Privacy Policy

Profitava is a finance and analytics tool for e-commerce sellers. This policy explains what data we collect, how we use it, how we protect it, and your choices.

1. Who this applies to

This policy applies to the Profitava web application and to the person who holds each Profitava account (“you”).

2. What we collect

• Account data: your email address, a securely hashed password, and (if enabled) an encrypted two-factor authentication secret.
• Amazon selling data: when you connect Amazon (SP-API), we retrieve your orders, fees, settlements, inventory, and returns to calculate profit, cashflow, and taxes.
• Data you enter: cost of goods, expenses, suppliers, deals, gift cards, and other bookkeeping information.
• Bank & card data (only if you connect it via Plaid): account balances and transactions. You log in to your bank inside Plaid’s secure window — we never see or store your bank username, password, card number, or PIN. We receive read-only balances and transactions from Plaid.
• Optional third-party keys: if you provide Keepa, Veeqo, or your own Plaid API keys, they are stored encrypted and used only to make requests on your behalf.

3. How we use it

We use your data solely to provide the service to you. We do not sell your data, and we do not share it with third parties for advertising. We share data only with the service providers that operate the app on our behalf (Section 5), and only as needed to run the service.

4. Consent

We collect and process your data with your consent: you agree to this policy when you create an account, and — for bank data — you provide separate, explicit consent inside Plaid’s Link flow before any account is connected. You can withdraw consent at any time by disconnecting a data source or deleting your account.

5. Service providers

• Render — hosting and managed PostgreSQL database (encryption at rest).
• Plaid — bank/card balances and transactions when you choose to connect an account.
• Amazon SP-API, Keepa, Veeqo — the selling, pricing, and shipping data you connect.

6. How we protect it

• All traffic is encrypted in transit using TLS 1.2 or higher.
• Sensitive credentials and financial access tokens are encrypted at rest using AES-256-GCM.
• All stored data resides in a managed PostgreSQL database with AES-256 encryption at rest.
• Passwords are hashed with scrypt; access requires an authenticated account with optional two-factor authentication; each account can access only its own data.

7. Data retention & deletion

We keep your data only while your account is active. You can delete specific connections (e.g., unlink a bank, which removes its stored transactions) at any time, or delete your account to remove your data. You can also request deletion by emailing support@rejaofficial.com. Requests are actioned within 30 days.

8. Your rights

Depending on where you live (e.g., under CCPA or GDPR), you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. To exercise these rights, contact support@rejaofficial.com.

9. Children

Profitava is a business tool and is not directed to anyone under 18.

10. Changes

We may update this policy as the service evolves. Material changes will be posted here with a new effective date.

11. Contact

Questions or requests: support@rejaofficial.com (REJA LLC).