Privacy Policy

OttoCentral is a software service provided by Road Runner Software Development Company LLC, a limited liability company organized in the United States.

• Company: Road Runner Software Development Company LLC
• Registered Address: 1128 Lexington Avenue, Bldg 4A, Rochester, NY 14606, USA
• Privacy Contact: privacy@ottocentral.com
• General Contact: info@ottocentral.com

The categories of personal information we collect and process are described below. Categories are grouped by their source and the purpose for which they are used.

2.1 Account Information: first name, last name (optional), email address, hashed password, account creation date, language and interface preferences.

2.2 Google Sign-in Information: if you choose to sign in with Google, the name, email address, profile picture URL and OAuth subject identifier provided by Google.

2.3 Amazon Connection Information: for each Amazon Selling Partner account you connect, the refresh token issued through LWA (Login with Amazon), seller ID, authorized marketplace IDs, and authorization timestamp. Refresh tokens are stored in encrypted form.

2.4 Amazon Inventory and Business Information: commercial data such as SKU, ASIN, product title, stock quantity, price, listing status and category. This information is not directly personal in itself, but may be personal information when combined with the seller account it relates to.

2.5 Amazon Buyer Personal Information (Buyer PII): buyer name, delivery address, phone number and email address obtained through the Amazon Selling Partner API in the context of an order. Special handling rules for this category are described in Section 4.

2.6 Billing and Payment Information: invoice title, tax ID, invoice address, payment method type, payment status and invoice number. We do not store full card numbers; card data is handled by our PCI-DSS compliant payment processor.

2.7 Usage and Device Information: IP address, device and browser information, session identifier, pages viewed, searches, error reports and session duration. This is used to operate the service, measure performance and troubleshoot.

2.8 Support Communications: content of any email or support request you send us, attachments and correspondence.

We use personal information for the following business and commercial purposes:

• Creating and securing your account, authenticating you and maintaining sessions.
• Providing the OttoCentral service, operating the Amazon SP-API integration, and displaying inventory, orders and pricing information.
• Processing payments, generating invoices and maintaining accounting records as required by law.
• Handling Amazon Buyer Personal Information solely for the purposes described in Section 4 (displaying orders and, where you authorize it, transferring order data to a WMS integration).
• Measuring service quality, diagnosing errors and improving the service.
• Detecting and preventing fraud, abuse and security incidents.
• Responding to your questions, complaints and support requests.
• Complying with legal obligations and responding to lawful requests from courts, regulators and other authorities.
• Sending product updates, announcements or marketing communications, where you have consented and consistent with applicable law (including CAN-SPAM).

Amazon Buyer PII obtained through the Amazon Selling Partner API is handled in accordance with the Amazon Selling Partner Data Protection Policy. We access this information only to (a) display order details to the seller who owns the relevant Amazon account and (b) transfer order details to a warehouse or WMS integration that the seller has explicitly connected.

We do not use Amazon Buyer PII for marketing, profiling, ad targeting, bulk analysis, or sale to third parties.

When a seller revokes the connection to an Amazon account or deletes their OttoCentral account, we delete Buyer PII associated with that account from our active systems and backups within thirty (30) days, consistent with the Amazon Data Protection Policy.

Buyer PII is protected with the technical controls required by Amazon, including encryption in transit and at rest, principle-of-least-privilege access, access logging, network segmentation, and secure key management.

We share personal information only in limited circumstances:

5.1 Service Providers: We use vendors that process personal information on our behalf under contractual data-protection commitments. Our current sub-processors are listed in Section 9.

5.2 With Amazon: When you connect an Amazon Selling Partner account, we exchange information with Amazon as required by the Amazon SP-API.

5.3 With Skuload: If you authorize a WMS integration with Skuload, we transfer relevant order and delivery information to Skuload so it can fulfill the order.

5.4 Legal and Safety: We may disclose personal information when we believe in good faith that disclosure is required by law, a court order, or a lawful request from a government authority, or is reasonably necessary to enforce our Terms of Use, protect our rights or property, or prevent fraud, security incidents or harm.

5.5 Business Transfers: If OttoCentral is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. We will notify you of such a transfer through the OttoCentral service or by email.

5.6 No Sale of Personal Information: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

We retain personal information only as long as necessary for the purposes described in this policy and to comply with our legal obligations.

We take reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration and destruction.

7.1 Technical Measures: TLS 1.2 or above in transit; AES-256-based encryption at rest; separate cryptographic keys for sensitive fields such as refresh tokens; salted Argon2/Bcrypt hashes for passwords; role-based access with the principle of least privilege; centralized monitoring of access and event logs; regular security patching; backup and disaster-recovery procedures.

7.2 Organizational Measures: confidentiality obligations for staff; documented authorization for individuals granted access; contractual data-protection undertakings with sub-processors; periodic awareness training; incident-response procedures.

7.3 Security Incident Notification: If we become aware of a security incident affecting personal information in a way that triggers a legal notification obligation, we will notify affected individuals and the appropriate authorities in accordance with the applicable US state laws.

The OttoCentral website and application use cookies and similar technologies to operate the service, remember your preferences and, on the marketing site, measure aggregate engagement. See the Cookie Policy for the categories of cookies we use, their purposes and durations, and how to manage them.

We rely on the following sub-processors to deliver the service. This list is kept current; before adding a new sub-processor we update this policy first.

• Amazon Web Services, Inc. (cloud infrastructure hosting) — us-east-1 region (Virginia, USA)
• Amazon Services LLC (Amazon SP-API — account data and Buyer PII)
• Google LLC (Sign in with Google, if the user chooses this option)
• Google Workspace (transactional email delivery through Gmail SMTP)
• Stripe, Inc. (payment processing, PCI-DSS compliant)
• Google Analytics (aggregate usage analytics on the ottocentral.com marketing site only)
• Skuload (only when a user explicitly authorizes a WMS integration)

Depending on where you live, applicable law may give you certain rights regarding your personal information. We honor the following rights for all users of OttoCentral, regardless of location, subject to reasonable identity verification:

1. Right to Know / Access: You may request confirmation of whether we process personal information about you and receive a copy of the categories and specific pieces of personal information we hold.
2. Right to Delete: You may request that we delete personal information we have collected about you.
3. Right to Correct: You may request that we correct inaccurate personal information about you.
4. Right to Portability: You may request a copy of your personal information in a portable, machine-readable format.
5. Right to Opt Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising, but you may confirm this preference at any time.
6. Right to Non-Discrimination: We will not deny you our service, charge you a different price, or provide you a different level of service because you exercised any of these rights.

California residents have specific rights under the California Consumer Privacy Act (CCPA/CPRA), including the rights listed above. Residents of other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have similar rights under their respective laws. Residents of the European Economic Area and the United Kingdom have rights under the GDPR and UK GDPR (including access, rectification, erasure, restriction, portability, objection and the right to lodge a complaint with a supervisory authority).

To exercise any of these rights, contact us at privacy@ottocentral.com. We will respond within the time required by the applicable law (typically 45 days for CCPA requests). An authorized agent may submit a request on your behalf; we may ask the agent to provide proof of authorization and may ask you to verify your identity directly.

OttoCentral is operated from the United States and personal information is stored and processed in the United States. If you access the service from outside the United States, you understand and consent to the transfer of your personal information to and processing in the United States, where privacy laws may differ from those of your country.

If you are in the European Economic Area or the United Kingdom, our legal basis for processing your personal information is (as applicable) the performance of a contract with you, our legitimate interests in operating and improving the service, compliance with a legal obligation, or your consent.

OttoCentral is a business tool for Amazon sellers and is not directed at children. We do not knowingly collect personal information from children under 13 in the United States (or under 16 in the European Economic Area and the United Kingdom). If you believe a child has provided personal information to us, contact privacy@ottocentral.com and we will delete it.

We may update this Privacy Policy from time to time to reflect changes to our practices, legal requirements or the service. When we make material changes, we will notify you by email to your registered address or by a prominent notice in the OttoCentral service. The effective date at the top of this policy indicates when it was last updated.

For any question, request or complaint about this Privacy Policy or the personal information we hold, contact us at:

• Privacy email: privacy@ottocentral.com
• General email: info@ottocentral.com
• Written: Road Runner Software Development Company LLC, 1128 Lexington Avenue, Bldg 4A, Rochester, NY 14606, USA