SourceDock Privacy Policy

Who is responsible

Odyne LLC operates SourceDock. We are the controller of account data you give us and the processor of Amazon Information we retrieve only after you authorize SourceDock in Amazon’s official Login with Amazon flow.

Web application and Amazon SP-API data

When you create an account we collect your email address, password hash or identity-provider identifiers, subscription and billing details from our payment processor, and the workspace data you enter (ASINs, costs, notes, purchases). We also keep your profile photo if you upload one, usage and security logs (such as sign-ins, plan changes and connections), your ASIN search history, and your two-factor secret, encrypted.

If you connect an Amazon selling account, Amazon issues OAuth tokens. We store the refresh token encrypted at rest. We never collect your Amazon password, Seller Central cookies, or two-factor codes. We use those tokens only to call SP-API for the authorizing selling partner, and only for features that selling partner uses:

• Restrictions and catalog data for ASINs they research
• Pricing and fee estimates for those ASINs
• For Capital Recovery, finances and settlement data for fee and reimbursement recovery
• Asking Amazon to send its standard Request a Review for orders they choose, only when they turn on review requests (we never receive buyer contact details for this)

We do not sell Amazon Information. We do not aggregate SP-API data across selling partners to provide or sell to any party. We do not publish insights about Amazon’s business. Each selling partner sees only their authorized account plus public catalog data and their own inputs.

What the extension does

The extension connects to your account and helps you check brand approval status on Amazon Seller Central (United States, and Canada if you allow it). When you start a check, it opens the Seller Central page for that product and reads the approval status Amazon already displays. It does not click, type, submit forms, or apply for approval. It also shows a profit panel on Amazon product pages, on amazon.com and amazon.ca. It reads the product’s ASIN from the page and shows your fees, profit, sales rank and whether you can sell it. It runs on Seller Central, on Amazon’s store sites and on the SourceDock web app. On an Amazon product page, it reads the product’s ASIN and the sellers Amazon lists for it. The profit panel never shows on Amazon’s cart, checkout or sign-in pages. When you use Find on another store’s product page, it reads that page’s product name, barcode and price, only then, to look for the same product on Amazon.

Extension data we collect (only after you consent)

• ASINs, marketplace, and approval outcomes you check
• Amazon seller ID, to attach outcomes to the right account
• SourceDock authentication tokens (never Amazon credentials)
• Extension version
• Selector-failure telemetry (which lookup failed and the page URL; no page HTML)
• Your consent choice, saved to your SourceDock account, and cached selectors on your device
• The ASIN and marketplace of each Amazon product page you open while the profit panel is on, and any sale price you type into the panel
• Products you add to your Vault: the ASIN, marketplace, the cost you typed and the source link (the address of the store page you’re on when you add it, or one you type)
• Purchases you add from the profit panel: the ASIN, marketplace, quantity, cost per unit, purchase date, store name, order number and source link (the address of the store page you’re on when you add it, or one you type)
• When you use Find on a store page: the product name and barcode it reads there (or the words you select or type), to look for that product on Amazon. Find searches are not saved

SourceDock uses that ASIN to look up the product’s fees, Buy Box and rank, and whether you can sell it, through your own Amazon connection. SourceDock doesn’t keep a list of the product pages you open. Whether you can sell a product is kept on your device. So is Amazon’s list of other sellers for it, which SourceDock never receives.

The profit panel keeps the cost and sale prices you type on your device, so they’re filled in the next time you open the product. The cost stays on your device unless you add the product to your Vault or add a purchase from the panel, which saves it to your SourceDock account. The store price Find reads stays on your device to work out your profit, with the page’s product name, barcode and address, until you close the browser.

Data the extension does not collect

• Page HTML or DOM snapshots
• Browsing history outside Seller Central, Amazon product pages and the SourceDock app (except the address of the store page you add a Vault product or a purchase from, or use Find on)
• Name, email, or demographics through the extension
• Credit-card or bank numbers through the extension
• Amazon passwords, session tokens, or login cookies
• Amazon buyer / customer PII or their orders
• Cookies from other websites, or what you type on websites (it sends SourceDock only the sale price you type into its own panel, the cost when you add a product to your Vault, and a purchase you add from the panel)

Settlement and fee figures used by Capital Recovery come from the web application via SP-API after you authorize it, not from the extension.

Gmail (only if you link it)

What SourceDock reads

You can link your Gmail under Account → Connections. SourceDock then uses Google’s read-only Gmail permission. It looks for order emails. It looks at emails from Amazon, Walmart, Target and Home Depot. It also looks at emails Gmail puts under Purchases or Updates, and emails with an order word in the subject, like “order” or “shipped.” Before it opens one, it checks who sent it. It also checks Google’s stamp that the email is real. It opens an email only if it looks like it’s about an order from a store. It never sends, changes or deletes your email.

For other stores, SourceDock may send the email to an AI service provider to find the order’s details. First, SourceDock masks details like your name, email, phone, address and card numbers where it finds them, and removes links. The provider works under confidentiality and deletion terms. It can’t use your email to train its AI. To pick the Amazon product that matches an item, SourceDock may also send the item’s name, with product names from SourceDock’s own product data, to that provider.

What SourceDock keeps

SourceDock doesn’t keep your emails. It reads each one to see if it’s about an order and what happened to it. From each order email, it keeps only the store, order number, whether the order was placed, shipped or delivered, the email’s date, item names, the store’s item numbers, quantities, prices, discounts, tax, shipping, tracking numbers, the carrier, cancelled items, refund amounts, the words to look up each item on Amazon, and the Amazon product SourceDock found for each item. These wait in your Purchases inbox until you approve or reject them. You can edit them first. An approved email becomes an ordinary purchase. It shows up wherever your purchases do. That includes a helper bot you’ve connected to SourceDock. Team members you add can see your purchases, including ones recorded from order emails. Only you can see the order emails waiting in your Purchases inbox. When you match a store’s item to an Amazon product, SourceDock remembers the match for the next email. To find the matching Amazon product, SourceDock may search Amazon’s catalog for an item’s name using your own Amazon connection. SourceDock also keeps the address of the Gmail account you linked, Google’s ID for that account, and whether the link is on or paused. It never keeps an email’s text, its subject, pictures or attachments.

How long SourceDock keeps it

SourceDock keeps each checked email’s ID for 90 days. That way the same email is never added twice while your Gmail stays linked. An email’s ID also stays with its inbox item until that item is deleted. An inbox item stays until 30 days after you approve or reject it. An item you never decide on loses its items, prices and tracking at 90 days. It is deleted 30 days after that. For each email you approve or reject, SourceDock keeps a scrambled code for 90 days. That way the same email is never recorded twice. The code can’t be turned back into the email. Item matches stay until you delete your account or your paid plan ends. Deleted data can stay in database backups for up to 6 hours.

How SourceDock uses it

SourceDock uses this data only to show and record your purchases. It never uses it for ads. It never sells it. It never uses it to judge credit or lending. No one at SourceDock reads it unless you ask, for example in a support request. Someone may also read it if security needs it or the law requires it. SourceDock doesn’t use Google user data, or anything made from it, to build, improve or train general AI or machine-learning models.

Unlinking

You can unlink at any time in Account → Connections. You can also remove SourceDock in your Google Account’s third-party access settings. Unlinking deletes the email IDs and your inbox items. It also asks Google to end SourceDock’s access. Once Google confirms, SourceDock deletes the stored refresh token too. If Google can’t be reached, SourceDock keeps only that token, still encrypted, and Google’s ID for that account. It asks Google again each day until Google confirms. It also tells you how to remove its access yourself. The scrambled codes stay for their 90 days. That way linking again never records the same email twice. Approved purchases stay until you delete them or your account, or until your paid plan ends for ones you never changed. When you delete one, SourceDock removes the email’s details from it. The rest of the purchase, like its products, counts, costs and dates, is kept until you delete your account. Item matches stay until you delete your account or your paid plan ends. If you ask to delete your account, SourceDock stops checking your Gmail right away. After the 30-day grace period, it unlinks your Gmail and erases your Gmail data.

When your paid plan ends

When your paid plan ends, SourceDock unlinks your Gmail 29 days later, along with your Amazon data. It also deletes the order details waiting in your Purchases inbox, the email IDs and scrambled codes, the item matches, and the purchases it made from your order emails that you never changed. Purchases you changed or added yourself stay. If you renew before then, nothing is deleted.

Security

Google gives SourceDock a refresh token. SourceDock stores it encrypted (AES-256-GCM). The short-lived access token is never stored. Everything SourceDock sends to and from Google uses HTTPS.

Google’s Limited Use rules

SourceDock’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

How we use, share, and delete data

• Use: provide the product you subscribed to, secure the account, and bill the subscription.
• Share: only with the providers that run the service, listed below. No sale of personal or Amazon Information.
• Protect: HTTPS in transit; Amazon refresh tokens encrypted at rest; access limited to operating the service.
• Retention: check results and price history 90 days; fee lookups and service logs up to 90 days; Jax questions and answers 30 days; photos you take in the calculator to find a product aren’t kept; inactive session data 30 days; workspace data (the Vault, purchases and their costs) for as long as your account exists. When you disconnect an Amazon store, Amazon ends SourceDock’s access, or your paid plan ends, SourceDock stops reading Amazon for that store and deletes the data it got from Amazon 29 days later: its sales, orders, payments, refunds, inventory, shipments, Amazon’s reports, its listings and account health, and the Capital Recovery figures built from them. Your own entries stay: the purchases you added and their costs, the Vault, receipts, settings and the claims you marked filed. Purchases SourceDock made from Amazon’s records that you never changed are deleted too, and made again if you reconnect. Reconnect within the 29 days and nothing is deleted. If Amazon asks, SourceDock deletes it sooner. Anonymous, per-ASIN market history with no link to any account is kept indefinitely. Gmail data is kept as the Gmail section above says.
• Deletion: from Account > Danger you can delete your account yourself. Your plan won’t renew, so nothing more is charged, and after a 30-day grace period the account and everything in it (including your Amazon tokens) is permanently erased. You may also email support@sourcedock.io. Amazon tokens are erased the moment you disconnect Amazon; the rest of that store’s Amazon data is deleted 29 days later, as above.

Who we send data to

We use service providers to run SourceDock. Each gets only what its job needs:

• Amazon (SP-API and Login with Amazon): the calls you authorized for your seller account.
• A payment processor: payments and subscriptions. We never see your full card number.
• A product-data provider: the ASINs you research, to fetch public price history and sales estimates.
• AI service providers that process data on our behalf under confidentiality and deletion terms: to read the columns of spreadsheets you import, to read order emails from stores and match their items to Amazon products if you link your Gmail, to read the words on a product photo you take in the phone app’s calculator, to answer questions you ask Jax about your products and claims, and, when it’s turned on for your account, for spoken briefings about your store.
• An email delivery provider: account, receipt and billing emails.
• Google: for sign-in, if you sign in with Google. For Gmail, only if you link your Gmail. If you turn on Google Sheets sync, SourceDock writes your purchase records to a spreadsheet in your own Google Drive.
• Your own AI tool, only if you connect one with AI connection under Account → Connections: it can only read, and only the store and the parts you pick, until you turn it off. SourceDock keeps a list of what it asked for, never the answers, for 12 months.
• Hosting, database and network providers: to run the app and serve the site.
• A file-hosting service: the extension and desktop installer files you download.

We use no advertising or analytics trackers on the website or in the app.

Your rights (GDPR and CCPA)

You may request access, correction, deletion, restriction, portability, or to object. California residents may request to know or delete personal information. We do not sell personal information. Email support@sourcedock.io with the subject “Privacy Request.”

Chrome Web Store Limited Use

The extension reads Seller Central pages for the approval checks you start, reads the ASIN of Amazon product pages for Add to Vault and the profit panel, reads the sellers Amazon lists for those products for the profit panel, reads the address of the store page you add a Vault product or a purchase from, and reads the product name, barcode and price of a store page you use Find on. We do not use that data for advertising, lending, or creditworthiness, and we do not transfer it except to provide the core service.

Trademark

Amazon, Amazon.com, Seller Central, and Amazon Services API are trademarks of Amazon.com, Inc. or its affiliates. SourceDock is a product of Odyne LLC. SourceDock is not affiliated with, endorsed by, or sponsored by Amazon.

Changes

We will update the date above when this policy changes. Continued use after a change means you accept the updated policy.

Contact

Odyne LLC, SourceDock. support@sourcedock.io