Xiangyu ERP Privacy Policy

This policy applies to the Xiangyu ERP website, web system, browser plugin and desktop helper operated by Quanzhou Haoruicheng Network Technology Co., Ltd. That company is the controller responsible for the personal and business data described here.

Xiangyu ERP is an independent software service. It does not represent Amazon, eBay, Walmart or any other third-party platform, and it does not imply any partnership, recommendation or endorsement by them. Platform names and trademarks belong to their respective owners.

We collect data only where it is necessary for the features you choose to use:

• Account and company information: name, company name, email, phone, and login and security verification information.
• Store authorisation information: platform, site, store identifier, authorisation status and access tokens issued by the platform. We do not ask for third-party platform passwords.
• Product and operations data: products, categories, attributes, variations, images, price, inventory, listing status and task results.
• Order and fulfilment data: processed only when you enable order or fulfilment features, covering orders, recipient information, delivery, tracking and necessary transaction information.
• Technical and audit data: IP address, device and browser information, login records, API call records, error logs and security event records.
• Enquiry data: the name, company, contact details and requirements you submit voluntarily by email or contact form.

We use data for store authorisation, product sync, data preparation, bulk publishing, pricing and inventory maintenance, order fulfilment, data analysis, quota accounting, account security, fault diagnosis and user support. Data is not used for advertising profiling unrelated to your authorised purposes, and we do not sell, rent or trade user data.

All platform data follows purpose limitation and data minimisation: only the components and authorised staff needed for the task can access it.

Xiangyu ERP accesses Amazon data through the Selling Partner API only after the seller explicitly authorises it and enables the relevant features. The scope matches the published statement of role purposes, and we comply with the Amazon Services API Developer Agreement, Acceptable Use Policy and Data Protection Policy.

• Amazon data is used only for the authorising seller business management, not for data brokerage, advertising, model training or providing data to other sellers.
• Restricted data is processed only where necessary, under role-based least-privilege access.
• When the seller revokes Amazon authorisation, closes the feature or ends the service, we stop access and delete or irreversibly anonymise data no longer needed.

We do not sell user data to third parties. We share data only within these limits:

• Platforms you authorise: on your instruction, we submit products, inventory, price, order fulfilment or other necessary data to Amazon and other platforms.
• Cloud sub-processors: we use Alibaba Cloud for servers, databases, object storage, network and security infrastructure. Sub-processors process data only on our instructions and are bound by confidentiality and security obligations.
• Necessary service providers: payment, email, SMS or logistics providers receive only the minimum data required.
• Legal requirements: we may disclose data where required by law, regulation or valid legal process, limited to what is required.

Before sharing data we assess each party security measures and policies, and share only with parties whose standards are at least as strict as ours.

Business data is stored on Alibaba Cloud infrastructure per the service configuration. Data is kept only as long as needed to fulfil the authorised purpose, perform the contract, ensure security and meet legal obligations.

• Store authorisation tokens are encrypted while valid, then stopped and deleted after revocation.
• Product, inventory, order and task data is kept while you use the features, then deleted or anonymised on account closure, service end or purpose completion.
• Security audit, order and financial records that must be kept by law are stored separately and deleted when the period ends.
• You can submit access, correction, export or deletion requests to contact@xiangyuerp.com.

We apply technical and organisational measures matched to the risk:

• HTTPS/TLS encryption in transit, with encryption protecting access tokens, sensitive fields and backups.
• Role-based permissions, least privilege, strong authentication, access approval, log auditing and periodic permission reviews.
• Production, test and development environments are separated; real restricted data is not used outside production.
• Vulnerability remediation, dependency updates, backup and restore, security monitoring and staff data-protection training.

For security incidents involving Amazon information, we respond immediately and notify security@amazon.com within 24 hours of discovery, then notify affected users and take containment and remediation measures as required.

You can access, correct, export or delete your personal data, revoke store authorisation, restrict data access for specific features, or request account closure. Revoking authorisation does not affect processing validly carried out before revocation, but we will not obtain new data from that platform afterwards.

After receiving a request we verify your identity and respond within the period required by law. If we cannot delete immediately due to a legal obligation, we explain why and restrict further use.

The website uses only the cookies or local storage needed for basic functions, visit measurement and security. Amazon data is never written into advertising tracking cookies, and platform data is never provided to advertising networks.

Xiangyu ERP is for business operators and is not directed at children. If we discover we collected a minor information by mistake, we delete it promptly.

We may update this policy to reflect service, legal or platform requirement changes. Material changes are announced prominently on the website, and the published and effective dates are updated.

Data controller: Quanzhou Haoruicheng Network Technology Co., Ltd.

Application name: Xiangyu ERP

Contact email: contact@xiangyuerp.com

Address: Room 1208, Qilong Digital Park, Quanzhou, Fujian, China