Privacy Policy

Last updated: June 2026

This Privacy Policy explains how the Brecx platform and related services (the "Service") collect, use, store, protect, retain and delete information. Brecx is operated by Fresh and Finest ("Fresh and Finest", "Brecx", "we", "us"). By using the Service, you agree to the practices described here.

Who we are

The Service is provided by Fresh and Finest, the company that operates Brecx. Fresh and Finest is the data controller for account information and acts as a data processor for the marketplace data we access on your behalf.

Information we collect

• Account information you provide directly, such as name, email and company.
• Marketplace data we access on your behalf once you authorize a channel — for example listings, inventory levels, orders, fulfillment records and, where an enabled feature requires it, limited buyer information ("PII") such as names and shipping addresses needed to process and ship orders.
• Usage and device data generated when you use the Service, such as log data and basic analytics.

How we use information

We use information for a single purpose: to operate, maintain and improve the Service for the account it belongs to — synchronizing inventory and orders across your connected channels, providing the analytics and automation you enable, and communicating with you about your account. Buyer PII obtained from a marketplace is used only to fulfill and operate orders for that seller account. We do not sell, rent, share or transfer marketplace data or buyer PII to third parties; we do not use it to market to buyers; and we do not use it to train external models.

Data protection and security

We handle marketplace data in line with each connected marketplace's data protection and acceptable-use requirements — including those of Amazon, Walmart, eBay and TikTok Shop. Our safeguards include:

• Encryption in transit using TLS 1.2 or higher (and SFTP / SSH-2 where files are transferred).
• Encryption at rest using AES-256, with credentials and keys managed through a Key Management System (KMS) across the full key lifecycle.
• Least-privilege access requested through official authorization flows, with multi-factor authentication, account lockout after repeated failed logins, and regular credential and API-key rotation.
• Logical per-account isolation with role-based access controls and need-to-know restrictions on production data.
• Audit logging and monitoring of access to production systems, with logs retained for at least 12 months.
• Vulnerability management — critical issues remediated within 7 days and high-severity issues within 30 days of discovery, with periodic scans and annual penetration testing.
• Vendor due diligence — annual risk assessments of any subprocessor before it is granted access to marketplace data.
• Secure secrets storage — credentials and access tokens are kept in an isolated secrets vault and are never hardcoded.
• Incident response — a documented plan under which we notify the affected marketplace(s) and impacted parties, as required, within 24 hours of confirming a security incident.

Data retention and deletion

We retain data only as long as needed to provide the Service and to meet the marketplaces' requirements:

• Buyer PII is retained no longer than 30 days after order delivery, unless a longer period is required to comply with legal, tax or regulatory obligations.
• Other marketplace data is deleted within 18 months unless a longer retention period is required by applicable law.
• When you disconnect a channel or close your account, the associated marketplace data is purged within 30 days. You may export it first.

You may request export or deletion of your data at any time by emailing contact@brecx.com. Data is securely disposed of when no longer required.

Compliance with marketplace policies

Where we access data through a marketplace, we comply with that marketplace's developer and data-handling policies — including those of Amazon, Walmart, eBay, TikTok Shop and the other channels we connect to.

Your rights

Depending on your location, you may have rights to access, correct, export or delete your personal information. To exercise these rights, contact us at the address below.

Contact

Questions about this policy can be sent to contact@brecx.com.