DepotKeeper Privacy Policy

Operator and contact details

Operator: Nanjing Gugua Gugua Technology Co., Ltd. (“we”, “us” or “DepotKeeper”) Privacy contact email: support@depotkeeper.com Contact address: Building 2, N5, No. 2 Xianyao Road, Yaohua Subdistrict, Qixia District, Nanjing, Jiangsu, China

Overview

This Policy explains how we collect, use, retain, share and protect personal information when operating the DepotKeeper website, workspace, mobile application and related services.

1. Processing roles

For website visitors, registration contacts, account administrators, customer-support contacts, and information for which we independently determine the purposes and means of processing, we generally act as a personal information processor/controller.

For order recipients, buyers, contacts, employees and other data entered, imported or synchronised through integrations by organisational users in the Services (“Customer Data”), the organisational user generally determines the purposes and means of processing. We provide the Services solely as an entrusted processor/processor in accordance with the organisational user’s instructions. Data access between sellers and warehouses is determined by their authorised relationship and permission settings.

2. Information we may process

To provide the Services, we may process:

• Account and contact information: name, email address, phone number, job title, company name, account credentials and preference settings;
• Business and fulfilment information: shops, warehouses, SKUs, products, inventory, bins, inbound forecasts, orders, returns, operations and charge records;
• Delivery information: recipient name, phone number, email address, delivery address, order number, tracking number, carrier, parcel and proof-of-delivery status;
• Technical and security information: IP address, device and browser information, login and activity logs, information generated by cookies or similar technologies, and error and security-incident records;
• Mobile camera and photos: when you actively start scanning, the app uses the camera to read SKU, location, inbound or shipping-label codes; the live camera view is not uploaded as video. If you actively capture and submit an inbound exception evidence photo, it is uploaded and retained as an exception-record attachment;
• Communication information: support tickets, emails, chat records and attachments you submit;
• Third-party integration data: data returned by third-party services you authorise to connect, where necessary to deliver the selected functionality. Where you authorise Amazon Selling Partner API (Amazon SP-API), this may include shop, order, product, fulfilment, logistics, return and refund data.

Please do not upload sensitive personal information unrelated to warehousing and fulfilment, or high-risk information such as identity documents, bank cards, payment passwords, health information or children’s information, unless permitted by law, you have completed the necessary compliance measures, and we have confirmed this in writing.

3. Purposes and legal bases for processing

We process personal information where necessary to:

• Create and manage accounts and provide receiving, inventory, order, picking, shipping, tracking and collaboration functions;
• Manage authorised relationships and permissions, inventory traceability, audit trails and dispute handling;
• Verify identity, protect account, system and data security, and prevent fraud, misuse and unlawful activity;
• Provide customer support, service notices, billing and contract management;
• Analyse service operations, resolve faults, improve products and, where permitted by law, conduct marketing communications;
• Fulfil legal, regulatory, audit, tax, accounting and compliance obligations.

We process information on bases recognised by applicable law, including necessity for performance of a contract, legal obligations, consent, protection of security and legitimate interests. Organisational users must ensure that they have an appropriate basis for providing Customer Data to us.

4. Information sharing

We do not sell personal information. We share information only as necessary for the following purposes:

• Seller-authorised home-based warehouses, small warehouses and their approved members may access only fulfilment data assigned within their authorised collaboration relationship. A warehouse may be an independently operated customer or a partner selected by the seller; it is not necessarily operated by DepotKeeper;
• Alibaba Cloud provides cloud-hosting, object-storage and backup infrastructure. Such providers act as entrusted technical processors for the agreed purpose and under controlled access;
• Carriers or other fulfilment providers you select and authorise receive only the information needed for the services actually performed;
• Entrusted email, customer-support, security or other providers process only the information required for their respective service;
• Necessary disclosures may be made to comply with law, respond to lawful requests, protect rights and security or resolve disputes.

Sharing Amazon Information must comply with seller authorisation, applicable Amazon policies and a specific business need. Before enabling sharing, we must record the actual recipient organisation, purpose, data categories, transfer method and authorisation, and apply confidentiality, access-control and data-protection obligations. Using the Service does not authorise access by every partner warehouse. Disclosure outside necessary entrusted processing, authorised fulfilment or legal requirements is prohibited, as is advertising, resale, cross-customer profiling or unauthorised AI training or generation. Contact support@depotkeeper.com for the recipients and sharing scope applicable to your account.

5. Cross-border transfers

DepotKeeper users, partner warehouses, sellers, carriers and technical service providers may be located in different countries or regions. To provide cross-border warehousing and fulfilment collaboration services, personal information may be transferred to or accessed from mainland China, warehouse locations, seller locations, cloud-service locations and order destinations.

We will take measures required by applicable law, including assessing transfer necessity and risk, executing required data-processing or cross-border transfer documentation, applying encryption and access controls, and providing notice or obtaining consent where required. Organisational users must also ensure that their data transfers comply with the laws applicable where they and data subjects are located.

6. Security measures

Our safeguards include individual accounts, role- and relationship-based access, HTTPS/TLS transport, server-side encryption of sensitive application credentials and authorisation refresh tokens, password hashing, operational traceability, backups and vulnerability remediation. Credential encryption does not establish that every business database, file, backup or endpoint is encrypted at rest; storage and key protection must be verified individually.

Amazon connections are subject to platform approval, seller authorisation and security controls actually implemented. Before enabling restricted personal-data processing, encryption at rest, key management, authentication, logging and deletion controls must be verified across the relevant databases, files, backups and accessing endpoints. The Information Security Policy describes these requirements; it is not a claim of platform approval, penetration testing or third-party certification. An incident involving Amazon Information must be investigated, contained and documented, with Amazon notified within 24 hours of discovery where required.

No internet transmission or storage method is absolutely secure. We take remedial and notification measures required by applicable law when an incident affects, or may affect, personal-information security.

7. Amazon SP-API data and retention

Our Amazon SP-API use case is warehouse fulfilment collaboration for sellers, home-based warehouses and small warehouses: product and stock association, order processing and shipment-status reporting. Brand Analytics is not part of the current application use case. Amazon Information must not be sold, rented, used for targeted advertising or profiled for purposes unrelated to fulfilment. Features and data fields depend on actual availability, Amazon-approved roles and seller authorisation.

Approved processing must follow these retention rules: buyer and recipient personal information must be deleted or irreversibly anonymised within 30 days after delivery, except specific records required by law. Non-personal information is retained only as strictly necessary for a documented fulfilment, reconciliation or legal purpose. Applicable 30-day deletion requirements must also be applied to all live copies when Amazon requires deletion, a seller revokes access or ends service, we are no longer authorised to process the Information, or participation ends. Legally retained exceptions must have restricted access and use.

The rules cover duplicate fields, exports, files, archives and backups. Backups must be encrypted, access- and purpose-restricted, and removed through controlled rotation. Deletion requirements must be reapplied after recovery before business access is restored. Security and access logs must exclude complete credentials and unnecessary buyer content; security logs for applicable personal-data processing must be retained for at least 12 months. Relevant configuration, deletion and recovery must be validated before restricted processing is enabled; policy text is not evidence of implementation.

Other personal information is retained for the period needed for the stated purposes, contracts and legal duties. Contact support@depotkeeper.com about retention and deletion for your account.

8. Your rights

To the extent provided by applicable law, you may request access, copies, correction, deletion, restriction of processing, withdrawal of consent, objection to certain processing or portable data, and may unsubscribe from non-essential marketing communications. You may update account information within the Services or email support@depotkeeper.com to make a request.

Where a request concerns Customer Data controlled by an organisational user, we will refer the request to that organisational user or provide assistance within the scope of its authorisation and applicable law. To protect data security, we may verify identity before responding. Statutory retention obligations, the rights of others, backup recovery and exceptions permitted by law may affect the scope of a request.

9. Cookies and similar technologies

We may use necessary cookies, local storage or similar technologies to maintain login status, remember language and preferences, protect security and analyse service performance. Necessary technologies are required for the Services to operate. For non-essential technologies requiring consent by law, we will provide an appropriate choice mechanism. You may manage cookies in your browser, but disabling them may cause some functions not to work properly.

10. Minors

The Services are intended for businesses and professional users and are not directed to individuals below the applicable minimum legal age. We do not knowingly collect personal information from minors. If you believe a minor has provided information to us, please contact us and we will handle it in accordance with applicable law.

11. Policy updates and contact

We may update this Policy and publish updated versions on the website or in the Services. If an update materially affects your rights, we will provide additional notice to the extent required by law.

For questions, requests or complaints about personal information processing, contact support@depotkeeper.com.