Privacy Policy

1. Introduction

Positive Odds Retail ("we", "our", or "us") is committed to protecting the privacy and security of data entrusted to us. This Privacy Policy describes how we collect, process, store, use, share, retain, and dispose of information through our website, communications, software and services, including the PODS platform. PODS may support authorized ecommerce marketplace and third-party platform integrations. Our current Amazon-specific processing includes the Amazon Selling Partner API (SP-API) and, where separately authorized, the Amazon Ads API.

2. Information We Collect

We collect and process only information needed for the services requested by a customer and permitted by the relevant authorization.

Amazon SP-API information

For supported Amazon marketplaces where a customer has authorized our application, SP-API information may include:

• Seller account information, account health metrics, and permitted performance information
• Orders, fulfillment information, shipment status, returns, and refunds
• Buyer names, delivery addresses, and contact details when authorized and needed for order fulfillment, shipping, or tax-invoice workflows
• Inventory, catalogue and listing information, stock levels, and pricing
• Financial transactions, settlements, fees, refunds, and reimbursements
• Tax information, including information used for MTR, GST, B2B/B2C, transaction-level reconciliation, and tax-invoice workflows where applicable
• Shipping and Easy Ship information where authorized
• Performance and analytics information where permitted

Amazon Ads API information

Amazon Ads API authorization is separate from SP-API authorization. Where separately authorized, we may process campaign information, spend, impressions, clicks, attributed sales, advertising performance metrics, and keyword or targeting information where permitted.

Other authorized marketplace and platform information

Where a customer authorizes another supported ecommerce marketplace or third-party platform integration, we may process account, order, inventory, catalogue, pricing, fulfillment, financial, advertising, and performance information within the permissions granted for that integration and only as needed to provide the requested services.

Website inquiries and communications

When a person contacts us through our website, email, or other communications, we may collect their name, email address, phone number, company or brand name, business information, monthly revenue or similar information voluntarily supplied, services of interest, messages, requirements, and other information voluntarily provided. Website contact-form submissions are transmitted to us through an essential third-party form-delivery service.

3. How We Use Information

Information from ecommerce marketplaces and third-party platforms is used only to provide services to the customer that authorized access and only within the permissions and purposes allowed by the relevant platform. Amazon Information is processed only for the authorized seller and within the permissions and purposes allowed by Amazon. Depending on the services authorized, we may use information to:

• Manage, analyze, and support authorized Amazon marketplace accounts
• Process and track orders, fulfillment, shipping, and returns
• Support GST and tax reporting, tax invoice generation where applicable, and transaction-level tax reconciliation for authorized sellers
• Support MTR reporting and B2B/B2C tax reconciliation
• Analyze inventory, catalogue, listings, pricing, settlements, fees, refunds, and reimbursements
• Provide seller-authorized performance reporting and operational analytics
• Analyze or manage advertising campaigns through the separately authorized Amazon Ads API

Information submitted through our website or communications is used to respond to inquiries, prepare proposals, communicate with prospective and existing customers, provide customer support, and deliver requested services.

4. Data Storage and Security

We implement industry-standard technical and organizational security measures designed to protect all information we process, including Amazon Information, Personally Identifiable Information (PII), credentials, financial data, and other sensitive information. These measures include:

• All data is encrypted in transit using TLS 1.2 or higher, with TLS 1.3 used where supported.
• All Amazon Information and PII is encrypted at rest using AES-256 or equivalent strong industry-standard encryption across databases, object storage, backups, queues, logs, and other storage systems containing sensitive information.
• Access is restricted on a need-to-know and least-privilege basis using role-based access controls (RBAC).
• Multi-Factor Authentication (MFA) is enforced for all user accounts with access to our systems.
• Network firewalls, intrusion detection and/or prevention systems (IDS/IPS), network segmentation, and restrictive access controls help prevent unauthorized access.
• A centralized Key Management System (KMS), or equivalent secure key-management mechanism, governs the creation, storage, access, rotation, and lifecycle of encryption keys.
• Security and system activity is monitored and logged to support detection, investigation, and response to suspicious or unauthorized activity.
• Vulnerability scanning is conducted at least every 30 days, and identified vulnerabilities are assessed and remediated based on severity and risk.
• Penetration testing is conducted at least annually and, where appropriate, following material changes to security-sensitive infrastructure.

5. Data Retention and Disposal

We retain Amazon Information and PII only for the permitted purpose and no longer than necessary. Amazon buyer PII is retained for no longer than 30 days after order delivery when needed for order fulfillment or tax-invoice workflows, except where a longer period is required by applicable legal, tax, or regulatory obligations. Non-PII information is retained only as long as needed to provide the authorized services.

Amazon Information and PII will be securely deleted within the applicable required period when the seller revokes authorization, our engagement with the seller ends, we are no longer authorized to process it, it is no longer needed for the permitted purpose, Amazon requires deletion, or access to the applicable Amazon service or program ends. Unless a shorter period applies, deletion following these triggers will be completed within 30 days.

Information that must be retained under applicable legal, tax, or regulatory obligations will be isolated, protected, used only for that obligation, and deleted when the required retention period ends. Secure disposal follows industry-standard sanitization practices, including NIST 800-88 where applicable.

6. Data Sharing

We do not sell or rent Amazon seller or buyer data or information from other authorized marketplace accounts, use such data for unrelated commercial purposes, or mix or share data across unrelated customer accounts. Amazon Information is processed only for the seller that authorized access, and other marketplace information is processed only for the customer that authorized the relevant account.

Information may be processed by essential infrastructure and service providers only where needed to operate the service, including cloud hosting, data storage, infrastructure, security, and form-delivery services. These providers must be subject to appropriate confidentiality and data-protection obligations. We may also disclose information when required by applicable law or a valid legal process.

7. Data Subject Rights

Subject to applicable law, individuals whose personal information we process may request access to, correction of, or deletion of that information, or may withdraw consent where consent is the applicable basis for processing. Contact us using the details below. We will respond within a reasonable timeframe and in accordance with applicable law.

8. Security Incident Response

We maintain a documented incident response plan to detect, contain, investigate, and remediate security incidents. When an incident involving Amazon Information requires notification under applicable Amazon requirements, we will notify Amazon at 3p-security@amazon.com within 24 hours of detection. We will also notify affected parties and relevant regulatory authorities where required by applicable law.

9. Regulatory Compliance

We process Amazon Information in accordance with applicable Amazon policies and agreements, including the Amazon Data Protection Policy, Acceptable Use Policy, and Solution Provider Portal Agreement. We also comply with applicable data-protection laws, including India's Digital Personal Data Protection Act, 2023, and relevant requirements in other jurisdictions where we operate.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, services, Amazon requirements, or applicable law. The updated policy will be posted on this page with a revised effective date.

11. Contact Us

Questions, concerns, or privacy requests may be sent to: