Privacy Policy

1. Who we are

ReclaimHQ is operated by ReclaimHQ Ltd (registered at Companies House as RECLAIMHQ LTD), a company registered in England and Wales (company no. 17042386, 4 Leckwith Drive, Bridgend, CF31 4JH). We are the data controller for the personal data described in this policy and are registered with the Information Commissioner's Office (ICO). If you have any questions about this policy, contact us at hello@reclaimhq.uk.

2. What data we collect

When you use ReclaimHQ, we collect:

• Account information: your name, email address, company name, and password (hashed). If you link a Discord account for support, we store your Discord user ID.
• Amazon data: removal order IDs, product names, ASINs, SKUs, tracking numbers, shipment dates, reimbursement records, customer return records, inventory data, support case content, and related Amazon Marketplace information that you import via the Chrome extension or that is retrieved via the Amazon Selling Partner API on your behalf after you authorise access. In this policy, "Amazon data" means this information and anything we work out from it for you, such as claim deadlines, reimbursement shortfalls and your conversations with Tarquin about your Amazon cases.
• Your own business records: the cost of goods (COG) list you upload or type in, the purchase invoices you upload or sync from Google Drive, and your records of the stock you hold and sell (condition, location, cost, your own photos and your eBay listings). These are your records, not Amazon data.
• eBay postage labels and packing slips: if you connect your eBay account and use the ReclaimHQ Warehouse with the ReclaimHQ extension, we store eBay's own packing slip (invoice) for each sold order awaiting dispatch, fetched from your eBay account ahead of printing so it is ready when you print, and the postage label for each order you print. Both documents contain your buyer's name and delivery address. They are stored privately in your account and used only to print and reprint that order's label and packing slip. When eBay sells a drop-off QR code instead of a postage label (such as for an InPost locker or shop), we store that QR code in the same way, for showing and printing it, and delete it on the same schedule. We do not keep a QR code that eBay issues alongside a postage label. We do not fetch a packing slip again for an order dispatched more than 30 days ago. We delete both documents 90 days after the order is dispatched, or 90 days after the sale if it is never dispatched; we delete the packing slip as soon as we see the order is cancelled, and both documents sooner if eBay tells us the buyer has closed their eBay account. We also keep the recipient's name and postcode with the order, to help you match a damaged label to its order. We delete them 90 days after the order is dispatched, or 90 days after the sale if it is never dispatched, and sooner if the order is cancelled or eBay tells us the buyer has closed their eBay account.
• eBay buyer messages: if you connect your eBay account with message access, the Warehouse reads your conversations with eBay buyers from eBay each time you or your team open it, so you can read and answer them in ReclaimHQ. We do not store the messages: they stay in your eBay account and are read again each time they are shown, and a reply goes to eBay only when you press Send. We keep a record that a reply was sent (when, by whom and how long it was), never its words.
• eBay buyer offers: if you connect your eBay account, the Warehouse reads the offers buyers have made on your listings from eBay each time you or your team open it (the offer, the buyer's eBay user name and feedback score as eBay shows them, and any message the buyer added), so you can accept, counter or decline them in ReclaimHQ. We do not store them: they stay in your eBay account, and an answer goes to eBay only when you press it. We keep a record that an offer was answered (when, by whom, the amounts and the outcome), never the buyer's user name or anyone's message.
• Payment information: processed securely by Stripe. We do not store your card details.
• AI conversation data: messages exchanged with the Tarquin claims assistant and the Susi support assistant, including your inputs and AI-generated responses. Conversations are stored so your chat history is available to you. Once a week we review a sample of recent Tarquin conversations to improve Tarquin's guidance; they are never used to train AI models. Conversations with Tarquin about your Amazon cases are Amazon data and are deleted with it (section 11). Conversations with Susi are support messages and are kept while your account is open.
• Security and service logs: your IP address, browser user agent, approximate location (country), and a device identifier, recorded in our append-only security audit log when you sign in or perform sensitive actions. We do not use third-party analytics or advertising trackers.
• Support content: support tickets, bug reports, and feature requests you submit, including messages exchanged in our Discord support channels.
• Affiliate payout details: if you join our affiliate programme, the invoicing details you provide and the bank details we need to pay you (bank details are encrypted at rest).

3. How we use your data

We use your data to:

• Provide and improve the ReclaimHQ service, including syncing your marketplace data, tracking claim deadlines, and drafting claims with the AI assistant.
• Process your subscription payments via Stripe.
• Send transactional and service emails (account confirmation, password resets, billing receipts, claim-deadline alerts).
• Respond to support requests via email and Discord.
• Occasionally invite you to leave a review, and send marketing emails where permitted (every marketing email carries a one-click unsubscribe).
• If you choose to join a liquidation operator's organisation, share your removal stock data (products, quantities, conditions, costs, and photos) with that operator from a dispatch date you control.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Lawful bases for processing

Under UK GDPR, we rely on the following lawful bases:

• Contract: providing the service you subscribe to, including account management, syncing your marketplace data, processing your claims data, billing, and transactional email.
• Legitimate interests: security logging and the audit trail, fraud and abuse prevention (including rate limiting), service emails about problems affecting your account, review invitations, and the first-party rhq_aff referral/affiliate attribution cookie set when you arrive via a referral link (see section 9).
• Consent: marketing emails, and sharing your data with a liquidation operator you choose to join.
• Legal obligation: retaining accounting and billing records as required by UK tax law.

Where we rely on consent, you can withdraw it at any time.

5. Data storage and security

Your data is stored securely using Supabase (PostgreSQL) with row-level security policies ensuring you can only access your own data. All connections are encrypted via TLS. Passwords are hashed using bcrypt. API keys are stored as one-way hashes.

Application-level encryption: commercially sensitive fields, including cost of goods (COG), target sale prices, removal fees, recovery amounts, and invoice filenames, are encrypted at rest using AES-256-GCM with per-user encryption keys. Each account's data is encrypted with its own key, so access to the database alone does not reveal your commercial figures. They are decrypted only by the service when your account needs them: to show them to you, to run scheduled checks such as leak scans, to draft claims, and, if you use managed claims, for the claims specialist working your account.

The Chrome extension does not store your Amazon credentials. It only imports the order data you choose to send to ReclaimHQ.

6. Amazon Marketplace data

When you connect your Amazon Seller Central account to ReclaimHQ, we access your Amazon Marketplace data solely to provide the ReclaimHQ service to you. This includes removal order data, reimbursement records, inventory information, customer return records, and financial transaction data.

• Purpose limitation: We use your Amazon data only to provide, maintain, and improve the ReclaimHQ service for your account. We do not use your Amazon data for advertising, profiling, or any purpose unrelated to the service you have authorised.
• No competitive use: A company under common ownership with ReclaimHQ Ltd, and members of our team, operate their own Amazon selling businesses. We will never use your Amazon Marketplace data, including your product catalogue, ASINs, SKUs, suppliers, cost prices, sales, or inventory, to inform, source, or benefit our own (or any other party's) selling activity, to identify or replicate products, or to compete with you in any way. Internal access is limited to operating and supporting the service and is recorded in a tamper-evident audit log.
• Sharing: We never sell, rent or license your Amazon data, and never use it for anyone else's selling. We share it only as necessary to operate the service (the providers listed in section 7 and at reclaimhq.uk/subprocessors, and, for managed customers only, our claims specialists), with eBay when you, or a liquidation partner you joined, price or list your stock there (Amazon catalogue identifiers such as the part number, barcode and brand go into eBay's searches to price or match an item, even one that is never listed, and the Amazon product details of a listing go to eBay when it is published), with a product price-history service, which receives only the ASINs and barcodes of your stock and, when you ask us to find an item on Amazon by its name, the product name you typed, never any personal data, to look up their Amazon prices and products, or with a liquidation partner you choose to join, who sees your removal-order data and the Amazon product details of the stock it lists for you.
• Data retention: While the subscription on your account is active, we keep your Amazon data for as long as it is needed to provide the service to you, because claim deadlines, reimbursement checks and reversal checks all depend on your history. Inventory ledger records more than 18 months old are deleted automatically, because Amazon's own ledger covers 18 months.
• Disconnecting and deletion: Disconnecting Amazon in Settings, Integrations stops the sync and deletes our access tokens straight away; removing ReclaimHQ's access in Seller Central stops our access at Amazon's end. When you disconnect Amazon or remove our access in Seller Central and no other Amazon connection remains on your account (a Chrome extension key that is still active counts as one, and so does our claims specialist's access while you use our managed claims service), or your subscription ends, you ask us, your account is closed or Amazon tells us to, we permanently delete your Amazon data within 30 days. Revoking a Chrome extension key on its own does not start a deletion; email us if you want one. These rules follow section 1.7 of Amazon's Data Protection Policy. Section 11 has the detail, including the billing records UK tax law requires us to keep.
• Security: All Amazon data is encrypted in transit using TLS 1.2 or higher and encrypted at rest. Commercially sensitive fields are additionally encrypted using AES-256-GCM with per-user encryption keys, as described in section 5.

7. Third-party services

We use the following third-party services to operate ReclaimHQ:

• Supabase: database, authentication, and file storage (our primary data store).
• Vercel: application hosting and serverless compute.
• Stripe: payment processing. Card details go directly to Stripe and never touch our servers.
• Resend: transactional and service email delivery.
• Anthropic: AI model provider powering the Tarquin claims assistant, the Susi support assistant, the eBay listing tools and drafted replies to eBay buyers' requests and messages. For Tarquin and Susi, conversation content and relevant order and case context are sent to Anthropic's API to generate responses. For the eBay listing tools, the photos of the item you are listing, the fault notes you type and product details such as the title, brand and catalogue text are sent to read the item, grade its condition and write the listing. When you ask ReclaimHQ to draft a reply to an eBay buyer's request (an item not received request, a return or a cancellation), the request's reason, the buyer's own words and the amount, with the order's title, sale and dispatch dates, carrier, tracking number and tracking status, are sent to draft it; never the buyer's eBay user id or address. When you ask ReclaimHQ to draft a reply to an eBay buyer's message, the messages in that conversation (with email addresses, phone numbers, web links and postcodes taken out first), the listing's title, condition and price, the order details above when the conversation is about the buyer's own order, and a few of your own earlier replies to buyers (so the draft matches how you write) are sent to draft it; never the buyer's eBay user id or the order's delivery address. You read and edit every drafted reply, and nothing is sent to the buyer until you press Send. Anthropic's commercial terms exclude using our customers' data to train its models.
• Upstash: rate limiting and abuse prevention infrastructure, and short-lived caches for the eBay listing tools. Processes IP addresses and hashed identifiers (such as hashed email addresses and user IDs), and caches Amazon catalogue details and prices for at most 14 days.
• Discord: our primary support channel. Paying customers link a Discord account; we store your Discord user ID and support conversations take place on Discord's platform.
• Railway: hosting for our Discord support bot, which records support ticket replies and welcomes new members. It receives Discord user IDs and names and the messages in the Discord channels it can see, keeps only support ticket messages and images, which it copies to our database and file storage, passes the ID and names of a new member to us to set up their welcome channel, and holds names and short excerpts of support replies in its logs.
• Trustpilot: review invitations. If we invite you to leave a review, Trustpilot receives your name and email address.
• Ship24 and UPS: carrier tracking used to estimate arrival dates for parcels liquidation operators receive and for parcels sellers dispatch to eBay buyers. They receive tracking numbers only, and Ship24 also the courier code.
• Google: optional Google Drive invoice sync (only when you connect it) and "Sign in with Google".
• Claims specialists (managed service only): work your reimbursement claims in your Seller Central using the access you grant, under written contract and, outside the UK, a UK IDTA (see section 8).
• eBay: optional resale integration. If you connect your own eBay account, listing content and order data pass between ReclaimHQ and eBay under your authorisation. Pricing an item searches eBay with its catalogue identifiers (section 6), and a liquidation partner you join can list your stock on its own eBay account.

Amazon and eBay act on your own authorisation as platforms you have chosen to connect (for eBay listings, on a liquidation partner's when it lists your stock). The one exception is eBay's price search, which ReclaimHQ calls with its own eBay access and catalogue identifiers only (section 6). Each service processes data under its own data-processing terms consistent with UK GDPR. We maintain a canonical, up-to-date list of our subprocessors at reclaimhq.uk/subprocessors.

8. International transfers

Some of our providers process data outside the UK. Vercel, Railway, Stripe, Anthropic, Resend, Upstash, Discord, and Trustpilot are US-based or process data in the United States. Where personal data leaves the UK, we rely on safeguards recognised under UK GDPR: the UK Addendum or International Data Transfer Agreement (IDTA) incorporated with each provider's standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it.

If you use our managed case management service, your claims are worked by a claims specialist engaged by ReclaimHQ. Claims specialists may work from outside the UK, including from countries the UK has not deemed to provide an adequate level of data protection. Each specialist who works from outside the UK does so under a UK International Data Transfer Agreement supported by a transfer risk assessment. Every claims specialist uses the Seller Central access you grant only to work your Amazon cases. This applies only if you are on the managed service; it does not apply to other customers. Where each specialist is based is listed on our subprocessors page.

9. Cookies

We use first-party cookies only. We do not use third-party advertising or cross-site tracking cookies, and we do not sell your data.

• Authentication and security cookies (strictly necessary): keep you logged in and protect your account. The service cannot function without these.
• Referral and affiliate attribution cookie (rhq_aff / referral cookie): if you arrive via a referral or affiliate link, we set this first-party cookie for up to 90 days to record which referrer or affiliate introduced you, so we can credit them if you subscribe. We set it on the basis of our legitimate interest in running our own referral programme (not third-party advertising): it contains only an attribution code, is never used for advertising or profiling, and is not shared with third parties. You can clear or block it at any time via your browser, and it does not affect your ability to sign up or use ReclaimHQ.

10. Your rights (UK GDPR)

Under UK GDPR, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data.
• Portability: receive your data in a machine-readable format. You can export your order and claims data as CSV from within the app at any time, and we will provide a fuller export on request.
• Restriction: ask us to limit how we process your data.
• Objection: object to processing of your data, including any processing based on legitimate interests.
• Withdraw consent: at any time, where processing is based on consent.

To exercise any of these rights, email hello@reclaimhq.uk. We action requests within one month.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concerns first, so please consider contacting us at hello@reclaimhq.uk before raising a complaint.

11. Data retention and deletion

We keep your account details for as long as your account is open.

Amazon data (see section 2) is kept only while the subscription on your account is active and the data is needed to provide the service. We permanently delete it within 30 days of the earliest of:

• the subscription on your account ending, including a free trial that is cancelled;
• the last Amazon connection on your account being removed, whether you disconnect Amazon in ReclaimHQ or remove ReclaimHQ's access in Seller Central, with no Chrome extension key left active and no managed claims service in progress;
• you asking us to delete it, by emailing hello@reclaimhq.uk;
• your account being closed, by you or by us;
• Amazon telling us to delete it, or our own access to Amazon's services ending.

We email the account owner before the deletion, with its date, whenever we can reach them. A deletion is cancelled if, before that date, every reason for it has gone: for example, if your subscription ended AND no Amazon connection remains, you need to both restart your subscription and reconnect Amazon. Before the deletion date you can download your orders (as CSV) and claims (as a spreadsheet) from the Billing page; to receive a copy of anything else, such as photos, case messages or Tarquin conversations, email us before the date and we will pause the deletion until we have sent it.

When we delete your Amazon data, the photos and labels of the Amazon removal units being deleted go with it; a file that is not in your account's own storage is kept and removed by hand. Photos of orders you permanently deleted yourself may still be in storage: ask us and we will remove them. Items you keep as stock or have listed on eBay stay in your account as stock records, holding only your own details (condition, location, the cost you paid, your own photos and your eBay title), never Amazon's product details. Amazon product images or text that you published on your own eBay listings stay there until you edit or end those listings, because they are held in your eBay account. If you joined a liquidation operator, the operator keeps its own stock, listing and sales records of the goods you sent it, so it can sell them and account to you, including a stock code that contains each product's ASIN.

Your own business records (your cost of goods list, the purchase invoices you upload or sync from Google Drive, and your stock records) are not Amazon data. We keep them until you delete them, ask us to, or close your account, so they are ready if you come back, and then delete them within 30 days. Messages you send to our support team, by ticket, in Discord or to Susi, are kept while your account is open.

Billing records: UK tax law requires us to keep records of what we charge and are paid for six years from the end of the financial year they relate to, or longer if HMRC opens an enquiry into that year. These are your invoices and payments and, if you used our managed claims service, the list of Amazon reimbursements each fee was charged on and that the claims specialist was paid from (only the reimbursement and Amazon case IDs, the reimbursement it reversed if any, the date and the amount). We keep nothing more than that law requires, use it for no other purpose, and delete it when the period ends.

Security logs are kept as described in section 12.

Backups: our database is backed up automatically and the backups are encrypted. Deleted data leaves the backups as they are replaced, and we time deletion so that this also happens within the 30 days above. Backups are used only to recover from a fault, never to provide the service, and if we ever restore one we apply again every deletion that was due before the service is used again.

12. Security logging and incident response

We maintain append-only security audit logs that record authentication events, data exports, account changes, and administrative actions. We keep these logs for at least 12 months, as Amazon's Data Protection Policy requires, and they are protected by integrity controls that make any later change detectable. They can include Amazon order, case or reimbursement IDs, and they are not deleted with your Amazon data.

In the event of a personal data breach, we will notify the ICO within 72 hours of becoming aware of it where feasible, as UK GDPR requires, and we will inform affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email. Continued use of the service after changes constitutes acceptance of the updated policy.