BunnyScan

About the operator

BunnyScan is a software product owned and operated by Urban Rivet, Inc., a U.S.-based technology company specializing in e-commerce analytics and seller tools.

In this Privacy Policy, "BunnyScan," "we," "our," and "us" mean Urban Rivet, Inc. in connection with the BunnyScan platform.

1. Introduction

This Privacy Policy explains how Urban Rivet, Inc. collects, uses, stores, and protects information when you use the BunnyScan website, licensed installation, managed hosting, and related services ("Services").

By using the Services, you agree to the practices described in this Privacy Policy.

2. Information we collect

A. Information you provide

Account information (name, email, authentication identifiers)
Organization and workspace details (business name, team members)
License and billing contact information
Payment method details processed by our payment provider (Stripe — we do not store full card numbers on our servers)
Third-party credentials you choose to connect, such as Amazon SP-API tokens and product data API keys, stored securely for your installation

B. Information collected automatically

Log data (IP address, browser type, device information, timestamps)
Usage analytics (features used, scan activity, error diagnostics)
Cookies and similar technologies for authentication and session management

C. Amazon SP-API data

If you connect Amazon Seller Central or provide SP-API credentials, we may access and process data Amazon makes available through SP-API, such as:

Product and listing data
Offer and pricing data relevant to analyses you run
Inventory and catalog information
Performance or eligibility signals needed for sourcing workflows

We access only data necessary to provide the Services and handle it in accordance with Amazon's data-protection and SP-API policies.

D. Other integrated data

If you provide third-party API credentials, we process product history, offer, and related data from those providers solely to run analyses you request. We process that data only to deliver the Services.

3. How we use your information

We use collected information to:

Provide, host, and maintain your licensed BunnyScan installation
Run storefront, ASIN, wholesale, and related analyses you initiate
Authenticate users and secure accounts
Process license fees and maintain billing records
Provide support under your License Agreement
Improve product performance, reliability, and security
Comply with Amazon SP-API and applicable legal obligations
Detect and prevent fraud, abuse, or misuse

We never sell your personal information or your Amazon business data.

4. How we store and protect data

We use industry-standard security measures, including:

Encryption in transit (TLS) and encryption at rest where supported by our infrastructure
Application-layer encryption (AES-256-GCM) for Amazon SP-API refresh tokens and third-party API keys before they are stored in our database; decryption occurs only in privileged server processes at runtime
Secure storage for API tokens and secrets in managed environment systems (not in source code or client-side code)
Role-based access controls within our team and your workspace
Managed hosting on reputable cloud providers with access logging

Authentication

BunnyScan customer sign-in is passwordless (email one-time code). We do not store customer application passwords. Urban Rivet operational accounts that access production systems or Amazon-related credentials follow strong password and MFA requirements (minimum 12 characters with complexity, annual rotation, MFA on admin and production access). A full operator security summary is maintained in policies/security.md and available on request for Amazon SP-API review.

Amazon SP-API and analysis data are retained only as long as necessary to provide the Services, meet your License Agreement, or satisfy legal and Amazon policy requirements.

5. Sharing of information

We may share information only with:

Service providers that help us operate the Services (hosting, database, email, analytics, payment processing via Stripe)
Amazon, as required by SP-API policies and your authorization
Legal authorities, if required by law, court order, or to protect rights and safety

We do not share or sell data to advertisers or unrelated third parties for their marketing.

If your installation is a private or dedicated deployment, your workspace data is logically separated from other customers' environments as described in your License Agreement.

6. Your rights

Depending on your location, you may have the right to:

Access personal information we hold about you
Correct inaccurate information
Request deletion, subject to legal, billing, and Amazon retention requirements
Request export of your data where technically feasible
Withdraw consent where processing is consent-based
Object to or restrict certain processing, and lodge a complaint with a supervisory authority

European Economic Area (EU GDPR) and United Kingdom (UK GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, the following also applies in addition to the rights above.

Lawful bases for processing. We process personal data on one or more of these bases, depending on the activity:

Contract — to provide, host, and support the Services you subscribe to
Legitimate interests — to secure accounts, prevent abuse, improve reliability, and operate the platform (balanced against your rights)
Legal obligation — for tax, accounting, fraud prevention, and compliance with Amazon SP-API and applicable law
Consent — where required (for example, optional marketing or non-essential cookies, if offered)

Data subject requests. To exercise GDPR/UK GDPR rights (access, rectification, erasure, restriction, portability, or objection), contact support@bunnyscan.com. We will respond within the timeframes required by applicable law (typically one month, extendable where permitted). We may need to verify your identity before responding.

Supervisory authorities. You may lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO). In the EEA, contact the authority in your country of residence or place of work.

7. Data retention

We retain data only as long as necessary to:

Provide the Services during your license term
Meet billing, tax, and accounting obligations
Comply with legal obligations and Amazon SP-API requirements
Resolve disputes and enforce our agreements

When your license ends, we may delete or anonymize workspace data after any post-termination export window in your License Agreement, unless law requires longer retention.

8. International transfers

If you access the Services from outside the United States, your information may be processed in the United States or other countries where we or our service providers operate (including cloud hosting and payment processing). Those countries may not provide the same level of data protection as your home jurisdiction.

Where required by EU GDPR, UK GDPR, or similar laws, we rely on appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses approved by the European Commission or UK authorities, and supplementary measures where appropriate. You may request more information about these safeguards by contacting support@bunnyscan.com.

We take steps designed to protect information consistent with this Privacy Policy.

9. Children's privacy

BunnyScan is not intended for individuals under 18. We do not knowingly collect personal information from minors.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this site and update the "Last Updated" date. Continued use of the Services after changes become effective indicates acceptance of the updated policy.

11. Contact us

For privacy questions or data requests, contact:

Urban Rivet, Inc. (operator of BunnyScan)

Email: support@bunnyscan.com