Privacy Policy — Walmart Repricer

1. Who we are

Walmart Repricer (the “Service”) is operated by <COMPANY_NAME> (“we”, “us”). You can contact us at <CONTACT_EMAIL>.

We are not affiliated with Walmart Inc. “Walmart” is a trademark of its owner.

2. What we collect

Account data — email and a hashed password when you register.
Walmart Marketplace credentials — Client ID and Client Secret you provide. The secret is encrypted at rest with AES-256-GCM. We never log it.
Catalog data — SKU identifiers, titles, prices, costs, and category referral fees you enter or sync from your Walmart account. This data belongs to you; we process it on your behalf.
Repricing telemetry — every Buy Box snapshot we capture and every price change we compute, retained as long as your account is active so the dashboard can show history.
Billing data — name, email, and the last 4 digits of your payment card via Stripe. We never see or store the full card number.
Logs and error reports — IP address, user agent, request paths, and stack traces when an error occurs. Retained for up to 90 days for debugging and security.

3. How we use it

To run the repricer on your behalf — fetch your Walmart Buy Box, compute price decisions, and push updates back when you opt in.
To bill you for the plan you selected.
To send transactional and notification emails you opted into (failed-reprice alerts, daily digest, weekly report). Marketing emails require separate consent.
To detect abuse, prevent fraud, and comply with legal obligations.

4. Third-party processors

We share data only with vendors necessary to run the Service:

Stripe — payment processing. Stripe Privacy Policy.
Walmart Marketplace API — outbound calls to Walmart on your behalf, using your credentials.
Resend — outbound email delivery. Resend Privacy Policy.
Sentry — error tracking. Sentry Privacy Policy. Stack traces are scrubbed of secrets before transmission.
Railway — hosting infrastructure (compute, Postgres, Redis) in US data centers.

We do not sell your data. We do not share it with advertisers.

5. Cookies

We use a single first-party cookie named token to keep you signed in. It is httpOnly and Secure. We do not use third-party tracking cookies.

6. Data retention and deletion

You can delete your account at any time from Settings → Account → Danger zone. Deletion cascades to your sellers, SKUs, pricing rules, snapshots, and price changes within 24 hours. Backups are purged within 30 days.

Billing records (invoices, refunds) are retained for 7 years to comply with tax law in <JURISDICTION>. We anonymize them after deletion.

7. Your rights

Under applicable laws (GDPR for EU residents, CCPA for California, similar laws elsewhere):

Right to access, correct, or export your data — email <CONTACT_EMAIL>
Right to delete — use the in-app deletion or email us
Right to object to processing or withdraw consent for emails
Right to lodge a complaint with your supervisory authority

8. Security

All traffic is encrypted in transit with TLS. Walmart credentials are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt (cost 12). We never log secrets — our logger has a redact list for password, token, and authorization headers.

9. International transfers

The Service is hosted in the United States. If you access from outside the US, your data is transferred to and processed in the US.

10. Changes

We'll post material changes here and update the effective date. We'll email you if we change how we use your data in a way that requires consent.

11. Contact

Questions or requests: <CONTACT_EMAIL>