プライバシーポリシー

Privacy Policy

English Version — Effective 9 September 2026

1. Scope

Winst Inc. ("we", "us") provides account management services to brands selling on Amazon ("customers") and handles their selling data in the course of that work. This policy covers both our website (https://winst.co.jp/) and our application Winst Report Automation, which retrieves reports through the Amazon Selling Partner API.

2. Information we collect

Only after a customer has authorized our connection through Amazon's official OAuth flow, we retrieve the following from their Seller Central account: listing information; pricing information; order and inventory information; fulfillment information (FBA inventory ledger, returns, storage fees); Amazon Warehousing and Distribution inventory; Amazon Logistics delivery status; settlement reports and fee breakdowns; sales, traffic, sessions and conversion rate; Brand Analytics reports (search query performance, search terms, market basket, repeat purchase, item comparison); whether buyer enquiries have occurred; review solicitation eligibility and status; and sustainability certification information.

When you contact us or request a quote by email, we receive the information you include in that email, such as company name, contact name, email address, telephone number and the details of your enquiry.

Our website uses no analytics tools and no cookies. We do not identify or track visitors. Google Fonts is loaded to render typefaces, which means technical connection information such as the visitor's IP address is sent to Google LLC. We do not receive that information.

3. Information we do not collect

We do not retrieve personally identifiable information about buyers — names, addresses, telephone numbers or email addresses — through the Amazon Selling Partner API. We have not applied for the restricted roles that carry such data, and our application is not built to retrieve it.

4. How we use the information

• Preparing and delivering monthly and weekly business reports to the customer the data came from.
• Understanding inventory, sales, advertising and settlement performance in order to advise that customer.
• Responding to enquiries and quote requests.

We use the information for no other purpose.

5. Scope of write operations

Our application is primarily read-only. Write operations through the Selling Partner API (listing, A+ content, price and inventory updates, FBA inbound plans, review solicitations and template messages to buyers) are performed only at the request or with the approval of the selling partner.

6. Storage and protection

• Retrieved data is stored encrypted at rest (AES-256 or equivalent); no plaintext temporary files are left behind.
• All communication with Amazon and internal transfer of data uses TLS 1.2 or higher.
• Credentials are stored encrypted and never appear in plaintext in code, logs or URLs. Their locations are recorded in a register and reviewed regularly.
• Work devices require device login with separated accounts and multi-factor authentication. Access to data is limited to those who need it for the work.
• Each customer's data is stored separately and is never combined with, or used in reporting for, another customer.
• Operational logs are retained for at least 12 months so that the course of any incident can be traced, in line with Amazon's Data Protection Policy. Logs do not contain the selling data itself.

7. Disclosure to third parties

We do not sell, share, lend or otherwise disclose retrieved data to third parties. It is used solely to report to, and advise, the customer it came from. The only exception is disclosure required by law, in which case we will notify the customer in advance where we are permitted to do so.

8. Retention and deletion

• We retain data only for as long as it is needed for the account management work. Non-personal selling data is retained for no longer than 18 months from retrieval, unless a longer period is legally required.
• We delete a customer's data within 30 days of any of the following: (1) the customer revokes our authorization; (2) the agreement ends; (3) the customer asks us to delete it; (4) Amazon instructs us to delete it.
• We confirm to the customer once deletion is complete.

9. Your right to revoke

A customer may revoke our authorization at any time from within their own Seller Central account. From that moment we can no longer retrieve their data. No consent or action on our part is required. Under Amazon's rules the authorization is also renewed annually; we contact the customer before it expires, and if it is not renewed, data retrieval stops at that point.

10. Incident response

If data is disclosed, or we suspect it may have been, we contact the customer immediately and ask them to revoke our authorization in Seller Central, which stops all retrieval at once. We notify Amazon at security@amazon.com within 24 hours of detecting or suspecting a security incident. We then identify the cause, apply a remedy, reissue credentials and restore service only after the customer re-authorizes. We record the full course of events and report it to the customer.

If we suspect that a customer is using our service in violation of their agreement with Amazon, we notify Amazon at spapi-abuse@amazon.com and stop retrieving data from that account.

11. Compliance

We operate this application in compliance with Amazon's Acceptable Use Policy, Data Protection Policy and Selling Partner API Developer Agreement, together with other applicable terms.

12. Applicable law and your rights

Winst Inc. is located in Japan and handles personal information in accordance with the Act on the Protection of Personal Information (APPI) of Japan. At present we do not process personal data of individuals located in the EU, so our processing is not subject to the GDPR. Should that change, we will revise and publish this policy accordingly.

A data subject, or their authorised representative, may request notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, or suspension of disclosure to third parties of their retained personal data. Please contact us at the address below. After verifying identity we respond within two weeks as a rule, at no charge. Complaints about our handling of personal information may be sent to the same address.

13. Changes to this policy

We may revise this policy in response to changes in law or in our services. Revisions are published on this page with the date of revision.

14. Contact

Winst Inc. (株式会社Winst)
Representative: Tomoki Katsuyama
KRP BIZ NEXT, 3F KRP Building No.4, 93 Chudoji Awata-cho, Shimogyo-ku, Kyoto 600-8815, Japan
Email: info@winst.co.jp
We reply within 2–3 business days.