Privacy Policy

1. General information and data controller

GepFlow protects the confidentiality and security of the personal data of its users and their customers. The data controller is ANASZKO SP. Z O.O., with its registered office in Piastowo (Piastowo 38, 82-316 Milejewo, Poland), entered in the National Court Register (KRS) under number 0000773057, NIP (tax ID) 5783135545, REGON 382619841 — the operator of the GepFlow service. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the terms of our partner platforms.

2. Amazon SP-API integration requirements (Data Protection Policy)

For the integration with the Amazon Selling Partner API (SP-API):

• Amazon customers' personally identifiable information (PII) is retrieved and processed solely for logistics purposes (order fulfillment, generating courier labels, issuing invoices).
• Amazon customers' PII is not shared with any third parties, except couriers and carriers for the purpose of delivering the parcel.
• Amazon customers' personal data (PII) is retained for no longer than 30 days after the order is shipped. After this period it is permanently and irreversibly deleted or anonymised in the database, in accordance with the Amazon Data Protection Policy.
• Data is protected against unauthorised access in line with Amazon's security standards (AES-256 encryption).

3. eBay integration requirements

As part of the integration with the eBay platform:

• We respect buyers' privacy rights. Data retrieved from the eBay platform is used solely to process the order.
• We fully support and handle user account and data deletion notifications (eBay Marketplace Account Deletion). Upon receiving a notification from eBay, we promptly delete the related user's data from our database.
• Users may at any time request access to their data retrieved from the eBay platform, or ask for it to be deleted, directly from the data controller.

4. Viadomo and artificial intelligence (AI) support

• Viadomo collects customer messages from various sales channels (Allegro, eBay, Amazon, e-mail, etc.) in one shared customer service panel.
• The content of customer messages may be processed by artificial intelligence algorithms (AI — language models) to automatically generate suggested replies for customer service agents.
• AI tools act as an assistant to staff and take no independent action without human approval. Message data is transmitted securely and is not used to train public AI models.

5. Data security and encryption

All personal data processed in the GepFlow system is subject to high security standards:

• Data is stored in the European Union, in Google Cloud in the European region (Belgium and the Netherlands).
• Data is transmitted over the encrypted SSL/TLS protocol.
• Data stored in the Firebase Firestore database is encrypted at rest using the AES-256 standard.
• Sensitive integration credentials (API keys, access tokens and refresh tokens) are additionally encrypted in the database with a master key at the application level, which protects them from being read in the event of unauthorised access to the database.

6. Cookies

• The gepflow.com website uses Google Analytics 4 (Google Ireland Ltd.) only after you consent in the banner — for visit statistics (which pages and content are viewed, from which country and source visitors come). Without consent the Google script is not loaded and no data is sent to Google. We do not use advertising tools (e.g. Meta Pixel, remarketing). Google Analytics cookies (_ga, _ga_*) are stored for up to 14 months; data may be transferred to the USA under the EU-US Data Privacy Framework. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time: Cookie settings.
• Fonts, images and videos on the website are served from our own server, and the links to Facebook and Instagram are plain links — they do not send any data to those services until you click them.
• The GepFlow panel (after logging in) stores in your browser only the data necessary for the service to work: keeping you logged in (Firebase Authentication) and protecting forms against bots (Cloudflare Turnstile). These do not require consent, and blocking them in your browser will prevent you from logging in.
• If we add analytics or advertising tools in the future, we will ask for your consent before they are enabled and describe them in this policy.

7. User rights and contact

Everyone whose data we process has the right to access their data, have it rectified, restrict its processing and request its erasure (the right to be forgotten). Questions and requests regarding privacy protection should be sent to: rodo@gepflow.com.