Privacy Policy
How we handle the data you entrust to us, including everything retrieved from Amazon on your behalf.
In short: we use your data to run the service you asked for, we do not sell it, we do not share it with other sellers, and Amazon data is used only to provide Xcel Rack's functionality to you. You can disconnect or delete at any time.
1. Who we are
Xcel Rack is an inventory, forecasting and warehouse management application for eCommerce sellers, operated by Xcelerate Brands. Where this policy says "we" or "us" it means the operator of Xcel Rack; "you" means the business using it.
For any privacy question, contact [email protected].
2. Data we collect
2.1 Account data
Names, usernames, email addresses, organization membership and role. Used to authenticate you and to decide what you are permitted to see.
2.2 Data you provide
Warehouse and supplier information you upload or enter: warehouses, suppliers, part numbers, box numbers and quantities, units per box, stock levels, lead and transit times, and any notes you add.
2.3 Data retrieved from Amazon
When you connect an Amazon Selling Partner account, we retrieve only what the roles you approve allow, which may include:
- catalog and listing information — SKUs, product identifiers, item names, fulfillment type
- orders and order items, including quantities, prices and dates
- inventory quantities, including FBA on-hand and inbound
We retrieve this to provide Xcel Rack's functionality to you — inventory tracking, sales analysis and forecasting — and for no other purpose.
2.4 Operational data
Logs of requests, errors and background jobs, retained to operate and debug the service. These may include identifiers such as an organization id or an IP address. They never contain passwords or access credentials.
3. What we do not do
- We do not sell your data, or share it with third parties for their own marketing.
- We do not use one customer's data to benefit another. Your data is not aggregated into benchmarks, market reports or models shown to anyone else.
- We do not use Amazon data for any purpose other than providing this service to you.
- We do not send your data to advertising networks or analytics brokers.
4. Amazon Selling Partner data
Data obtained through Amazon's Selling Partner APIs is handled under Amazon's Data Protection Policy and the Acceptable Use Policy.
- Authorization — we access your Amazon data only after you explicitly authorize it, and only within the roles granted.
- Credentials — the authorization token issued by Amazon is stored in a managed secret store with per-tenant access control. It is never written to our analytics database, never sent to a browser, and never exposed in logs, error messages or support tooling.
- Isolation — each organization's Amazon data is stored and queried against that organization only.
- Revocation — disconnecting Amazon destroys the stored authorization immediately. You may also revoke it from Seller Central at any time.
- Personally identifiable information — where order data includes customer personal information, it is retained only as long as needed to provide the service and is not used for any secondary purpose.
5. Where data is stored
Xcel Rack runs on Google Cloud Platform in the United States. Application data is held in Google BigQuery and Google Cloud SQL; credentials are held in Google Secret Manager. Static content is served through Cloudflare.
If you are located outside the United States, your data will be processed there.
6. Security
- All traffic is encrypted in transit with TLS. Data is encrypted at rest by the platform.
- Access is authenticated and authorized on every request, on the server, for every organization-owned record.
- Credentials are stored in a dedicated secret manager, separated per organization, and are never accessible from the browser.
- Administrative access to the platform does not include access to your marketplace credentials.
- Sensitive actions are recorded in an audit trail.
No system is perfectly secure. If you believe you have found a vulnerability, please write to [email protected].
7. Retention
| Data | Retained |
|---|---|
| Account and organization records | While the account is active |
| Marketplace and warehouse data | While the account is active, subject to your own retention settings |
| Marketplace authorization | Until you disconnect or revoke it |
| Operational logs | Up to 30 days |
When an organization is deleted, its records are removed from every table that holds them, and any stored marketplace authorization is revoked.
8. Your rights
Depending on where you are, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these, contact us at [email protected]. We will respond within the period required by applicable law.
9. Sub-processors
We use a small number of service providers to operate Xcel Rack, including Google Cloud Platform (hosting, databases, secret management) and Cloudflare (content delivery). Each is bound by its own data-processing terms. We will update this policy before adding a sub-processor that materially changes how your data is handled.
10. Cookies
The marketing site uses no tracking or advertising cookies. The application uses browser storage strictly to keep you signed in and to remember interface preferences.
11. Changes
We may update this policy. When we do, we will change the date above, and for material changes we will notify account administrators.
12. Contact
Xcel Rack, operated by Xcelerate Brands
[email protected]