FlowOps by Lanta

Privacy & Data-Handling Policy

Lanta LLC · Effective August 15, 2026 · Last updated August 15, 2026

This policy describes how Lanta LLC ("we," "us") collects, uses, protects, and retains data within FlowOps, our warehouse and transportation management platform, including data accessed on behalf of sellers through the Amazon Selling Partner API (SP-API).

1. Scope & data we collect

FlowOps accesses Amazon order data — order IDs, line items/SKUs, quantities, and, under restricted (PII) roles, buyer name and shipping address — solely to fulfill and ship the seller's orders. We also process the operational data our customers enter to run their warehouse and transportation operations (inventory, shipments, invoices, and user accounts).

2. Purpose limitation

Amazon data is used only for order fulfillment, inventory reconciliation, and shipment tracking on behalf of the seller. It is never sold, rented, or used for advertising or marketing.

3. Sharing

We share only the minimum ship-to details required by the delivery carrier (e.g. USPS, UPS, FedEx, via our shipping provider EasyPost) and only to deliver the package. We do not share Amazon data with any other third party, and we do not sell it.

4. Retention

Buyer PII (name and shipping address) is retained no longer than 30 days after shipment, then automatically purged by a scheduled process; only non-PII order references are kept afterward for reconciliation and audit. Security audit logs are retained for at least 12 months.

5. Security

• Encryption in transit (TLS 1.2+) for all client, server, and outbound SP-API traffic.
• Encryption at rest (AES-256 with provider-managed keys) on our managed database.
• Encrypted, geographically separate backups with point-in-time recovery.
• Role-based access control plus row-level, per-tenant data isolation, enforced server-side.
• Least-privilege, need-to-know access; unique named accounts; multi-factor authentication for administrative and staff accounts.
• Security audit logging of authentication, authorization failures, and administrative actions.
• Application secrets held only in secure configuration — never in source control, never returned to clients, never written to logs.

6. Data-subject requests & deletion

Sellers may request export or deletion of their data. PII is removed on request and on account termination. To make a request, contact us at the address below.

7. Incident response

We maintain a documented Incident Response Plan with defined roles, containment/eradication/recovery procedures, and semi-annual reviews. If a security incident affects (or may affect) Amazon data, we notify Amazon within 24 hours, along with any other legally required parties.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

9. Contact