Privacy Policy

Unilytic (“Unilytic”, “we”, “us”, or “our”) is an inventory-management and shipment-planning service for Amazon sellers. Unilytic is owned and operated by Autotronics India, based in Hisar, Haryana, India.

For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) of India, Autotronics India is the Data Fiduciary responsible for the personal data processed through Unilytic. If you have any question about this policy or about how your data is handled, you can reach us at akshat@unilytic.in — see Section 15 for full contact and grievance details.

This Privacy Policy applies to the Unilytic web application, the Unilytic backend API, and the Unilytic marketing website (collectively, the “Service”). It covers data about you (the account holder), the members of your organization, and the business data you choose to upload or connect.

Unilytic is a business tool intended for use by Amazon sellers and their teams. By creating an account and using the Service, you acknowledge and agree to the collection and use of data as described in this policy.

This Privacy Policy does not cover third-party services that you separately use or connect to — such as Amazon Seller Central or the Razorpay checkout — which are governed by their own privacy policies.

We collect only the data needed to operate the Service:

a. Account and profile data

• Email address and profile details — your email and optional profile information (display name, a short bio, and an avatar image URL), used to create your account, identify you, show you to teammates, and contact you about the Service.
• Password — your password is handled entirely by our authentication provider (Supabase Auth) and is stored only in a securely hashed form. We never see or store your password in plain text.
• Preferences — such as your light/dark theme choice.
• Organization data — your organization's name, an optional description and logo image URL, the team members you invite, their roles (such as owner, admin, or member), and pending invitations.

b. Inventory and operations data

• Inventory data you upload as CSV or Excel files, and the processed inventory records derived from it.
• Shipment records, local stock entries, and figures relating to claims and vendor returns.
• Warehouse return photos — if you use the warehouse-returns scanning feature, the images you upload of returned items (for example, to document damage). These are stored privately and accessible only to your organization.
• An audit log of significant actions taken within your organization (for example, who uploaded a file or sent an invitation, and when).

c. Try-before-you-sign-up preview

• If you use the "Upload your report" preview before creating an account, the file you upload is sent to our servers, analyzed in memory only, and the results are returned to your browser. We do not store the file or the derived records on our servers, and the analysis is not linked to any account. The uploaded report and its results are held only in your browser (in your current session) so they can be shown to you across the preview pages, and are cleared when you close the tab. If you then create an account, your browser re-uploads the same file into your new organization, at which point it is saved as described in section (b) above.

d. Amazon Selling Partner data

• If you connect your Amazon seller account, we read data through the official Amazon Selling Partner API (SP-API) — such as inventory ledger reports, inbound shipment status, and, for the returns and reimbursement features, your FBA customer returns, refunds, reimbursements, and the related order-level financial and fee data. This is your own seller and operational data; we do not request, receive, or store Amazon shopper or end-customer personal information.
• Our access is read-only. Unilytic never writes to, or changes anything in, your Amazon account (it cannot edit listings, prices, or orders).
• To maintain this connection we store the authorization credentials you grant us — namely the Login with Amazon refresh token and your marketplace identifier. See Section 5 for how these are protected.

e. Billing data

• Your subscription plan, its status, and the customer and subscription identifiers issued by our payment processor, Razorpay.
• We do not collect or store your card number, UPI ID, or bank details. All payment information is entered on, and handled entirely by, Razorpay's secure checkout.

f. Technical data

• Standard technical information generated when you use the Service, such as request logs, browser type, and approximate access time, used to operate, secure, and troubleshoot the Service.
• Product-usage analytics. We use a privacy-conscious analytics provider to understand how the Service and our sign-up flow are used (for example, which pages are viewed and which actions are taken), so we can improve them. This captures usage events and technical data, not the contents of your inventory files.

We use the data described above only to:

• provide the Service — inventory analysis, shipment planning, and reporting;
• create your account, authenticate you, and manage your organization and team;
• sync data from Amazon SP-API when you have connected your seller account;
• process your subscription and manage billing through Razorpay;
• send service communications by email and (optionally) Slack — including essential account alerts (trial reminders, billing issues, security events such as two-factor changes), team invitations, and the recurring automated email digests that owners and admins configure under Settings → Automated Emails;
• maintain security, prevent abuse, and keep an audit trail of account activity;
• provide customer support and respond to your requests;
• comply with applicable legal, tax, and regulatory obligations.

We process this data on the basis of your consent, given when you create an account and use the Service, and as necessary to perform our contract with you (to provide the Service you signed up for). Business and operational data you upload to the Service — such as inventory, shipment, and stock records — is processed solely to provide the functionality you request from the Service. We do not use your data for advertising or for automated decision-making that produces legal effects.

All Service data is stored in a managed PostgreSQL database hosted by Supabase in the Mumbai (ap-south-1) region of India. We protect it with the following measures:

• Encryption in transit — all traffic between your browser, our backend, and our database is encrypted using TLS/HTTPS.
• Encryption at rest — the database hosting the data is encrypted at rest by our hosting provider.
• Extra protection for Amazon credentials — your Amazon SP-API refresh token is additionally encrypted by Unilytic at the application layer before it is written to the database, so it is not readable in plain text even within the raw database.
• No direct database access — your browser never connects to the database directly. Every request passes through our authenticated backend API.
• Data isolation — every record is scoped to a single organization. You and your teammates can only view and manage data that belongs to your own organization; you cannot see any other customer's data.

We rely on a small set of trusted third-party service providers (“sub-processors”) to operate the Service. We share only the data each provider needs for its function, and each is bound by its own data-protection obligations:

We may also disclose data where required to do so by law, by a valid order of a court or government authority, or to protect the rights, safety, and security of Unilytic, our users, or the public.

Unilytic does not sell or rent your personal or business data. We do not share it with advertisers or data brokers, and we do not use your inventory, shipment, or Amazon data to train artificial-intelligence models.

Your data is shared only with the sub-processors listed in Section 6, who process it on our behalf and under our instructions, and only where disclosure is required by law as described above.

Unilytic uses only essential cookies and browser storage needed to run the Service. We do not use third-party advertising or cross-site tracking cookies.

• Authentication session — your login session token is stored by your browser so you stay signed in.
• Application state — small values are kept in your browser's local storage to remember things like your currently selected organization, theme preference, and onboarding progress.
• Functional cookie — one cookie remembers whether the in-app sidebar is expanded or collapsed.

You can clear this data at any time through your browser settings; doing so will sign you out and reset these preferences.

We keep your personal and business data for as long as your account and organization remain active, so we can provide the Service to you.

If you close your account, or send us a written request to delete your data, we will delete your personal data and business data within 30 days, except for limited records we are required to retain to comply with legal, tax, accounting, or audit obligations, or to resolve disputes and enforce our agreements. Such retained records are kept only for as long as the relevant obligation requires.

Self-service deletion at plan limits. You may also delete inventory data yourself from within the Service. When an upload or Amazon sync would exceed your subscription tier's caps, you can confirm a prompt to delete the oldest historical dates, or to keep only a subset of SKUs or warehouses. These deletions take effect immediately and remove the corresponding inventory rows permanently. Where your plan caps warehouse image storage, reaching that cap prevents new photo uploads until space is freed. When you delete a warehouse receipt, its record is removed immediately and its photo files are permanently purged from storage after a short grace period (around 7 days); your existing data is never deleted automatically before then. See Section 10 ("Your data and content") of our Terms of Service for the full description of plan-limit data handling, including that the audit log retains a record of each deletion (subject to the audit-log retention period of your plan).

Amazon Selling Partner data. Data we read from the Amazon SP-API (such as inventory ledger reports, inbound shipment status, and your FBA returns, refunds, reimbursements, and related order-level financial and fee data) is operational data, not shopper or end-customer personal information — the Service does not request, receive, or store Amazon shopper PII. Amazon-derived operational data is retained under the same rules as the rest of Your Data described above, and is deleted on account closure within 30 days, except where retention is required by law.

As a Data Principal under the DPDP Act, 2023, you have the following rights in respect of your personal data:

• Right to access — to obtain a summary of the personal data we process about you and how we process it.
• Right to correction and completion — to have inaccurate or incomplete personal data corrected, completed, or updated.
• Right to erasure — to request deletion of your personal data, subject to the retention exceptions in Section 9.
• Right to withdraw consent — to withdraw the consent you have given, at any time, as easily as it was given. Withdrawing consent does not affect processing done before the withdrawal.
• Right of grievance redressal — to a readily available means of raising a grievance with us (see Section 15).
• Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email us at akshat@unilytic.in. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. Much of your data can also be viewed, edited, or exported directly within the Service. If you believe your rights have not been honoured, you may also lodge a complaint with the Data Protection Board of India.

You remain in control of the Amazon connection at all times. You can disconnect Unilytic from your Amazon seller account by:

• removing the Amazon credentials within the Unilytic settings; and/or
• revoking Unilytic's access from the Manage Your Apps section of Amazon Seller Central.

Once disconnected, we stop syncing data from Amazon. You may also ask us to delete the stored Amazon credentials and previously synced Amazon data, as described in Section 9.

The Service is a business tool and is not directed to, or intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Some of the sub-processors listed in Section 6 may store or process data on servers located outside India. Where this happens, we rely on reputable providers that apply appropriate technical and contractual safeguards, and we transfer data only in a manner permitted under the DPDP Act and other applicable law.

We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or the law. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will also take reasonable steps to notify you, such as by email or an in-app notice. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy.

If you have any question, concern, or grievance about this policy or about how your personal data is handled, please contact us. We will acknowledge and address your request as required by the DPDP Act.

You may also lodge a complaint with the Data Protection Board of India if you are not satisfied with how we have handled your grievance.