Privacy Policy

1.1Who we are. The Company operates the Service. Representative: Hamza Ashraf. Address: 1043-25 Oaza Karuizawa, Karuizawa-machi, Kitasaku-gun, Nagano 389-0102, Japan. Contact for privacy matters: support@mjworldllc.com.

1.2Controller and processor. We act as a controller for the information about the people who use the Service and the Company's own operations: account, authentication, usage, security, billing and support information. For the business data a customer loads into the Service about its own company (Amazon seller data, supplier documents, accounting records and so on, together "Customer Data"), the customer decides what is loaded and why, and we process it on the customer's behalf to provide the Service. The customer is responsible for having a lawful basis to load that data.

1.3Who "you" are. "You" means a person who visits this website or uses the Service, whether for yourself or on behalf of a business (a "Customer").

2.1Account information. Name, work email address, company name, role in the Service, and, once paid plans start, billing contact, billing address and the company's invoice registration number.

2.2Authentication information. A salted hash of your password, your two-factor authentication secret (stored encrypted) and recovery codes (stored hashed), and records of your sign-in sessions.

2.3Amazon seller data. Data you authorize us to read through Amazon's Selling Partner API: listings, prices, inventory, orders (we do not request buyer names, addresses, email addresses or phone numbers), sales and traffic reports, fees, and settlement and payment records.

2.4Records you add. Supplier invoices, receipts, bank statements, purchase orders, accounting entries, product and recipe information, label files and settings. These can contain personal information of your suppliers, staff or other contacts, such as names on documents.

2.5Payment data. When paid plans start: the last four digits of a card, transaction and invoice identifiers, and refund and dispute status, received from Stripe. We do not store full card numbers.

2.6Technical data. IP address, device type, browser, operating system, time zone and the identifiers in the cookies described in section 11.

2.7Log and email data. System logs; an audit log of sign-ins, failed attempts, account changes and approvals; and delivery information for the emails we send you.

2.8AI feature data. Questions you ask the assistant, the data it reads to answer them, the conversation history, and records of usage and cost.

2.9Communications. Messages you send us, for example to the support address.

5.1Authorization. We connect to your Amazon account only after you authorize EC THUNDER in Seller Central. You can revoke the authorization there at any time, after which we stop syncing that account.

5.2Minimum access. We request only the access the features you use need, and we do not request buyer personal information.

5.3Limited use. We use Amazon data only to provide the Service to the seller it belongs to. We do not sell it, do not use it for advertising or marketing, do not combine it with another customer's data, and do not show it to anyone outside your organization.

5.4Amazon's rules. We handle Amazon data in line with Amazon's Acceptable Use Policy and Data Protection Policy.

6.1What is sent. The optional assistant and product plans send your question and the specific data needed to answer it to an AI model provider through its API. Financial documents (invoices, receipts, bank statements) are read by local OCR and deterministic parsers on our servers, not by AI.

6.2Training. We do not use your data to train our own models, and we choose API services whose terms do not, by default, use submitted data to train models.

6.3No solely automated decisions. The Service ranks issues and suggests actions using fixed rules and AI. It does not make decisions with legal or similarly significant effects on individuals by automated means alone. The AI cannot change your Amazon account, prices, orders or accounting records, and a price change is written to Amazon only after an authorized person approves it.

6.4Role limits. The assistant only reads what the signed-in user's role may see. For example, a warehouse user cannot ask it about costs or margins.

8.1Where data is held. Your information is stored in Singapore, with encrypted backups kept in the United States, and may be processed in the United States and, for product identifiers only, other countries where our market data providers operate.

8.2Safeguards. When we send personal information to a provider in another country, we do so under the measures required by Article 28 of the APPI, including contracts that require the provider to protect it to a standard equivalent to the APPI, or with your consent where that is required. For transfers from the European Economic Area or the United Kingdom we rely on the Standard Contractual Clauses and additional safeguards such as encryption in transit and at rest. On request we will tell you about the data protection rules in the relevant country and the measures the provider takes.

9.1Account and Customer Data. We keep them while your account is active. After the account ends you can export your data for thirty (30) days, and we then delete it.

9.2Billing records. Invoices and payment records are kept for the period Japanese tax law requires (currently seven years).

9.3Backups. Database backups are overwritten on a rolling schedule and are gone within about six (6) months of a deletion.

9.4Logs and AI history. Security and audit records are kept as long as needed for security and accountability and are reviewed periodically. AI conversation history is kept with the account and removed with it.

9.5Your accounting records. Keeping accounting records for the period Japanese law requires is your responsibility as the business owner. Export them before you close your account.

11.1In the Service (app.ecthunder.com). We use two cookies: ec_session keeps you signed in, is required for the Service to work and expires after 24 hours; ec_locale remembers your language choice for one year.

11.2On this website (ecthunder.com). We set no cookies and use no analytics, advertising or tracking pixels.

12.1Under the APPI. You may ask us to disclose, correct, add to, delete or stop using the personal information we hold about you, to stop providing it to third parties where the law allows, and to disclose records of its provision to third parties.

12.2Under the GDPR. Where it applies you may also ask to access, rectify, erase, restrict or port your personal data, object to processing and withdraw consent.

12.3How to ask. Write to support@mjworldllc.com. We will confirm your identity and respond within a reasonable period and in any case within one month. If you use a customer's account, we may refer you to that customer, because it decides what is loaded.

12.4Complaints. You may complain to our contact point above, to Japan's Personal Information Protection Commission, or, where the GDPR applies, to your local supervisory authority.

14.1Roles. As section 1.2 explains, the customer determines the purposes and means of processing its Customer Data, and we process it on the customer's behalf to provide and secure the Service.

14.2Purpose limitation and minimization. We process Customer Data only for the purposes disclosed to the customer and only to the extent necessary, and we apply the retention periods in section 9.

14.3Security and logging. We protect Customer Data as described in section 10, keep logs of access to it, limit staff access, and will notify affected customers without undue delay if we become aware of a personal data breach, and notify the authorities and individuals where the law requires.

14.4Backups. Backups that may contain personal information are encrypted and kept in storage separate from the production servers.

14.5Termination and deletion. When an account ends we delete Customer Data as set out in section 9, subject to lawful retention requirements and the backup cycle.

14.6Data processing terms. We can provide a data processing addendum on request.