step login secret (if you turn it on), timezone | You, at sign-up and in settings | To create and secure your account, to contact you about the service, billing and these policies | While the account exists, then 30 days |
| Billing data: plan, invoices, payment status, last 4 digits of the card, billing address, sales-tax state | You and Stripe at checkout | To charge you, send renewal reminders, collect sales tax where required, keep tax records | 7 years (tax records) |
| Usage and security logs: IP address, browser, pages used, login events, who accessed which account and when | Your browser and our systems | To keep the service secure, support you, and show you the access log for your account (Terms §8) | 13 months (395 days) |
| Support messages: emails and the contact forms | You | To answer you | 2 years |
| Website chat: what you type to the assistant on our site, under a random session id (your IP address is used only in memory) | You | To answer you; Anthropic provides the assistant | 30 days |
| Amazon data fetched with your authorization: listings, SKUs, prices, offers and Buy Box status on your listings, inventory, fees, shipments, orders and listing images | Amazon's Selling Partner API | To compute and send prices, to compute your costs and floors, to keep our internal price record (audit, support and compliance; not shown in your account) | Market observations up to 90 days (the detail emptied after 14 days); working pricing decisions 35 days; each price sent and the rule that chose it 12 months; your daily profit and sales totals while you subscribe, so your dashboard keeps its history; everything deleted 30 days after your account closes |
| Your cost files (spreadsheets you upload or import) | You | To set your costs and floors; a language model may be used to map your columns, on your rows only | While the account exists, then 30 days |
| Website visitors: IP address, pages, referrer (no advertising trackers) | Your browser | To run the site and count visits | 12 months, aggregated |
| Free-trial record: a one-way, keyed fingerprint derived from your Amazon seller ID (we do not keep the seller ID itself in this record) and the date your free trial was used | Amazon, when you link your account | To give each Amazon selling account one free trial only: the fingerprint lets us recognize an account that has already had its trial | Kept after your account closes and your other data is deleted, for as long as we offer free trials. The record holds only the fingerprint, our internal account number for you, and the date and time your free trial started |
| Onboarding-call bookings and Amazon links before a trial: booking details, the Amazon authorization token | You, Calendly, Amazon | To hold your place and walk through your own listings on the onboarding call | A booking never linked: 30 days; a linked account that never starts a trial: the token is deleted after 14 days and you are asked to remove the app in Seller Central |
We collect no sensitive personal information (as defined in the California law) and no data about children.
Emails from us. We email you about your account, trial, billing and security; those are part of the service. Rarely, and only when it matters (for example when places are running out), we may email you Box Boss news. Every such email has a one-click unsubscribe, and unsubscribing never affects account emails. You can say no when you sign up, or any time from your Profile. We never email people who have not signed up or asked us to.
3. Buyer information in Amazon orders
The repricer needs no buyer's personal data, so we do not request Amazon's restricted buyer data. Where an Amazon report carries a buyer's ZIP code we keep only its first three digits. If buyer personal data ever reaches us, we use it for nothing and delete it no later than 30 days after the order is delivered. Buyers who want to exercise their rights should contact the seller they bought from or Amazon; if a seller asks us to help with a buyer's request, we do.
4. Who we share data with (our sub-processors)
We share personal information only with the providers below, under contracts that limit them to providing their service to us. The current list is also in the Data Processing Addendum and we give customers 30 days' notice of changes.
| Provider | What | Where |
|---|---|---|
| DigitalOcean | Runs the service; each customer's data in its own database and process | US (New York or San Francisco region) |
| Amazon Web Services | Message queue and backups | US |
| Stripe | Payments, invoices, sales tax | US |
| Cloudflare | Security and traffic filtering in front of the site; inbound routing of email sent to our addresses (the message passes through Cloudflare on its way to us) | Global edge |
| Google (Gmail) | The mailbox where email sent to our addresses is received, read and answered | US |
| Anthropic | The help assistant and the mapping of your uploaded cost files; only the text you send and the rows you upload, never Amazon-fetched data | US |
| Resend | Sending our email: transactional email (receipts, reminders, trial and account emails) and our replies to you | US |
| Telegram | Our operator's control room: support messages you send us, with your name and email, are shown to our founder there so he can approve each reply; nothing about your prices or Amazon data beyond what you wrote and, when you press Disagree, that SKU | Global |
| Calendly | Booking the onboarding call: your name, email and business name | US |
We also disclose data when the law requires it, to Amazon where its developer agreement requires it (for example an audit of our data handling), and to a successor if the business is sold, under this policy.
We do not sell personal information and do not share it for cross-context behavioral advertising. There is nothing to opt out of, so there is no "Do Not Sell or Share" link.
5. Security
Encrypted connections; encrypted storage of Amazon credentials and tokens; two-step login offered and strongly recommended on every customer login, and required on every staff login; a web application firewall; one database and one process per customer; access logging; tested backups; a written incident plan. If we discover a security incident affecting your data we will tell you without undue delay and, where Amazon data is involved, tell Amazon within 24 hours as its policy requires.
6. Your rights
Whatever state or country you are in, you can email privacy@boxbossrepricer.com to:
- know what personal information we hold about you and get a copy;
- correct it;
- delete it (we will, unless the law requires us to keep it, for example tax records);
- limit how we use it, or object to a use;
- not be discriminated against for asking.
We answer within 45 days (or sooner where your local law requires). We verify requests by confirming the account email. An authorized agent may act for you with written permission. If you are in the UK or EU you also have the right to complain to the ICO (ico.org.uk) or your local authority; we would rather hear from you first.
7. Complaints
Email privacy@boxbossrepricer.com with "complaint" in the subject. We acknowledge within 30 days and tell you what we found and did.
8. International transfers
We are a US company operated from the UK; data is stored in the US. Where UK or EU data-protection law applies to a transfer, we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, as set out in the Data Processing Addendum.
9. Changes
We will email account holders at least 30 days before a material change to this policy and post the date at the top.
10. Notice at collection (California)
The categories in §2, the purposes in §2, the retention periods in §2, the statement in §4 that we do not sell or share personal information, and the link to this policy, are our notice at collection. We do not collect personal information from consumers other than from our business customers' staff who sign up and from site visitors.