Privacy Policy

1. Data we collect

We collect the following data:

• Account data: the name, email address and store or workspace name you give when you register and sign in, and the email addresses of colleagues you invite.
• Store business data: with your authorisation, we read from the platforms you connect your own store's product and listing data, stock levels and prices, and each order's number, status, amount, currency and time.
• Authorisation credentials: the authorisation credentials or tokens needed to connect a platform.
• Payment data: payments are processed by a third-party payment service provider; we do not store full credit card numbers.
• Technical logs: records produced to keep the system secure and to troubleshoot faults, such as request times, error logs and browser information.

2. Data we do not collect

We do not request or store the names, addresses, email addresses or phone numbers of your store's customers (buyers). For Amazon, we request only the minimum permissions needed to read the non-personal-data fields of products, inventory and orders.

3. How we use data

We use the data above to provide and maintain the service, connect platforms and synchronise data, reply to your enquiries, keep the system secure and meet our legal obligations. We do not sell your data, we do not use it for advertising or user analytics, and we do not provide your store data to other customers.

4. About Amazon data

When you connect Amazon:

• You give the authorisation yourself in Amazon Seller Central. You can revoke it in Amazon at any time, or disconnect in RAID. Once you revoke or disconnect, we stop reading your Amazon data and clear the stored authorisation credentials.
• We use your Amazon data only within your own account, and we comply with Amazon's Acceptable Use Policy and Data Protection Policy.

5. How data is stored and protected

We take the following measures:

• Data in transit is sent over encrypted connections (TLS).
• Authorisation credentials are stored encrypted and are not shown on screen again.
• Each customer's data is kept separate in the system, and only authorised members of that workspace can view it.
• If a security incident affects your data, we will notify you and the platforms concerned as applicable law and the platforms' requirements provide.

6. Data sharing and service providers

We do not disclose your data to third parties except with your consent, where it is necessary to provide the service, or where the law requires it. To provide the service, we use service providers who process data on our behalf, including database and sign-in services (Supabase), computing and website delivery services (Cloudflare) and payment services (Airwallex), and we require them to meet corresponding confidentiality and security requirements. Because we use these services, your data may be processed outside Hong Kong.

7. Retention and deletion

We keep your data while you use the service. You can apply in Settings to delete your workspace or account; a 7-day cooling-off period follows, after which our operations staff carry out the deletion. You can also ask by email at any time for your personal data or store data to be deleted. We complete the deletion within 30 days of the end of the cooling-off period or of receiving your email request. Copies in backups expire automatically with the backup retention cycle, after 35 days at most. Authorisation credentials are cleared once you disconnect. When we delete data, we delete the data itself rather than only anonymising it.

8. Your rights

You have the right to access, and to request correction of, the personal data we hold about you, and you may also request its deletion. Please contact us using the details below, and we will handle your request in accordance with the Ordinance.

9. Policy updates and contact

We may update this policy. We will tell you about material changes in an appropriate way and update the effective date. If you have any questions, or wish to exercise your rights, please contact Mercury Production Limited at 32/F, Tower A, Billion Centre, 1 Wang Kwong Road, Kowloon Bay, Hong Kong, or by email at support@raid-hk.ai.