Privacy & Data Handling

Last updated 1 October 2026

Omnicoda, Inc. (“Omnicoda,” “we”) provides a commerce operations platform to online sellers (“our customers”). This notice explains how we collect, process, store, use, share and dispose of data — including data we process on behalf of our customers from Amazon and other sales channels — and what we collect from visitors to this website.

Our website

If you visit omnicoda.com:

• Early-access requests. If you submit the form, we store your email address, and your IP address and browser user-agent for spam prevention and to avoid duplicate requests. We use your email only to contact you about early access to Omnicoda.
• Analytics. We use Google Analytics to understand how the site is used — pages viewed, referring source, and whether the signup form was started or completed. This sets cookies in your browser. We do not use it for advertising, and ad-personalisation signals are disabled.
• Delivery and security. The site is served through Cloudflare, which processes visitor IP addresses to deliver the site and protect it from abuse.

You can block or clear cookies in your browser at any time; the site works without them.

What we process

• Seller/customer account data: name, work email, company, and login credentials for Omnicoda.
• Marketplace and channel data (processed on the customer’s behalf, with their authorization): orders, inventory, listings, pricing, and settlement/financial data.
• Buyer personal information: a buyer’s name and shipping address (and, where provided, contact details) — used solely to fulfill that buyer’s order.

How and why we use it

We process this data only to provide the services our customers authorize — order visibility, profit and financial reconciliation, inventory, listings and pricing, and order fulfillment (including generating shipping labels and confirming delivery). We act as a data processor for marketplace and buyer data, on our customer’s instructions. We never sell data, and we never use it for advertising.

How we store and protect it

Data is encrypted in transit (TLS). Off-site backups are encrypted client-side (AES-256) before they leave our environment. Credentials for connected systems — a customer’s ERP or marketplace logins — are encrypted at the application layer. Access is least-privilege, and each customer’s data is isolated from every other customer’s at the database level. We maintain security monitoring, logging and an incident response process, and we continue to strengthen these controls as we grow.

How long we keep it

We practice data minimization. Buyer personal information is retained only as long as needed to fulfill the order and handle post-delivery issues — returns, delivery disputes and carrier claims — and is then removed.

Retention periods vary by sales channel. Where a marketplace sets a maximum retention period for buyer data, we apply it and our customers cannot extend it. For Amazon orders, buyer personal information is deleted 7 days after the carrier confirms delivery, and in every case no later than 30 days after shipment — including the copies created for fulfillment, such as shipping labels. For other channels, the seller configures retention within the limits of applicable law.

Other data is retained for the life of the customer relationship and any legal or accounting minimums, then disposed of securely.

Who we share it with

We share data only with the service providers below (our “subprocessors”), only the fields each one needs, and only to provide the service to the customer who authorized us:

• Cloudflare — network edge. Traffic to our application passes through Cloudflare, encrypted, for connection security and protection against attacks.
• Anthropic — AI model provider. When a customer asks our in-app assistant a question, the relevant order, product and sales data is sent to Anthropic’s API to produce the answer. Buyer names, street addresses, postal codes, email addresses and phone numbers are removed before any request. Under Anthropic’s commercial terms, this data is not used to train its models.
• EasyPost and Veeqo — shipping-label providers. When a customer buys a shipping label, the recipient’s name, shipping address and package details are sent to produce the label and tracking number, and are passed on to the carrier the customer chooses.
• Backblaze — off-site backup. Receives only backup archives that are encrypted before they leave our systems; Backblaze cannot read them.
• Resend — email delivery, for account emails and for messages to people who sign up on this website.
• Google Analytics — usage measurement on this website only, as described above; it is not used inside the application.

At a customer’s direction, we sync their own data to systems they control, such as their ERP. We do not sell data, use marketplace data for advertising, or share one marketplace’s data with another. We disclose data if required by law.

Your rights and contact

Buyers should direct requests about their personal data to the seller they purchased from (the data controller); we support our customers in fulfilling those requests. If you submitted your email to this website, you can ask us to remove it at any time.

For privacy questions, contact [email protected]. Security concerns: [email protected].

We may update this notice; material changes will be posted here with a new “last updated” date.