Privacy Policy 隐私政策

1. Who We Are

1. 关于我们

This Privacy Policy applies to Mint Hub, operated by 浅草枢（鄂尔多斯）信息技术有限公司 ("Mint Hub", "we", "our", or "us"). We provide cross-border e-commerce operations automation tools for sellers on platforms including Amazon, Walmart, and GigaCloud.

本隐私政策适用于由浅草枢（鄂尔多斯）信息技术有限公司（以下简称"Mint Hub"、"我们"或"我方"）运营的 Mint Hub。我们为在 Amazon、Walmart 和 GigaCloud 等平台经营的卖家提供跨境电商运营自动化工具。

Our website is mint-hub.com. Authorized sellers sign in to the Mint Hub Dashboard at dash.mint-hub.com to access their own connected store data.

我们的官方网站为 mint-hub.com。授权卖家登录 dash.mint-hub.com 的 Mint Hub 工作台，访问自己已连接店铺的数据。

For questions about this policy, contact us at: privacy@mint-hub.com

如对本政策有疑问，请通过以下方式联系我们：privacy@mint-hub.com

2. What Data We Collect

2. 我们收集哪些数据

2.1 Website Visitors

2.1 网站访客

When you visit mint-hub.com, our web server may log standard request metadata such as your IP address, browser type, and pages visited. This is standard server logging and is not used to identify individuals. We do not use third-party analytics scripts, advertising trackers, or cookies beyond what is strictly necessary for page functionality.

当您访问 mint-hub.com 时，我们的服务器可能记录标准请求元数据，例如您的 IP 地址、浏览器类型和访问页面。这属于标准服务器日志，不用于识别个人身份。我们不使用第三方分析脚本、广告追踪器，也不使用页面功能所必要以外的 Cookie。

2.2 Contact Form Submissions

2.2 联系表单提交

If you submit a message through our contact page, we collect the information you provide (such as your name and email address) solely to respond to your inquiry. This information is not shared with third parties.

如果您通过联系页面提交信息，我们收集您提供的内容（如姓名和电子邮件地址），仅用于回复您的咨询。这些信息不与第三方共享。

2.3 Amazon SP-API Authorization Data

2.3 Amazon SP-API 授权数据

When an Amazon seller authorizes the Mint Hub Operations application, we receive and store the following data provided by Amazon through the SP-API OAuth flow:

当 Amazon 卖家授权 Mint Hub Operations 应用程序时，我们将通过 SP-API OAuth 流程接收并存储以下 Amazon 提供的数据：

• Selling Partner ID — the unique identifier for the authorized Amazon store
• Selling Partner ID — 已授权 Amazon 店铺的唯一标识符
• Authorization code — a short-lived code used to obtain a refresh token; discarded immediately after use
• 授权码 — 用于获取刷新令牌的短效码，使用后立即丢弃
• Refresh token — a long-lived credential that allows us to fetch access tokens on behalf of the authorized store; encrypted at rest
• 刷新令牌 — 允许我们代表已授权店铺获取访问令牌的长效凭证，静态加密存储

We also access operational data from the seller's Amazon account as permitted by the SP-API roles the seller authorized, which may include inventory levels, order summaries, and listing information. Advertising data is not part of this SP-API application; if supported in the future, it would be handled through a separate Amazon Ads API authorization.

我们还将根据卖家授权的 SP-API 权限，访问其 Amazon 账户的运营数据，包括库存水平、订单摘要和 Listing 信息。广告数据不属于本 SP-API 应用的范围；如未来支持，将通过单独的 Amazon Ads API 授权处理。

3. Why We Collect This Data

3. 我们为何收集数据

We collect data only for the following purposes:

我们仅出于以下目的收集数据：

• To respond to contact inquiries
• 回复联系咨询
• To maintain secure, authorized access to an Amazon seller's SP-API data on their behalf
• 代表卖家维护对其 Amazon SP-API 数据的安全授权访问
• To display inventory, order, and listing information within the seller's own operations workspace
• 在卖家自己的运营工作台中展示库存、订单和 Listing 信息
• To maintain system security, detect abuse, and ensure service stability
• 维护系统安全、检测滥用行为并确保服务稳定性

We do not collect data for advertising, profiling, or resale.

我们不为广告投放、用户画像或数据转售目的收集数据。

4. How We Use SP-API Data

4. 我们如何使用 SP-API 数据

SP-API data is used exclusively for the operational purposes described in Section 3. Specifically:

SP-API 数据仅用于第3条所述的运营目的，具体包括：

• Inventory data is shown only within the authorized seller's own workspace
• 库存数据仅在已授权卖家自己的工作台中展示
• Order data is used only to support operational decisions within the seller's workspace
• 订单数据仅用于支持卖家工作台中的运营决策
• Listing data is used to flag SKUs that need restocking or repricing attention within the seller's workspace
• Listing 数据用于在卖家工作台中标记需要补货或调价关注的 SKU

SP-API data is never used to build profiles, train models on seller-specific competitive data, or inform decisions for any party other than the authorizing seller.

SP-API 数据绝不用于构建用户画像、基于卖家竞争数据训练模型，或为授权卖家以外的任何一方提供决策依据。

5. Third-Party Sharing

5. 第三方共享

We do not sell, rent, or transfer your data to third parties. We do not share SP-API data obtained through seller authorization with any party other than the authorizing seller's own team.

我们不向第三方出售、出租或转让您的数据。通过卖家授权获取的 SP-API 数据，不与授权卖家团队以外的任何方共享。

We may use infrastructure providers (cloud servers, database hosting) to operate our services. These providers process data on our behalf under contractual agreements and are not permitted to use the data independently.

我们可能使用基础设施提供商（云服务器、数据库托管）来运营服务。这些提供商依据合同协议代我方处理数据，不得独立使用该数据。

6. Data Retention

6. 数据留存

• Contact form messages — retained for up to 12 months, then deleted
• 联系表单消息 — 保留最长12个月后删除
• Server logs — retained for up to 90 days
• 服务器日志 — 保留最长90天
• SP-API refresh tokens — retained while the seller's authorization is active; deleted within 30 days of revocation or deletion request
• SP-API 刷新令牌 — 在卖家授权有效期间保留；授权撤销或收到删除请求后30天内删除
• SP-API operational data — retained for up to 12 months to support historical reporting, then deleted or anonymized
• SP-API 运营数据 — 为支持历史报告保留最长12个月，之后删除或匿名化处理

7. How We Protect Refresh Tokens and Authorization Data

7. 我们如何保护刷新令牌和授权数据

The following controls apply to Amazon SP-API authorization and seller data:

以下控制措施适用于 Amazon SP-API 授权与卖家数据：

• Encryption at rest — refresh tokens are encrypted using a server-side key before being written to the database
• 静态加密 — 刷新令牌在写入数据库前使用服务端密钥加密
• Ephemeral access tokens — short-lived access tokens are held only in memory during an API request and are never written to disk
• 临时访问令牌 — 短效访问令牌仅在 API 请求期间保留于内存中，绝不写入磁盘
• Access control — each seller's tokens and data are logically isolated; no internal user can access another seller's data
• 访问控制 — 每位卖家的令牌和数据逻辑隔离，内部用户无法访问其他卖家的数据
• Minimum privilege — only the SP-API roles required for declared features are requested
• 最小权限 — 仅申请功能声明所需的 SP-API 权限
• Incident response — in the event of a breach affecting seller tokens, we will notify affected sellers promptly and revoke compromised credentials
• 应急响应 — 如发生影响卖家令牌的安全事件，我们将及时通知受影响卖家并撤销受损凭证

8. Your Rights: Data Deletion and Revocation

8. 您的权利：数据删除与授权撤销

To revoke Amazon authorization:

撤销 Amazon 授权：

Log in to Amazon Seller Central → Settings → Apps & Services → Manage Your Apps, and revoke access for Mint Hub Operations. Upon revocation, we immediately stop all SP-API access for your store and delete your refresh token. Any remaining operational data is deleted within 30 days.

登录 Amazon Seller Central → 设置 → 应用程序与服务 → 管理您的应用程序，撤销 Mint Hub Operations 的访问权限。撤销后，我们将立即停止对您店铺的所有 SP-API 访问并删除您的刷新令牌；剩余运营数据将在 30 天内删除。

To request deletion of your data:

申请删除您的数据：

Send a written request to privacy@mint-hub.com with the subject line "Data Deletion Request". Include your Selling Partner ID or the email address associated with your inquiry. We will process your request within 30 days and confirm deletion in writing.

请发送书面申请至 privacy@mint-hub.com，邮件主题请注明"数据删除申请"。请提供您的 Selling Partner ID 或与咨询相关的电子邮件地址。我们将在30天内处理您的申请并书面确认删除结果。

9. Children's Privacy

9. 未成年人隐私

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

我们的服务不面向18周岁以下人群。我们不会有意收集未成年人的个人数据。

10. Changes to This Policy

10. 政策变更

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.

我们可能不时更新本隐私政策。重大变更将通过更新页面顶部的"最后更新"日期加以体现。

11. Contact

11. 联系方式

• Email: privacy@mint-hub.com
• 电子邮件：privacy@mint-hub.com
• Company: 浅草枢（鄂尔多斯）信息技术有限公司 (Mint Hub)
• Address: Suite 1118, Jianyin Building, Kangbashi District, Ordos, Inner Mongolia, China
• 地址：内蒙古鄂尔多斯市康巴什区建银大厦1118室