T-Code Manager

Privacy Policy

Privacy and Data Handling Policy

Effective date: 2026-05-12 Last updated: 2026-10-11 Applies to: T-Code Manager (tcodemanager.com) and SellerSKU, operated by Welch Commerce Systems

This policy describes how we collect, process, store, use, share, and dispose of customer data, with specific attention to data we access from Amazon Selling Partner API (SP-API) on behalf of authenticated customers.

1. Who we are

Welch Commerce Systems operates T-Code Manager (TCM) and SellerSKU, multi-tenant SaaS applications that help Amazon sellers manage transparency code workflows and inventory operations. Both applications are operated under the same developer profile, infrastructure, and security controls described below.

Contact:

2. What data we collect

2.1 Data you provide directly

  • Account information: name, email, password (hashed), organization name, role.
  • Product information: ASIN, SKU, UPC, FNSKU, supplier SKU, product name, image URLs, transparency target quantities.
  • Operational data: transparency code uploads, print job records, dispense records.
  • Integration credentials: API keys for connected services (ShipStation, Amazon SP-API, others), encrypted at rest.

2.2 Data collected from Amazon Selling Partner API

When a customer authorizes us to call SP-API on their behalf via Login With Amazon (LWA), we access the following Amazon Information:

  • Order data (Orders API v0): order IDs, order statuses, order item codes, ASINs, quantities, fulfillment dates.
  • Order PII (Orders API v0, Direct-to-Consumer Shipping Restricted role): buyer name and ship-to address. This is read transiently to associate transparency codes with the correct order item; it is not displayed to warehouse users beyond the dispense workflow.
  • Inventory data (Inventory API): SKU stock levels and replenishment status.

2.3 Data collected automatically

  • Application logs (Railway-managed): timestamps, request paths, response codes, IP addresses, authenticated user IDs.
  • Audit logs: authentication events, admin actions, credential rotations, SP-API request/response metadata (excluding PII payloads).

We do not use third-party analytics or advertising trackers in production application surfaces.

Public website analytics. Our public marketing pages (the home page, pricing, product pages, guides and these policy pages) may use Google Analytics 4 to count visits and see which pages are read. Google Analytics sets cookies in your browser. It is never loaded on the application itself (sign-up, sign-in and every page after it), and no account data, customer data or Amazon Information is sent to it.

3. How we use your data

  • Service delivery: to operate the transparency code workflow, the inventory management workflow, and the SP-API submission pipeline that customers explicitly request.
  • Order fulfillment association: to read order line items and submit transparency codes via the POST_ORDER_FULFILLMENT_DATA feed, the Amazon-recommended workflow for sellers using third-party shipping tools.
  • Operational support: to debug customer-reported issues with explicit customer authorization.
  • Reconciliation: to verify that submitted transparency codes match dispensed codes, and to surface mismatches to the customer.
  • Account administration: authentication, billing, and customer support.

We do not use Amazon Information for advertising, marketing analytics, profiling, or any purpose beyond delivering the services the customer has explicitly authorized.

4. Where we store your data

  • Primary database: PostgreSQL hosted on Railway (US region), with disk-level encryption at rest.
  • Application hosting: Railway PaaS, with managed TLS for all customer traffic.
  • Backups: Railway-managed automated daily snapshots, geographically replicated to a separate AWS region for disaster recovery.
  • Logs: Railway logging infrastructure, retained for 30 days.

All Amazon Information is stored in the United States. We do not transfer data to non-US regions.

5. How we protect your data

  • Encryption in transit: All customer traffic and SP-API communication uses HTTPS / TLS 1.2 or higher.
  • Encryption at rest: Sensitive fields (LWA refresh tokens, third-party API keys, customer credentials) are encrypted using Fernet symmetric encryption (AES-128 in CBC mode with HMAC-SHA256), keyed to the per-environment ENCRYPTION_KEY managed via Railway environment variables. Non-sensitive operational data resides on Railway-managed encrypted-at-rest storage.
  • Access controls: Multi-tenant isolation via organization_id scoping ensures one customer cannot access another customer's data. Role-based access control (owner, admin, member) limits intra-organization access. Internal database access requires unique per-developer credentials with platform-level multi-factor authentication.
  • Authentication: Customer passwords are stored as werkzeug-hashed digests with automatic salting. Session-based authentication with secure, HTTP-only, SameSite=Lax cookies; 30-day session lifetime.
  • Credential management: No credentials in source code; .env files are gitignored; production secrets injected at runtime via Railway environment variables; secret-scanning enabled on the source repository.
  • Audit logging: Authentication events, admin actions, and credential rotations are logged with at-least 90-day retention.
  • Code review: All production changes are reviewed before merge; vulnerability scanning (Dependabot) runs on every push.

6. Who we share your data with

We do not sell, rent, or otherwise share customer data or Amazon Information with third parties for marketing, advertising, or analytics purposes.

We share data only:

  • Back to Amazon: when submitting transparency codes via POST_ORDER_FULFILLMENT_DATA feeds, as authorized by the customer.
  • With contracted developers under NDA: internal development team members may access production systems for debugging, only when necessary, with all access logged. All contractors sign non-disclosure agreements before being granted access.
  • As required by law: in response to lawful subpoenas, court orders, or legal process. We will notify the affected customer where legally permitted.
  • In aggregate, anonymized form: for product analytics and capacity planning that contains no personally identifiable information.

We do not transmit Amazon Information to ShipStation, third-party advertising networks, or any party other than the cases listed above.

7. How long we keep your data

  • Account data: retained for the duration of the customer's active account, plus 30 days after closure for billing and dispute resolution.
  • Order PII (buyer name, ship-to address): retained only for the operational window required to submit and confirm the OrderFulfillment feed; nulled out from local storage as soon as Amazon confirms feed acceptance. Hard cutoff: under 31 days post-shipment via scheduled daily purge job. We do not retain raw buyer PII once submission is confirmed.
  • Transparency code records (codes themselves): retained for the duration of the customer's account for audit and reprint scenarios.
  • Application logs: retained for 30 days, then automatically expired.
  • Backups: retained for 30 days on Railway-managed snapshots.

8. Your rights

Customers may at any time:

  • Request a copy of the data we hold about their organization.
  • Request correction of inaccurate data.
  • Request deletion of their account and associated data (honored within 30 days, subject to legal retention requirements).
  • Revoke our SP-API authorization via Amazon Seller Central, which immediately disconnects our access to their Amazon Information.
  • Contact us with privacy concerns at [email protected].

9. Security incidents

If we detect or are notified of a security incident affecting Amazon Information, we will:

  • Notify Amazon at [email protected] within 24 hours of detection.
  • Notify affected customers within 72 hours of detection, or as soon as reasonably possible if active investigation requires longer.
  • Investigate, contain, remediate, and conduct a post-mortem in line with our internal incident response plan.

Customers may report suspected security incidents to [email protected].

10. Changes to this policy

We may update this policy as our services or applicable law evolve. Material changes will be communicated to customers at least 30 days before they take effect. The current version is always available at tcodemanager.com/privacy.

11. Contact