Inbound Order Match

LEGAL

Privacy policy

Effective and last updated: October 24, 2026

Inbound Order Match (the “Service”) handles information needed to match wholesale orders. This policy explains what we collect, why we use it, where it is stored, when it is sent to service providers, and how you can make privacy requests.

Draft — confirm legal requirements for international transfers and request procedures before publication.

The operator information below is copied from Auto-Scheduler’s legal disclosures. Confirm the explanation and consent process for international transfers and the procedures for privacy requests before publication.

1. Operator and privacy contact

Personal information operator: Solver

Address: Aco Mansion 101, 5-126-2 Miyamachi, Omiya-ku, Saitama-shi, Saitama, Japan

Representative: Kazuaki Matsui

Privacy contact: connectechceomatsui@gmail.com

You may also use this contact to request access, correction, suspension of use, or deletion of personal information. We will verify your identity and respond as required by applicable law.

2. Information we collect

Depending on the features you use, we collect or generate the following information:

  • Account information: sign-in email address, the user identifier issued by the authentication provider, authentication status, and a signed cookie used to maintain your session. We do not store your password in the Service database.
  • Organization information: organization name, billing email, plan and usage, invitee email addresses, and member roles.
  • Information you enter or save: order text, customer names, product catalogs, phrase-to-SKU or unit mappings, matching results, and API key identifiers. API key secrets are shown once when created and stored as hashes.
  • Browser information: when you are not using organization storage, active orders, catalogs, and phrase mappings are stored in your browser’s localStorage under `iom.desk`. They remain until you clear browser storage or import them into an account.
  • Usage and technical information: access times, request processing information, browser and device information, and IP address. For visitors who are not signed in, the IP address is also used for short-lived rate limiting of the order line-splitting feature.
  • Billing information: organization name, billing email, subscription and payment status, and invoice references. Card details are entered and processed on Stripe’s pages; the Service does not store card numbers.

3. How we use information

We use information only as needed for the following purposes:

  • Receive orders, split order text into lines, match lines to product codes, display results, and export CSV files.
  • Authenticate accounts, save and sync work, manage organizations and members, and send invitations.
  • Count usage, charge fees, process payments, and maintain billing records.
  • Provide the API, check access permissions, resolve incidents, protect security, and prevent abuse.
  • Respond to privacy and service inquiries, meet legal obligations, and handle disputes.

4. AI processing of order text

When you use order line splitting, the order text is sent from our server to the AI endpoint configured for that environment. The current default is Vercel AI Gateway with OpenAI GPT-4.1 mini. Environment settings can change the endpoint or model, so the provider and processing region may vary. We send the text for line splitting; if you save the resulting order in the Service, it is also stored in the Service’s order records.

Data retention and model-training practices at AI Gateway and the model provider depend on their respective settings and terms. The Service code does not request prompt non-retention or prohibit training. Do not include unnecessary personal, payment, authentication, or confidential information in order text.

5. Service providers and disclosures

We entrust information to the following providers as needed to operate the Service. Each provider handles information under its own agreements and privacy documents. Where applicable law requires additional information or consent for a transfer to a provider in another country, we will follow those requirements.

The Service currently uses services operated by Vercel and Stripe, which are based in the United States, and the configured AWS storage region is US East (N. Virginia). The default AI endpoint is Vercel AI Gateway with OpenAI GPT-4.1 mini, but environment settings can change the endpoint or model and the actual processing region may vary. The information and consent requirements for international transfers must be confirmed before publication.

Owners and members of the same organization may view and use that organization’s saved orders, catalog, phrase and unit mappings, organization name, invitation information, and member information within their assigned permissions. If you configure an API key in another system, that system can send order information to the Service.

Removing a member from an organization does not remove the orders, catalog, or phrase mappings that person added; they remain with the organization.

We may disclose information as required by law, to protect life, body, or property, or to respond to abuse or security threats as permitted by law. We do not sell personal information.

  • Vercel: Service hosting, delivery, runtime logs, and AI Gateway.
  • Amazon Web Services (AWS): authentication (Amazon Cognito) and storage of organization and order data (DynamoDB). The configured AWS Region is US East (N. Virginia, us-east-1). An S3 bucket is provisioned, but the Service currently has no feature for users to upload files.
  • Stripe: subscriptions, payments, and invoices. Stripe collects payment details directly.
  • Generative AI model provider: line splitting of order text. The current default model is OpenAI GPT-4.1 mini, but the provider may change if model or routing settings change.

6. Storage location and retention

Account, organization, and order data are stored in the configured AWS environment. The current configured Region is US East (N. Virginia, us-east-1). We do not separately copy order text into our AWS storage when it is sent to AI for line splitting.

Browser work data stays in browser storage until you clear it or import it into an account. We retain information saved to an account for as long as needed to provide the Service. The interface does not currently support deleting saved records or deleting an account. If you submit a request through the privacy contact, we will review it under applicable law, including any legal retention duties and backup handling.

Billing and payment records may be retained for periods required by accounting, tax, and other laws. Service-provider logs and backups are retained under each provider’s service and contract settings.

7. Cookies and analytics

When you sign in, we use the `iom.account` cookie to maintain your authenticated session. Temporary cookies preserve sign-in security state and your return path; they are deleted after authentication completes. These cookies are necessary for the Service to work.

The Service’s page code does not set advertising or analytics tracking cookies. Technical logs collected by the hosting provider for operations and security are governed by that provider’s documentation.

8. Security

We use measures intended to prevent loss, destruction, alteration, or unauthorized disclosure, including access controls, separate storage environments, encrypted connections, and server-side handling of secrets. We limit access to personnel and providers who need it and review our handling practices over time.

9. Changes to this policy

We may update this policy when laws or the Service change. We will provide notice on the Service when a change is material. The revised policy applies from the time it is posted on this page.