Privacy policy

• We use your information to run Copacker for you. We don’t sell it, and we don’t use it for advertising.
• We use data from Amazon, Shopify, eBay and the other services you connect only to provide Copacker to you.
• We don’t keep your customers’ names, email addresses, phone numbers or addresses.
• We share information only with the providers that run Copacker, the people you work with in it, and when the law requires it.
• You can ask for a copy of your information, or ask us to delete it, through the contact page.

Your account

Your name, email address, position and company. If you sign in with Google or Microsoft, they share your name and email address with us. Your password goes to WorkOS, our sign-in provider; Copacker never stores it.

Your workspace

What you and your team add to Copacker: your company’s details and addresses; your suppliers and forwarders, with their contact names, email addresses, phone numbers and addresses; products, prices, catalogs and stock; purchase orders, shipments, costs and comments; and the files you upload, such as commercial invoices, labels, product photos and price lists.

Services you connect

When you connect a store or marketplace, you let Copacker read the data it needs from it:

• Amazon, through the Selling Partner API: your seller account and marketplaces, listings, FBA and AWD inventory, orders, fees and payments, and inbound shipments.
• Amazon Ads, when you connect it: your advertising accounts and campaigns, with their spend and sales by product.
• Shopify: your store, products, locations, inventory, orders and Shopify Payments transactions.
• eBay, when you connect it: your orders and inventory.

From your orders, we keep what planning needs: order numbers and dates, products, quantities, prices, fees and fulfillment status. For Shopify orders, we also keep the customer’s ID number, so repeat customers can be counted. We don’t keep your customers’ names, email addresses, phone numbers or addresses.

We also keep the credentials each service gives us when you connect it, encrypted.

Messages and the mailing list

The contact form sends us your name, email address, company and message. The mailing list keeps your email address.

When you use Copacker

Our servers and providers receive your IP address and browser details with each request. WorkOS uses them to protect sign-in, and we use them to slow down repeated form submissions. Copacker also sets a few cookies, described in Cookies.

• To run Copacker: sign you in, forecast your stock, plan restocks, prepare purchase orders, shipments, labels and documents, and show your sales and costs.
• To make the changes you ask for in the services you connect, such as creating an Amazon inbound shipment or updating a product’s cost in Shopify.
• To send the emails Copacker needs: sign-in codes, password resets, invitations, purchase orders and notices when labels are ready.
• To keep Copacker secure, prevent abuse and fix problems.
• To answer your messages, and to send product news if you joined the mailing list.
• To meet our legal obligations.

Where the law requires a legal basis, we rely on our contract with you to provide the service, our legitimate interest in keeping Copacker secure and working, your consent for the mailing list, and our legal obligations.

We don’t sell your information, we don’t use it for advertising, and we don’t use it to train AI models.

When you import a document, such as a supplier’s order confirmation, Copacker sends it through OpenRouter to an AI model, which reads it into a draft purchase order for you to review. To match its lines, the model looks up products in your catalog. The document and those lookups go to the model only for that import.

This covers data from Amazon, through the Selling Partner API and the Amazon Ads API, and from Shopify, eBay and any other store or marketplace you connect.

• We use it only to provide Copacker to you: your forecasts, purchase orders, shipments, labels and reports.
• We never sell it, and we don’t use it for advertising or marketing, ours or anyone else’s.
• We never use it to contact your customers, and we don’t keep their personal information.
• We share it only with the providers that run Copacker, listed below, and with the people you give access: your team, and the suppliers and forwarders you share a purchase order with. We disclose it otherwise only when the law requires it.
• We read only what Copacker needs, and act in your accounts only to do what you ask, such as creating an inbound shipment.
• You can disconnect a service in Settings at any time. We then delete its credentials and stop reading from it.

The providers that run Copacker process information for us, only to provide the service:

WorkOS

Sign-in and accounts: passwords, sign-in with Google or Microsoft, single sign-on, and checks that protect sign-in.

Railway

Hosting: runs Copacker, and stores its database, documents and logs.

Cloudflare

Carries and protects traffic to copacker.ai, and serves the site’s video.

Amazon Web Services

Delivers notifications from Amazon and Shopify to Copacker.

Resend

Sends Copacker’s emails, and keeps the mailing list.

OpenRouter

Passes documents you import to the AI model that reads them, currently Anthropic’s Claude.

Langfuse

Keeps the instructions the import model follows, and records how each import ran, never what the document said.

Other people see your information only as you choose:

• Your team sees your workspace, as its owner and admins allow.
• Suppliers and forwarders see the purchase orders and shipments you share with them, not your sales or the other costs you record.
• The services you connect, such as Amazon and Shopify, receive what Copacker sends them for you.
• AI agents and tools you connect can read and change your workspace’s data with your access. Their providers handle what they receive under their own terms.

We may also disclose information when the law requires it, or to protect Copacker, our users or others from harm or fraud. If Copacker is merged, acquired or sold, your information may transfer with it, and this policy will still apply to it.

Copacker uses only the cookies it needs to work:

• A session cookie that keeps you signed in.
• One that remembers the workspace you have open.
• Short-lived ones that hold a sign-in or an invitation in progress, for up to 10 minutes.
• One with your computer’s time zone, and one that remembers whether the app’s sidebar is open.

Your choice of light or dark theme stays in your browser’s local storage. We don’t use analytics or advertising cookies, and we don’t track you across other websites.

• Your account and workspaces: while they’re open. Ask us to delete them, and we’ll delete the information in them, except what the law requires us to keep.
• Data from services you connect: while the workspace is open, unless you ask us to delete it sooner. Disconnecting a service deletes its credentials right away. When a Shopify store uninstalls Copacker, we erase what we copied from it when Shopify asks, 48 hours later.
• Store notifications: notifications from Amazon and Shopify can include a customer’s details, so they’re deleted once Copacker has processed them, or after 14 days at most if it can’t.
• Your messages to us: as long as we need them to help you.
• The mailing list: until you unsubscribe.

• Copacker is served over encrypted connections (HTTPS).
• Credentials for the services you connect are encrypted before they’re stored.
• Your password is held by WorkOS, never by Copacker.
• Documents are kept in private storage, and Copacker checks that you may see one before sending it.
• People see only the workspaces they belong to, and members only the pages they’re given.

No service can promise perfect security. If a breach affects your information, we’ll tell you as the law requires.

Depending on where you live, you may have the right to access, correct or delete your information, to get a copy of it, to object to or restrict how we use it, and to withdraw consent you gave. To use these rights, write to us through the contact page. We’ll confirm it’s you before we act, and we won’t treat you differently for asking.

You can also:

• Change your name, position and company in Settings.
• Disconnect a store or marketplace in Settings.
• Unsubscribe from the mailing list at any time, from any of its emails or through the contact page.

If your information is in a workspace someone else runs, such as a buyer’s, we may pass your request to them. You can also complain to your local data protection authority.

Copacker is a service for businesses. It isn’t meant for children, and we don’t knowingly collect information from anyone under 16. If you think a child has given us information, tell us through the contact page and we’ll delete it.

Our providers process information in the United States and other countries, which may have different data protection laws than where you live. Wherever it’s processed, we protect it as this policy describes.

We’ll post any change here and update the date at the top. If a change affects you significantly, we’ll tell you by email or in Copacker before it takes effect.

Questions or requests about your information? Write to us through the contact page.