Privacy Policy

1. Who We Are

The Inner Circle FBA ("we", "us", "our") is a private Amazon FBA mentoring and leads community operated by Lew Hull, based in the United Kingdom. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For data protection queries, contact us at: support@theinnercirclefba.com

2. Data We Collect

We collect and process the following types of personal data:

• Identity & Contact Data: Your name and email address, collected when you purchase a membership or contact us. Your email address is also how you sign in to our app (see section 12).
• Payment Data: Payment card details are processed by Stripe and are not stored by us. We retain transaction records (amount, date, subscription status) for accounting purposes.
• Discord Data: Your Discord username, user ID, and account information collected when you authorise Discord access as part of onboarding on our website.
• Usage Data: Information about how you interact with our website, including IP address, browser type, pages visited, and referral source (collected via cookies and analytics tools).
• Member Tool Data: Your member account ID and what you save or look up in our tools, such as product costs, buying rules, Repricer rules and recent scans, together with any Amazon seller data you choose to connect (see sections 10–12).
• Communications: Any messages you send to us via email or Discord.

3. How We Use Your Data

We use your personal data to:

• Process your membership and manage your subscription (legal basis: contract performance)
• Grant and manage your access to our Discord community (legal basis: contract performance)
• Sign you in and provide the member tools on our website, Chrome extension and app (legal basis: contract performance)
• Send you service-related communications, such as billing updates and membership changes (legal basis: contract performance)
• Respond to your enquiries and support requests (legal basis: legitimate interests)
• Improve our website and services through analytics (legal basis: legitimate interests)
• Comply with our legal and regulatory obligations (legal basis: legal obligation)

4. Third Parties We Share Data With

We share your data only where necessary with trusted third parties:

• Stripe: Payment processing. Stripe is PCI-DSS compliant. See Stripe's Privacy Policy.
• Discord: Community platform. Your Discord account is governed by Discord's Privacy Policy.
• Supabase: Secure database storage for subscriber records. Data is stored in EU/UK regions.
• Vercel: Website hosting. See Vercel's Privacy Policy.
• Calendly: Booking system for mentorship calls. See Calendly's Privacy Policy.
• Resend: Email delivery, including the sign-in codes for our app.
• Amazon, Keepa and eBay: Product data. When we look up a product for you, they receive product details such as a barcode number, ASIN or search words, never your name or email address (see sections 10 and 12).

We do not sell your personal data to any third parties.

5. Cookies & Affiliate Tracking

Our website uses essential cookies required for the site to function, including a session cookie for the member portal. It also sets two 30-day attribution cookies: one when you arrive via a member's share link, so that member is credited, and one on your first visit that records how you found us (for example, the advert, campaign or website that sent you and the page you first landed on), so we can see which of our marketing leads to new memberships. When the first-visit cookie is set, we also log those details with your browser type and a one-way hash of your IP address. If you click Accept All on the website's cookie banner, we may also set optional cookies: analytics cookies (PostHog) to understand how visitors use the site, and advertising-measurement cookies (the Meta Pixel and TikTok Pixel) to see which of our adverts lead to visits and sign-ups. None of these optional cookies are set unless you accept.

Our app does not show this banner, so these optional analytics and advertising cookies are never set in the app. The first-visit attribution cookie is not set in the app either, and app visits are not logged for attribution.

Affiliate cookies set by third parties: When you click an outbound link on our website to a partner we have an affiliate relationship with — including Amazon Associates UK, software providers (SellerAmp, Sellerboard, Profit Protector Pro, Sagemailer), business-banking partners (Tide, American Express), and cashback platforms (TopCashback, Quidco, Honey, Pouch) — that partner may set a cookie on your browser to attribute any subsequent purchase or sign-up back to The Inner Circle FBA. We do not set or have access to these cookies; they are governed by each partner's own privacy policy. See our affiliate disclosure for full details.

You can control cookies through your browser settings. Note that disabling cookies may affect site functionality.

6. Data Retention

We retain your personal data for as long as your membership is active and for a period of 7 years thereafter for accounting and legal compliance purposes. Discord access is revoked upon cancellation. You may request earlier deletion of your data (see Your Rights below).

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — request we limit how we use your data
• Right to portability — request your data in a portable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at support@theinnercirclefba.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All payment processing is handled by Stripe and is never stored on our own servers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via Discord or email. Continued use of our Service after changes constitutes acceptance of the updated policy.

10. Amazon Selling Partner API (SP-API) Access

Members on paid tiers may choose to connect their Amazon Seller Central account to The Inner Circle FBA via Amazon's Login With Amazon (LWA) authorisation flow. This connection is entirely optional. The terms below apply only if you grant this consent.

What we access: we read only the data needed to compute the dashboard, repricer recommendations, and accounting exports we offer:

• Finance and Accounting role — financial events (shipments, refunds, fees, reimbursements, ad spend, storage fees) for the seller's own account.
• Inventory and Order Tracking role — current FBA inventory summaries (fulfillable, inbound, reserved quantities) for the seller's own ASINs.
• Pricing role — competitive pricing and Buy Box data for the seller's own ASINs, used to generate repricing recommendations.
• Product Listing role — product titles and SKU↔ASIN mappings to label dashboard rows with recognisable product names.

What we do NOT access: we never request or read buyer personally-identifiable information (names, email addresses, shipping addresses), payment instrument data, order-personalisation messages, or any data outside the seller's own account.

Price changes: if you use the Repricer, we update your listing prices on Amazon through your connection, either when you apply a recommendation or automatically for rules where you have switched on automatic repricing. Every price change is logged.

How it's stored: the long-lived refresh token issued by Amazon is encrypted at rest using AES-256-GCM with a key held separately as an environment variable. Synced records (financial events, inventory snapshots, cost-of-goods you enter) are stored in our managed PostgreSQL database (Supabase, EU region) which itself encrypts every table at rest as part of its baseline. Data is used only to render your own dashboard — never aggregated, anonymised, sold, or used in model training.

How long we keep it: for the duration of your active membership. If you disconnect your Amazon account or cancel your membership, we delete your synced Amazon data within 30 days. Earlier deletion is available on request via the email address below.

How to disconnect: click "Disconnect" on the Amazon connection card inside your dashboard. This wipes our copy of your refresh token immediately and stops any further sync runs against your account.

Sub-processors for SP-API data: Supabase (PostgreSQL hosting, EU region) and Vercel (serverless compute, EU region). No other third party processes Amazon Information.

For our internal incident response procedure governing this data, see Data Handling.

11. Chrome Extension (Inner Circle Companion)

Members may install the Inner Circle Companion Chrome extension (current version 2.1). It surfaces profit, ROI, fees, sales velocity, Buy Box ownership, risk flags, seller-account eligibility and your own stock on Amazon UK product pages, adds a compact quick view to Amazon UK search pages, assists with ungating on Seller Central, opens a sourcing sidebar on eleven UK retailer sites, and can check your restock watches from your own browser. The terms below apply only if you install and connect the extension. This section is kept word-for-word consistent with the extension's Chrome Web Store data disclosures.

What the extension reads on Amazon UK product pages: the ASIN from the URL and, from the page, the displayed price, product title, brand byline, main image URL, the category text in the product details, sibling variation ASINs, the "bought in past month" badge, the offer/seller count and the maximum of the quantity selector. It does not read reviews, your Amazon account details, your basket, or anything unrelated to the product on screen.

On Amazon UK search, browse, best-seller and brand-store pages: the ASIN and title of each result card, to place IP-claim warnings and a quick view of rank and sales.

What is sent to our servers automatically when you are connected: every product page you open is logged to your own dashboard history (ASIN, product title, the prices in the calculator inputs and the monthly-sales figure shown). The brand byline is sent for the IP-claim watchlist check; the bought-badge figure and sibling ASINs are sent with the sales-data request; the quantity-selector maximum and seller count are sent for sales-velocity modelling. On search pages, up to 50 ASINs per request are sent for the quick view. On Seller Central Manage Inventory pages, up to 50 ASINs are sent to fetch your Repricer rules. On the eleven retailer sites, the product title (first eight words) is sent on product pages to find the matching Amazon listing, and anything you type into the sidebar's search box is sent as a search. All of this goes to theinnercirclefba.com over HTTPS and nowhere else.

Sent only when you click: Save COG (the cost you typed), Watch, Save to Deals (title, brand, image URL and every figure on screen), Log Win, the ungating outcome you choose to log, and Apply this price in the Repricer overlay.

What we store: per-ASIN viewing history (so we can show "you viewed this 5× before"), buy prices you save (as ex-VAT, so they survive VAT-mode changes), deals and wins you log, and verdict snapshots for the personal accuracy feedback loop. All of this is stored in our managed PostgreSQL database (Supabase, EU region) under your Discord ID. It is used only to render your own dashboard — never aggregated, anonymised, sold, or used to train models.

Authentication: the extension uses Chrome's chrome.identity.launchWebAuthFlow API to complete a one-time handshake with our dashboard. Your Discord login happens in our normal web flow — the extension never sees your Discord password or session cookie. The result is an opaque bearer token (prefix eict_) stored in chrome.storage.local on your machine. Server-side we keep only sha256(token); we cannot recover the original token if it leaks from your machine.

Seller Central helpers: the extension activates on sellercentral.amazon.co.uk and sellercentral-europe.amazon.com. Ungating helper: on listing-restriction application pages it reads the ASIN and inspects the form's structure (file inputs, required checkboxes, required fields, submit button). Only when you click our "Submit application" button, and only on forms with no invoice upload and no empty required field, does it tick the required checkboxes and press Amazon's submit button. It never fills in text fields, never uploads anything, and never submits on a timer. When it sees an invoice-required form it sends the ASIN plus a fixed label to our community ungating database automatically so the database can self-correct. Repricer overlay: on Manage Inventory pages it reads ASIN-shaped strings on the page, fetches your Repricer rule and recommended price for each, and shows them in a panel; clicking Apply this price changes that listing's price through your own Selling Partner API connection. No seller credentials, sales reports, order data or customer data are read.

Retailer sourcing sidebar: on argos.co.uk, bmstores.co.uk, homebargains.co.uk, therange.co.uk, diy.com, boots.com, superdrug.com, tesco.com, sainsburys.co.uk, groceries.morrisons.com and ebay.co.uk, the extension reads the page heading and price to decide whether you are on a product page. On product pages it opens a sidebar and, when connected, sends the product title to find the matching Amazon listing; on other pages it only waits for the right-click "IC Companion Search" menu item. The sidebar has an editable "Buy price" field so you can correct or fill in a price it didn't detect. Result thumbnails are loaded from Amazon's image CDN without cookies or referrer.

IC Companion Search on any website: the same right-click menu item also works on websites we don't have a tuned sidebar for. Clicking it on another site opens the identical sidebar there, for that one tab, using your browser's standard "allow this action on the current tab" permission (technically: activeTab) rather than standing access to that site. On these untuned sites the extension has no per-site selectors, so it reads only the page's title and, if present, a standard schema.org/Open Graph/JSON-LD product price tag — the same semi-standard markup Google Shopping relies on — leaving the price blank for you to type in when that isn't there. This never runs until you right-click and choose the menu item, and stops working the moment you navigate away from that tab.

Connect via Extension (retailer accounts): on the dashboard's Reverse Search page you can click "Connect via Extension" for Costco UK, eany.io, Toolstation, Screwfix, Booker or Weldricks. Only on that explicit click, the extension reads every cookie your browser holds for that retailer's domain — including its login session cookie — and sends them to our server, where they are encrypted at rest and used solely to fetch your trade prices for Reverse Search. Nothing is read from those domains at any other time. You can disconnect a retailer from the same page.

Restock watches: if you set restock watches in the dashboard, the extension's background worker fetches each watched product page from your own browser (with your logged-in session on that site, so regional stock is seen) every five minutes, and once whenever the worker starts, and reports in-stock / out-of-stock and price back to your dashboard. Only URLs you chose to watch are fetched, and only on sites the extension already has permission for.

Permissions explained:

• storage — the bearer token, a five-minute cache of your name and tier for the popup, your batch-ungating queue, and a five-minute cache of the public IP-claim watchlist. Page-scoped storage also holds your saved cost per ASIN, the panel's collapsed state, a ten-minute cache of the last sales data, a thirty-minute ASIN memory on Seller Central and a per-session "sidebar hidden" flag.
• identity — required by chrome.identity.launchWebAuthFlow for the one-time handshake.
• contextMenus — the right-click "IC Companion Search" item, shown on every website.
• activeTab + scripting — together let that same search item work on websites outside the eleven tuned retailer sites, without giving the extension standing access to the rest of the internet. activeTab grants access to only the tab you just right-clicked in, for that one action; scripting is what lets the extension then show the sidebar there.
• cookies — used only by Connect via Extension, on your explicit click, for the six retailer domains listed above.
• alarms — the five-minute restock-watch timer.
• Host permissions — amazon.co.uk (product and search overlays), the two Seller Central hosts (ungating helper and Repricer overlay), theinnercirclefba.com (our API and dashboard), the eleven retailer sites (sourcing sidebar and restock checks), and the six retailer cookie domains (Connect via Extension).

How to disconnect / uninstall: click Disconnect in the extension popup to wipe the token from your machine; the extension can then make no further requests on your behalf. To remove the extension entirely, go to chrome://extensions, find Inner Circle Companion, and click Remove. To delete the data we stored about your viewing history, saved buy prices, deals and connected retailers, email support@theinnercirclefba.com from your registered address and we will erase it within 30 days.

Data we never collect: we never read or transmit your browsing history, bookmarks, passwords, autofill data, payment methods, content from other tabs, your Amazon order history, your Amazon basket, or your buyer messages. The one exception to "the sites listed above" is IC Companion Search, described above — it reads a page's title and a standard product-price tag ONLY on the single tab and single click where you chose to run it, never automatically and never from any other tab. The extension's single purpose is to help you make Amazon UK sourcing decisions on the page you are already looking at.

12. Inner Circle FBA Mobile App

This section supplements (does not replace) the rest of this policy. It covers our iOS app, which uses the same Inner Circle FBA member account as the website. It sets out what the app collects and why, what it sends to other services on your behalf, and how to delete it.

Signing in:

• Email address: you sign in with the email address on your membership. We send a six-digit code to that address through our email provider, Resend. The code expires after 15 minutes and can be used once. The code is written in that email, so it passes through Resend; our own database stores only a one-way hash of it, never the code itself, along with the email address, how many times the code was tried, and when it was requested and used. In the app, your email address is used to match you to your membership and send your sign-in codes, to show which account you are signed in to (More → Account), and, if you ask us to delete your account, to let our support team find your account and confirm the deletion with you by email.
• Member account ID: once you are signed in, a secure sign-in cookie holds your member account ID so the app shows your own data and you stay signed in. Signing out (More → Account → Sign out) removes it. What the app saves for you on our servers, listed below, is stored against your member account.

What the app saves to your account: the items below are linked to your member account and used only to provide the app and our other member tools. None of it is used for advertising or tracking, and none of it is sold.

• Your Amazon seller data: the Profit, Inventory and Repricer screens show sales, fees, costs, stock levels and prices from your own Amazon seller account, synced through the Amazon connection described in section 10.
• Repricer: when you tap Apply in the Repricer, we change that listing's price on Amazon through your connection (see section 10), and the change is logged against your account.
• Scan history on your account: when you scan or type a barcode on the Scan tab with Amazon chosen, the product's barcode number, ASIN, title and image link, the time of the scan and the fact that it came from the app are also saved to your account, so your recent scans are available in our other member tools. This account copy is not the Recent scans list you see on the Scan tab, which stays on your device (see below). We keep only about your 50 most recent and delete older ones automatically. The account copy never includes the profit or ROI you work out, and scans in in-shop mode or with eBay chosen are not saved to your account.
• Costs and settings you enter: product costs, your buying rules (such as minimum ROI and profit) and your Repricer rules are saved to your account, so they match your website dashboard.

What the app does not save to your account:

• Product searches: the words, barcodes and ASINs you look up in Search products are used for that lookup only and are not saved to your account.
• Kept only on your device: the Recent scans list on the Scan tab (which includes in-shop scans), your Scorecard (including any profit and ROI you work out), your Buying List and recently loaded results are kept in the app's own storage on your device. Clear, next to Recent scans on the Scan tab, empties that list and your Scorecard on this device only. It does not delete the scan history on your account, which is deleted with your account, or sooner if you email us. Share list passes your list to your device's share sheet, and you choose where it goes. Deleting the app removes this data.

Camera access (barcode scanning):

• No images or video are captured. The camera feed is processed live, on your device, by the app's built-in barcode scanner. Frames never leave your device.
• What we receive: only the barcode number (8–14 digits), which we use to look up the product as described below.
• What we don't receive: any image data, GPS location, ambient sound, or other sensor readings.
• Permission control: Settings → Inner Circle FBA → Camera. Revoking it disables scanning; the rest of the app works fine.

Product lookups made on your behalf: to identify and price a product you scan or search for, our servers send the barcode number, ASIN or search words to Amazon (including the Amazon Selling Partner API) and Keepa (price and sales-rank history), and, if you choose eBay in the scanner, the barcode number to eBay. These lookups contain product details only, never your name, email address or member account details, and nothing is shared with these services for advertising. If you have connected your Amazon seller account, some Amazon lookups (for example, whether you can sell a product) go through your own connection, so Amazon sees them as coming from your seller account. Product images in the app load directly from Amazon's image servers.

Push notifications: push alerts are not available in this version of the app. The app does not ask for notification permission and does not collect a device token. If we add push alerts in a future version, we will update this section first, and alerts will only be sent if you allow them.

No tracking and no ads: the app shows no advertising and uses no third-party analytics, advertising or crash-reporting services. It does not track you across other companies' apps or websites, it does not access your device's advertising identifier, and we never sell your data. If we ever turn on crash reporting in the app, we will update this section first.

Data we never collect from the app: your contacts, photo library, calendar, microphone, location, camera images, browsing history outside our domain, other apps installed on your device, biometric data, advertising identifiers, or device hardware fingerprints.

Deleting your data: you can ask us to delete your account from inside the app. Go to More → Account, tap "Request account deletion", then "Request deletion". We will delete your account and the data linked to it, including your profit history, scan history, saved deals and settings, and confirm by email within 30 days. Records the law requires us to keep, such as records of your payments for tax and accounting, are not deleted: we keep them for up to 7 years after your membership ends (see section 6) and use them only for that purpose. You can also email support@theinnercirclefba.com. Data kept only on your device is removed when you delete the app.

Children: the app is not directed at children under 16. We do not knowingly collect data from anyone under 16.

13. Contact

For any privacy-related questions or to exercise your rights, contact us at:

support@theinnercirclefba.com