Privacy Policy

01Who we are

Opero3P ("Opero3P," "we," "us," or "our") is a software service operated by Quickmitts LLC, a Colorado limited liability company. We provide tools for Amazon FBA sellers to track product costs, fees, and the true margin remaining after credit card, portal, and gift card cash back stacking. We also provide outreach tools that let sellers manage brand contact lists and send email campaigns through their own connected Gmail account, bookkeeping tools, and an optional repricer that changes the prices of a seller’s Amazon listings according to rules the seller sets.

Our website is https://www.opero3p.com. The data controller for purposes of this policy is Quickmitts LLC. You can reach us at rob@opero3p.com.

02Scope of this policy

This policy applies to information collected when you:

• Visit opero3p.com or any subdomain
• Create an account or use the Opero3P web application
• Install or use the Opero Bridge Chrome extension
• Connect your Amazon Selling Partner account to Opero3P
• Connect a business bank or credit card account through Plaid
• Connect your Gmail account to send outreach email through Opero3P
• Subscribe to a paid plan or start a free trial
• Contact us by email

This policy does not cover websites or services operated by third parties, even when linked from our site. Their privacy practices are governed by their own policies.

03Information we collect

Information you provide directly

• Account information: email address, display name, password hash (we never store passwords in plain text), and authentication identifiers from Google OAuth if you sign in with Google.
• Workspace and membership data: workspace names, the role each user holds within a workspace (owner, admin, virtual assistant, etc.), and pending invitations.
• Product and purchase data: ASINs, supplier names, costs, quantities, dates, and notes you enter into the app.
• Cash back source data: names of credit cards, portals, and gift card balances you choose to track. We do not collect credit card numbers, CVVs, or banking credentials. (Bank connections are made through Plaid; see Section 6.)
• FBA fee data: dimensions, weights, prices, and category data you enter or sync via the Opero Bridge extension.
• Opero Bridge lookup history: the products you look up with the extension (ASIN, title, brand, image, price, cost, fees, profit and ROI), the name of the website you looked them up on (not the full page address), who looked them up and when. It is visible only to members of your workspace. Full details are in the Opero Bridge privacy policy.
• Reimbursement cases you track: when you file a case with Amazon from the Discrepancies tab, the Amazon order number, ASIN, case ID, its status (filed, paid, denied or dismissed), Amazon’s reason if it was denied, and any notes you add.
• Repricer settings: the products you switch on for automatic pricing, the strategy and limits you set for each (such as minimum ROI, minimum and maximum price), your pricing rules, schedules, and repricer settings.
• Outreach contact data: brand names, contact names, email addresses, phone numbers, job titles, company information, notes, and any tags or categories you attach to brands you add to your outreach lists.
• Outreach content: email templates, campaign sequences, send schedules, and the bodies and subjects of messages sent through the outreach system. We also record reply-tracking metadata (whether a reply came back, and the timestamp) so the system can stop sending follow-ups to brands who have responded.
• Customer-supplied API keys: if you choose to use the integrations below, you may paste your own API keys into your workspace settings. These are encrypted at the database column level before storage and used only to make API calls on your behalf:
  • Apollo.io — for contact enrichment on brand records you add.
  • MillionVerifier — for email address verification on outreach contacts.
  • Google Gemini (or another AI provider you configure) — for AI-assisted features such as template suggestions and content rewriting.
• Support correspondence: any information you send us by email.

Information we collect automatically

• Usage data: pages viewed, features used, errors encountered, and approximate timing of requests, used to improve the service.
• Device data: browser type, operating system, screen size, and IP address (used for security and abuse prevention; not used for advertising).
• Cookies and local storage: see Section 10.

Information we collect from third parties

• From Stripe: subscription status, plan tier, and last four digits of your payment card. We do not store full card numbers; Stripe handles all payment data.
• From Google (if you use Google Sign-in): your name, email address, and Google account identifier.
• From Gmail (if you connect your Gmail account for outreach): a refresh token granting our service the gmail.send scope, plus message identifiers for the outreach messages we send through your account. gmail.send is used only to send the outreach emails you have configured, from your own mailbox, to contacts you have added to a campaign. We never send to an address you have not added. Opero3P does not read your mailbox: each outreach email carries its own reply address on reply.opero3p.com, so replies to it come straight to Opero3P. You can disconnect Gmail at any time in Settings, which revokes this access.
• Replies to your outreach: when a contact replies to an outreach email, the reply is delivered to Opero3P through that email’s reply address. We store the reply so you can read it in your workspace, mark the brand as having responded, stop its follow-ups, and classify the reply (for example interested or not interested). If you choose to add a Gmail filter that forwards bounce notices to Opero3P, we use those notices only to stop emailing addresses that no longer work.
• From Amazon (if you connect your Amazon Selling Partner account): see Section 4.
• From your configured integrations (Apollo, MillionVerifier, AI provider): the responses returned for the specific requests you initiate (e.g., the contact record Apollo returns for a domain you enrich, or the verification result MillionVerifier returns for an email you check). We do not query these services unless you have provided your own API key and you have initiated the request.

04Google user data and Limited Use

If you choose to connect a Google account, Opero3P requests the following OAuth scopes. We request no others, and every one is optional — the rest of Opero3P works without connecting Google at all.

• userinfo.email and userinfo.profile — to identify your account when you sign in with Google.
• gmail.send — to send the brand outreach emails you have configured, from your own mailbox, only to contacts you have added to a campaign, within the daily send limit and sending window you set.

Opero3P does not read your mailbox. Replies to outreach emails reach Opero3P through a reply address on reply.opero3p.com carried by each email, not through your Gmail account.

Accounts connected before September 20, 2026 also granted read access (gmail.readonly), used only to detect replies to Opero3P’s own outreach. It stops being used by October 10, 2026, when those accounts reconnect with send-only access.

Limited Use disclosure

Opero3P’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.
• We do not allow humans to read Google user data unless we have your explicit consent for a specific message, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized.

Revoking access

You can disconnect Gmail at any time in Opero3P under Settings, or revoke access directly from your Google Account permissions page. Refresh tokens are deleted from our systems within 24 hours of disconnection or revocation.

05Amazon Selling Partner data

Authorization

We access your Amazon Selling Partner data only after you explicitly authorize us through Amazon's standard OAuth flow in Seller Central. You may revoke this authorization at any time by visiting Seller Central → Apps and Services → Manage Your Apps and disconnecting Opero3P.

Data we access

The specific endpoints and data we access depend on the SP-API roles you authorize. We request access only to data necessary to provide our core service:

• Product Listings: ASIN, SKU, title, dimensions, weight, category, and listing status.
• Pricing and Fees: current sale price, referral fee, FBA fulfillment fee, and other fees returned by the Product Fees API.
• Inventory: on-hand and inbound quantities by SKU (used for the Inventory & Margin and Reorder sections of the app).
• Offers and Buy Box: the competing offers on your listings (prices, shipping and Prime status, and which offer holds the Buy Box), used to calculate pricing suggestions and, if you use the Repricer, to decide prices.
• Orders (optional, if you enable the Sales Dashboard): order-level totals, units shipped, and order counts pulled from the SP-API Orders endpoint. We store these as monthly aggregates (revenue in cents, units sold, order count) bucketed by Pacific calendar month for the workspace whose owner authorized the connection.
• Finances: the financial events Amazon reports for your account — sales, refunds, fees, reimbursements and adjustments — each with its Amazon order number, SKU, quantity, amount and date. These are used for your profit and loss statement, your accounting exports, and to match refunds against returns and reimbursements.
• FBA reports (Amazon Fulfillment role): your Customer Returns report (order number, product, quantity, fulfillment center, condition of the returned unit, return reason and status, the return’s license-plate number, and any comment the customer typed when requesting the return), your Removal Orders report, and your Reimbursements report (reimbursement and case IDs, order number, reason, product, quantity and amount). These are used to show what came back into stock, what was removed, and which refunds Amazon should have reimbursed.

Amazon order numbers. We store Amazon order numbers so that a sale, its refund, its return and any reimbursement can be matched to one another. An order number on its own does not identify the buyer, and we do not store buyer names, buyer email addresses, shipping addresses or phone numbers.

Customer return comments. The Customer Returns report can include a short comment the customer wrote when requesting the return. Opero3P stores it as Amazon provides it, makes it available only to members of your workspace, with that return, and does not use it for any other purpose. Because a customer can type anything, a comment could occasionally contain personal details; you can ask us to delete any comment at any time.

Reports you upload. You can also import your Customer Returns and Reimbursements reports by uploading the files downloaded from Seller Central. Uploaded reports are handled exactly like the same reports received through the SP-API.

We do not access buyer personally identifiable information (PII) such as buyer names, email addresses, or shipping addresses. If our service expands to include features that would require such data, we will update this policy and re-request your authorization before doing so.

Price changes (Repricer)

Opero3P changes the price of an Amazon listing only when you ask it to: when the workspace owner or an admin confirms a price change, or when you turn on automatic pricing for the products you have switched on, each with the strategy and limits you set.

• Prices are never set below the floor worked out from your own costs and limits, and every change goes through further safety checks, including a check-only request to Amazon before the real update.
• Every price change is recorded in your workspace with the old price, new price, reason and time, and the latest change on a product can be put back.
• You can pause all price changes or switch automatic pricing off at any time in the app, and revoking Opero3P’s access in Seller Central stops all price changes.

Offer-change notifications

If you turn on fast reactions in the Repricer, Amazon sends Opero3P a notification each time the offers on one of your listings change. These notifications are delivered to a message queue Opero3P operates on Amazon Web Services. They contain your seller ID, the listing’s ASIN, and a summary of the offers on it (prices, shipping and Prime status, and the Buy Box). Each notification is deleted from the queue as soon as it is read; the market figures used for each pricing decision are kept in your repricer history.

How Amazon data is used

• Data accessed via SP-API is used only to provide the Opero3P service to you, the authorizing seller.
• Your Amazon data is never sold, licensed, or shared with other Opero3P users.
• Your Amazon data is never used for advertising, marketing, or training machine learning models.
• Aggregated, anonymized statistics (e.g., "average FBA fee in the home goods category") may be used internally for product development, but only in a form that cannot be linked back to you or your account.

Storage and security of Amazon data

• Your Amazon Selling Partner refresh token is encrypted at the database column level before storage. The encryption key is held outside the database and is not accessible to anyone other than the Opero3P production environment.
• Access tokens (short-lived) are held in memory only and not written to disk.
• All API calls between Opero3P and Amazon are made over TLS 1.2 or higher.
• Database records containing your Amazon data are protected by row-level security so that no other Opero3P user can read them.

Retention and deletion of Amazon data

• When you disconnect Opero3P from Seller Central, we delete your stored refresh token within 24 hours.
• Derived data (ASIN details, fee snapshots, inventory levels, etc.) is retained while your Opero3P account is active so your historical reports remain intact. You may request deletion of this data at any time by emailing us.
• Upon account closure, all Amazon-derived data is deleted within 30 days, except where retention is required by law (e.g., tax records related to a paid subscription).

06Bank account data (Plaid)

What this section covers. Opero3P lets a workspace owner connect business bank and credit card accounts so transactions flow into Bank & Cards for bookkeeping, instead of being imported by hand. These connections are provided by Plaid Inc.

Authorization

• Only the workspace owner can connect a bank. You connect through Plaid's secure window, and you choose which institution and accounts to share.
• You enter your bank login in Plaid's window, not in Opero3P. Opero3P never receives or stores your bank username or password.
• Plaid's handling of your information is described in the Plaid End User Privacy Policy.

Data we receive

• Account details: institution name, account name and type, and the last four digits of the account number (the mask). We do not receive or store full account numbers.
• Transactions: date, description, merchant name where provided, and amount for posted transactions. Pending transactions are not stored.

How bank data is used

• Bank data is used only to provide bookkeeping features to you: categorizing transactions, matching them to purchases and expenses, and producing your profit and loss, monthly close, and accountant reports.
• Bank data is never sold, never shared with other Opero3P users, and never used for advertising, credit decisions, or training machine learning models.

Who can see bank data

• Bank and card data is restricted to the workspace owner at the database level. Admins, virtual assistants, and other workspace members cannot view it.

Storage and security of bank data

• The Plaid access token for each connection is stored only on our servers, in a table that browser clients cannot read. It is never sent to your browser.
• All communication with Plaid is made over TLS 1.2 or higher, and bank data at rest is encrypted by our database provider (AES-256).

Retention and deletion of bank data

• When you disconnect a bank in Opero3P, we revoke the connection with Plaid and delete the access token immediately. No new transactions are retrieved after that.
• Transactions already imported are kept while your account is active so your books stay complete. You may ask us to delete them at any time by emailing rob@opero3p.com.
• Upon account closure, all bank data is deleted within 30 days, except where retention is required by law.

07How we use information

We use the information we collect to:

• Provide and operate the Opero3P service
• Authenticate you and secure your account
• Process subscription payments (via Stripe)
• Sync FBA fees and product data from Amazon and the Opero Bridge extension, and keep the extension's lookup history so you and your team can find products again and see sourcing activity
• Sync monthly sales aggregates from Amazon if you have enabled the Sales Dashboard
• Change the prices of your Amazon listings when you confirm a price change or use automatic pricing, within the floors and limits you set, and keep a history of each check and change so you can review and undo it
• Import and categorize transactions from bank and card accounts the workspace owner connects through Plaid, for bookkeeping and financial reports
• Send outreach email through your connected Gmail account on your behalf, only to recipients and at times you have configured, and only for the campaigns you have started
• Enrich brand contact records using your own Apollo and MillionVerifier API keys, only on records you choose to enrich
• Generate AI-assisted content suggestions using your own AI-provider API key, only on the inputs you submit
• Compute reports, margins, and recommendations within the app
• Respond to support requests
• Send service announcements (e.g., billing notices, security alerts, material policy changes). These cannot be unsubscribed from while your account is active because they are essential to providing the service.
• Send optional product updates and tips, only if you have opted in. You can unsubscribe at any time using the link in any such email.
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal information. We do not share it with advertisers or data brokers.

08Sub-processors and sharing

To operate the service, we share data with a small number of vetted vendors ("sub-processors"). Each is contractually bound to handle data only on our instructions and only for the purposes described below.

We may also disclose information when required by law, valid legal process, or to protect the rights, property, or safety of Opero3P, our users, or the public. If we receive a government request for your data, we will notify you unless legally prohibited from doing so.

If Opero3P is involved in a merger, acquisition, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you by email before any such transfer takes effect, and you will have an opportunity to delete your account before the transfer.

09Security

We take security seriously and apply industry-standard practices:

• All traffic to and from opero3p.com is encrypted in transit via TLS 1.2 or higher.
• Data at rest in our database is encrypted using the underlying provider's encryption (AES-256).
• Sensitive credentials such as Amazon refresh tokens are additionally encrypted at the database column level using application-layer keys.
• Row-level security in our database isolates each user's data from every other user's data.
• Bank and card data is restricted to the workspace owner, and Plaid access tokens are kept server-side only.
• Production access is restricted to authorized personnel and protected by multi-factor authentication.
• We do not store full payment card numbers; payments are handled exclusively by Stripe, a PCI DSS Level 1 certified provider.

No security program is perfect. If we discover a security incident affecting your data, we will notify you by email without undue delay, and in any event within 72 hours of becoming aware of the incident where required by applicable law.

10Data retention

• Active accounts: we retain your data for as long as your account is active.
• Canceled subscriptions: if you cancel your paid subscription but do not delete your account, we retain your data so you can resume later. After 12 months of inactivity, we will email you and, if there is no response, delete the account within 30 days.
• Account deletion: when you request deletion of your account, we delete your personal data within 30 days. Some records may be retained longer where required by law (for example, transaction records for tax purposes).
• Backups: deleted data may persist in encrypted backups for up to 90 days, after which it is purged.
• Amazon refresh tokens: deleted within 24 hours of disconnection in Seller Central.
• Gmail refresh tokens: deleted within 24 hours of disconnection from within Opero3P or revocation in your Google Account settings.
• Plaid access tokens: revoked with Plaid and deleted immediately when you disconnect a bank in Opero3P.
• Bank transactions: kept while your account is active; deleted within 30 days of account deletion.
• Repricer history (each automatic check, price change and Buy Box event): kept while your account is active so you can review and undo changes; deleted within 30 days of account deletion.
• Offer-change notifications: deleted from the message queue as soon as they are read.
• Amazon finances, returns, removals and reimbursements (including order numbers and customer return comments), and the reimbursement cases you track: kept while your account is active so your history and reconciliations stay intact; deleted within 30 days of account deletion. You can ask us to delete individual customer return comments at any time.
• Customer-supplied API keys (Apollo, MillionVerifier, AI provider): deleted from our database within 24 hours of removal from your workspace settings, and within 30 days of account closure.

11Your rights and choices

Regardless of where you live, you can exercise the following rights with respect to your Opero3P account:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate data either directly in the app or by emailing us.
• Deletion: request deletion of your account and associated data.
• Portability: export your ASIN, purchase, cash back, brand, contact, and campaign data from within the app at any time.
• Withdraw consent: disconnect your Amazon Selling Partner account, disconnect your Gmail account, disconnect any bank connected through Plaid, switch off automatic pricing or pause all price changes, delete any API keys you have stored for Apollo / MillionVerifier / AI provider, revoke Google OAuth, or cancel your subscription at any time.
• Opt out of optional emails: use the unsubscribe link in any marketing message.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law. To exercise any California right, email rob@opero3p.com. We will not discriminate against you for exercising these rights.

European Economic Area, United Kingdom, and Switzerland

Opero3P is operated from the United States and is primarily intended for sellers operating on Amazon US, Canada, and Mexico marketplaces. If you are located in the EEA, UK, or Switzerland and choose to use our service, you have the additional rights provided by GDPR or UK GDPR, including the right to lodge a complaint with your supervisory authority. The legal basis for our processing is the performance of a contract with you (when you have an account) and our legitimate interests (for security and product improvement). We are not currently established in the EU and do not maintain an Article 27 representative; we will revisit this if we begin serving EU sellers materially.

To exercise any right, email rob@opero3p.com. We will respond within 30 days.

12Cookies and local storage

We use a small number of cookies and browser storage entries:

• Authentication cookies set by Supabase to keep you signed in.
• Session storage used by the web app to remember UI preferences such as which sidebar section is open.
• Extension storage used by the Opero Bridge extension to keep you signed in and remember panel preferences on your device.

We do not use third-party advertising cookies, cross-site tracking pixels, or analytics that profile individual users for advertising. You can clear cookies and storage at any time using your browser's settings; doing so will sign you out and may reset UI preferences.

13Children's privacy

Opero3P is a business tool intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.

14International users

Opero3P is operated from the United States, and all of our sub-processors named in Section 8 store data in the United States. By using the service, you understand that your information will be transferred to and processed in the United States, which may have data protection laws different from those of your country of residence.

15Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Effective" date at the top of this page,
• Post the new policy at this URL, and
• Notify active users by email at least 14 days before the new policy takes effect.

Continued use of Opero3P after the effective date constitutes acceptance of the updated policy.

October 9, 2026: described the Finances data and FBA reports (Customer Returns, Removal Orders, Reimbursements) we access; clarified that we store Amazon order numbers to match sales, refunds, returns and reimbursements, while still not storing buyer names, emails, addresses or phone numbers; added customer return comments, uploaded reports, and the reimbursement cases you track, with their retention.

16Contact us

If you have questions about this policy or wish to exercise any of your rights, contact us at:

This policy is governed by the laws of the State of Colorado, United States, without regard to its conflict of laws principles.