Privacy Policy

Effective date: November 4, 2026

This policy explains how SPACELAB ("we", "us") handles information on spacelab.earth and in our inventory management application ("the App").

1. Information we collect

Website visitors. We do not use advertising or tracking cookies. We use Vercel Web Analytics, which counts page views without cookies and does not identify individual visitors. Our hosting provider may also log basic technical data (IP address, browser type, pages requested) for security and reliability. If you use our contact form, we receive your name, email address and message.

Sellers who authorize the App. When a seller connects their Amazon account through Amazon's authorization (OAuth) flow, we receive, through the Amazon Selling Partner API:

• Listings and SKUs
• Inventory levels (Fulfilled by Amazon and merchant-fulfilled)
• Order line items (SKU, quantity, date, status)
• Current list prices for the seller's own products

We also store account details the seller gives us, such as name and email address.

We do not request or store buyer personal information (names, addresses, phone numbers or emails).

2. How we use Amazon information

We use Amazon information only to provide the App to the seller who authorized it: syncing stock, deducting product and material stock when orders arrive, low-stock alerts, reorder planning and margin views. With the seller's permission, the App may update merchant-fulfilled quantities and list prices on Amazon. We never use Amazon information for advertising, profiling or any other purpose, and we comply with Amazon's Data Protection Policy and Acceptable Use Policy.

3. Storage and security

• Data is hosted with Vercel (application hosting) and Supabase (database).
• Data is encrypted in transit (HTTPS/TLS) and at rest.
• Each seller's data is isolated with row-level access controls; sellers can see only their own data.
• Access to production systems is limited to authorized personnel, protected by multi-factor authentication.
• API credentials are stored in secured environment variables, never in source code.
• We maintain an incident response plan. If a security incident affects Amazon information, we notify Amazon at security@amazon.com within 24 hours, and affected sellers without undue delay.

4. Retention and deletion

We keep seller data only while the App is connected and needed to provide the service. When a seller disconnects the App, closes their account, or asks us to delete their data, we delete it within 30 days, except where the law requires us to keep it. Contact form messages are kept only as long as needed to respond.

5. Sharing

We do not sell, rent or share personal or Amazon information with third parties for their own use. We use only these service providers (processors), under contract, to run the App and this website:

• Vercel Inc. — application hosting
• Supabase Inc. — database hosting
• Resend — delivery of contact form messages to our inbox

These providers may process data outside Japan (for example, in the United States). We may disclose information if required by law.

6. Your rights

Under Japan's Act on the Protection of Personal Information (APPI), you may request disclosure, correction, suspension of use or deletion of your personal information. If you are in the EU/EEA or UK, the GDPR also gives you rights to access, correct, delete, restrict or object to processing, and to data portability, and to complain to your local data protection authority. We process seller data to perform our contract with you and for our legitimate interest in keeping the service secure. To make a request, contact us through the contact form; we respond within 30 days.

7. Changes

We may update this policy. We will post the new version here with a new effective date and notify connected sellers of material changes.

8. Contact

SPACELAB (sole proprietor: Esteban MoraLomonte)

Contact: use the contact form on this page.