Privacy Policy

1. Who we are & how to reach us

Follow Up is a product operated by Vendlab Ltd ("we", "us"), trading as Follow Up. We are the data controller responsible for your personal data in relation to this service.

You can contact our Data Protection lead at support@getfollowup.xyz for any privacy request, including access, erasure, or disconnection of your Amazon authorisation.

2. What Amazon data we access — and why

When you connect your Amazon Selling Partner account, Follow Up accesses only the minimum data needed to send compliant review requests through Amazon's official Request a Review API:

• Order records — order identifiers, marketplace, and delivery date, used solely to determine eligibility and timing for the 5–30 day review-request window.
• Buyer-seller messaging metadata — whether a review request has already been sent for an order, so we never exceed Amazon's one-message rule.
• Opt-out and exception flags — buyer opt-out status, refund / A-to-z claim markers, and seller-feedback exceptions, so we automatically exclude ineligible orders.

This data is used for one purpose only: to send Amazon-compliant review requests through the official Request a Review API, within Amazon's permitted timing window. We do not use it for any other purpose.

3. What we never see, store or use

We never receive, store, or use buyer names, email addresses, or postal addresses for any purpose — including marketing. Follow Up never contacts buyers outside of Amazon's own messaging system. A review request is delivered through Amazon's template, on Amazon's infrastructure, and Amazon controls the entire buyer-facing experience.

4. Lawful basis for processing

We process Selling Partner data under two UK GDPR lawful bases:

• Contract (Art. 6(1)(b)) — to deliver the automation service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to operate, secure, and audit the service and maintain compliance records.

5. Retention & deletion

We keep Selling Partner data only for as long as your Amazon account is connected and the service is active. When you disconnect your Amazon authorisation, or request deletion, we remove your order and messaging data within 30 days. Anonymised audit-log entries (timestamps and reasons, with no buyer data) are retained for 24 months for Seller Performance enquiries.

6. Sub-processors & hosting

Follow Up relies on the following sub-processors to deliver the service:

• Cloud hosting & database — Supabase (servers located in the EU) for application data storage.
• Amazon Selling Partner API — the only channel through which review requests are sent.
• Transactional email — used solely for account-related service notifications to you (never to buyers).

We do not sell your data, share it for advertising, or transfer it outside the UK/EEA without a valid adequacy mechanism.

7. Your UK GDPR rights

As a UK / EEA data subject you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to processing;
• Data portability; and
• Withdraw consent and disconnect the integration at any time.

To exercise any of these rights, email support@getfollowup.xyz. We respond within 30 days. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Disconnecting your Amazon account

You can disconnect your Amazon authorisation at any time from the Follow Up settings page. On disconnection, your access tokens are revoked immediately and no further review requests are sent. Your stored order and messaging data is then deleted within 30 days, as described in the retention section above.

9. Changes to this policy

We may update this policy as the service evolves. Material changes will be notified by email to the address on your account, and the "last updated" date above will reflect the change.