Privacy Policy

Iraca is inventory and operations software for product businesses. This policy explains what information we collect, why we collect it, who we share it with, and what control you have over it. It applies to the Iraca web application, its API, the shipping and marketplace features you choose to use, and the public Iraca Marketplace storefronts we operate.

Who we are

Iraca is developed, marketed, and operated by Amenable LLC, registered at 1126 15th Avenue North, St. Petersburg, FL 33704, United States. Where this policy says “we”, “us”, or “our”, it means Amenable LLC. For the business data you enter into Iraca, you are the data controller and we act as your processor: it is your data, held on your behalf. For your own account and billing information, we are the controller.

Who this policy covers

Three distinct groups of people appear in Iraca, and the distinctions matter:

• Customers — the businesses that subscribe to Iraca, and the individual users on their teams.
• Third parties whose details our customers store — their own customers, suppliers, and contacts. We process this information only to provide the service to the customer who entered it. If you believe a business is holding your details in Iraca and you want them changed or removed, contact that business directly; we will support them in acting on your request but we cannot act on their data alone.
• Storefront buyers — people who register on an Iraca Marketplace storefront to browse vendors and contact them. A buyer account is held with the storefront, not with any individual vendor, and we are the controller for it.

Information we collect

We collect only what the service needs to function:

• Account information — name, email address, phone number, company name and business details, and a securely hashed password. Never a password in readable form.
• Business records you enter — products, recipes, inventory levels, purchase and sales orders, invoices, and the contact details of your customers and suppliers, including names, email addresses, phone numbers, and shipping addresses.
• Data from services you connect — where you authorize a marketplace or sales channel integration, the orders, listings, fees, financial transactions, and advertising reports that integration returns.
• Shipping details — where you buy a shipping label through Iraca, the recipient's name, address, and phone number, the parcel's weight, dimensions, and declared contents, and the tracking information the carrier returns.
• Storefront buyer accounts — where you register as a buyer on an Iraca Marketplace storefront, your name, email address, company, country, buyer role, verification status, any plan you subscribe to, and the inquiries you send to vendors.
• Billing information — subscription plan, invoices, and payment status. Card numbers are handled entirely by our payment processor and never reach our systems.
• Technical information — IP address, browser and device type, and server logs, used to operate, secure, and debug the service.

How we use it

We use this information to provide and operate Iraca: to run the features you use, to sync your connected sales channels, to produce the shipping labels you buy, to process subscription payments, to send service and account emails, to provide support, to detect and prevent abuse, and to meet our legal obligations. We do not use your business data to build advertising profiles, and we do not sell or rent personal information to anyone.

Connected marketplaces and advertising accounts

Iraca can connect to third-party services on your behalf — including Amazon Selling Partner and Amazon Ads, Shopify, WooCommerce, Etsy, Walmart, and TikTok Shop. These connections are always started by you and require your explicit authorization on the provider's own consent screen.

• We request only the access the features you enable require, and we read data from these services solely to display and process it inside your own Iraca account.
• Advertising integrations are used for reporting only. Iraca reads campaign and product-level performance data so that you can see advertising cost against your own sales. Where a provider grants campaign management permissions as part of a single combined scope, Iraca does not create, edit, pause, or bid on campaigns.
• We never share data obtained from these integrations with other Iraca customers, and we never sell it or use it to train machine learning models.
• Access tokens are encrypted at rest. You can disconnect any integration at any time from Settings, and you can also revoke Iraca's access from the provider's own account settings. Disconnecting stops future syncing; records already imported remain in your account until you delete them.

Iraca Marketplace storefronts

We operate public, co-branded storefronts on which Iraca customers can list their products. Some are run by us; others are run by an independent operator — a farmers market association, an export group — under their own brand.

• Buyer accounts. If you register as a buyer, we hold your account details, your declared role and verification status, and any plan you subscribe to. Your account is with the storefront, not with any individual vendor.
• Inquiries. When you contact a vendor through a storefront, we pass your name, email address, company, country, and message to that vendor so they can reply to you. From that point the vendor holds your details and their own privacy practices apply.
• Operators. Where a storefront is run by an independent operator, that operator can see the vendors listed on it, the buyer accounts registered on it, and the inquiries submitted through it, so that they can run and moderate their storefront. They act as a separate controller for that use.
• Vendor listings. What a vendor publishes on a storefront — product details, photos, business description, certifications — is public by their choice. Some fields are visible only to registered or subscribed buyers, as the operator configures.

Shipping and fulfillment

Where you buy a shipping label through Iraca, we send the recipient's name, address, and phone number and the parcel's details to our shipping provider, EasyPost, and to the carrier that will carry the shipment — USPS, UPS, FedEx, or another you select. This is unavoidable: a parcel cannot be addressed without it. Where you connect your own carrier account instead, your credentials are encrypted at rest and used only to fetch rates and buy labels on your instruction. Carriers are independent controllers of the shipment data they receive, and their own privacy policies apply to it.

Payments

Subscription payments are processed by Stripe. Card details are entered directly into Stripe's payment form and are never transmitted to or stored on Iraca's servers. We retain only the subscription status, the invoice history, and a non-identifying reference such as the last four digits and card brand. Stripe's own privacy policy governs its handling of that data.

Who we share information with

We share information only with the service providers we need to operate Iraca, each bound to protect it and to use it only on our instructions:

• Stripe — subscription billing and payment processing.
• Our hosting and database provider — application hosting and data storage.
• Resend — transactional and notification email delivery.
• Backblaze B2 — storage of files and documents you upload or generate.
• EasyPost and the shipping carriers you use — recipient addresses and parcel details, to produce labels and track shipments.
• Iraca Marketplace storefront operators — vendor, buyer, and inquiry data for the storefront they run, as described above.

How we protect it

All traffic to Iraca is encrypted in transit with TLS. Marketplace credentials, carrier credentials, and API tokens are encrypted at rest. Access to production systems is restricted to personnel who need it. Every customer's data is separated by tenant, and the application enforces that separation on every request. No system is perfectly secure, but we treat a breach of your business data as the most serious failure we could have, and we will notify affected customers promptly if one occurs.

How long we keep it

We keep your data for as long as your account is active. If you close your account, we delete or anonymize your business data within 30 days, except where we are required to retain records for longer — invoices and payment records, for example, are kept to satisfy tax and accounting obligations. You can export your data before closing your account.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable format, or to object to or restrict certain processing. Much of this is available directly in the application; for anything else, contact us using the details below and we will respond within the period the applicable law requires. You also have the right to complain to your local data protection authority.

Cookies

Iraca uses cookies and equivalent browser storage that are strictly necessary to run the application — keeping you signed in, maintaining your session, and remembering preferences such as your chosen language. We do not use advertising cookies or third-party tracking cookies.

Children

Iraca is business software and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy as the service changes. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will notify you by email or in the application before it takes effect.

Contact us

For any question about this policy, or to exercise any of the rights described above, email us at privacy@iraca.app or write to Amenable LLC, 1126 15th Avenue North, St. Petersburg, FL 33704, United States.