Privacy Policy
1. Controller and contact
This site is operated by Yiwu Xiran Culture Communication Co., Ltd. (义乌市熙然文化传播有限公司), China, the owner of the Amazon selling account that uses it ("we"). For any privacy question, data subject request or security concern, contact privacy@hub.magirig.com.
2. What this application is
Seller Hub is a private, single-user operational tool. It is not a public service, has no user registration, and is not used by or on behalf of any other seller. It displays our own product catalogue and prints FNSKU labels for our own inventory.
3. Categories of data processed
- Product and listing data about our own goods: SKU, ASIN, FNSKU, title, images, price, stock quantities, listing status, category and product identifiers, retrieved from Amazon SP-API and cached in our own database.
- Administrator authentication data: a salted scrypt password hash, a TOTP seed, a SHA-256 hash of the session token, the session expiry time, and a per-minute count of login attempts. The plaintext password and plaintext session token are never stored.
- Technical logs produced by the hosting platform (request time, status code, runtime errors). These logs do not contain Amazon access tokens or refresh tokens.
4. Purposes and legal basis
Product data is processed to run our own shop (inventory visibility and FBA labelling) under our legitimate interest in operating the business and in performance of our seller agreement with Amazon. Authentication data is processed to restrict access to the application, which is also a security requirement of the Amazon Data Protection Policy.
5. Cookies
One first-party session cookie named __Host-seller_hub is set after an administrator
successfully authenticates. It carries an opaque random token and is marked Secure,
HttpOnly, SameSite=Strict, scoped to Path=/ with no
Domain attribute, and expires after 8 hours. It is not shared with third parties and is
deleted on logout. No consent banner is required because no non-essential cookies are used.
6. Recipients and processors
| Amazon | Source of the product data and recipient of API requests. Data is not sent back to Amazon except as required to call SP-API. |
|---|---|
| Hostinger | Provides the managed web hosting and MySQL database where the cache and session hashes are stored, under its own data processing terms. |
| Local print agent | A process running on our own machine inside our local network that downloads label documents and sends them to a local thermal printer. No data leaves our network to any other party. |
We do not sell data, do not share it for advertising, and do not transfer it to unrelated third parties.
7. Retention and deletion
Product cache entries are kept only while the corresponding listing is in use and are overwritten on synchronisation. Expired session hashes are purged at application start and on login. Login attempt counters cover only the current one-minute window. Any personally identifiable information received by mistake is deleted within 30 days. See Data Retention & Deletion.
8. Security
All traffic is served over HTTPS/TLS. Administrative access requires a password and TOTP multi-factor authentication, is rate limited, and uses signed-opaque session tokens, strict CSRF origin checks and a restrictive Content Security Policy. Credentials are supplied as environment variables outside the web root and are never hardcoded or committed to source control. Full details are on the Security page.
9. Your rights
Where data protection law applies, you may request access, correction, deletion or restriction of your personal data, or object to processing, by writing to privacy@hub.magirig.com. As the application holds no buyer data, such requests normally concern only the administrator account itself.
10. Changes
This policy is reviewed at least every six months and after any security incident. Material changes are published on this page with an updated effective date.