Main content

Privacy Policy

Last updated: 10/20/2026

This Privacy Policy explains how SATE LLC ("afterbox", "we", "us") collects, uses, shares and protects personal information when you use afterboxcards.com, afterbox.co, our seller dashboard, our public product and brand pages, and our free tools (together, the "Service").

afterbox is used by two groups of people, and our role differs for each:

  • Sellers (Amazon, Etsy and other marketplace sellers who create an account). For seller account data, we are the controller.
  • Buyers (people who scan a QR code from an insert card and register a warranty or sign up for a seller's emails). For buyer data, the seller is the controller and afterbox acts as the seller's processor/service provider, handling data only on the seller's behalf.

1. Information we collect

1.1 From sellers

  • Account details: name, store name, email address, password (stored only as a salted hash), and the marketplaces where you sell (Etsy, Amazon, both).
  • Security data: login sessions, IP address, browser/device type, and two-factor authentication settings if you enable them.
  • Brand and product content: brand name, logo, colors, support/reply-to email, privacy and terms links, product names, SKUs/ASINs, care guides, warranty terms, and any images you upload.
  • Order reports: CSV files you upload containing Order IDs, SKUs and order dates, used to verify warranty registrations. Do not upload buyer names, addresses or other data we don't ask for.
  • Billing details: plan, subscription status, billing address and payment-method details. Card data is handled by our payment provider; we do not store full card numbers.
  • Notification settings: if you connect Telegram, the chat identifier used to send you alerts.
  • Communications: messages you send to our support.

1.2 From buyers (on a seller's behalf)

  • Warranty registration: name, email address, Order ID, the product, marketplace/platform, status of verification (verified, unverified, duplicate), and the date/time of your consent.
  • Email sign-up (optional): email address, product, and the date/time you confirmed your subscription via the double opt-in email.
  • Care-guide and gift-mode pages ask for nothing. We do not require you to provide any information to read a care guide.

1.3 Automatically collected

  • Server logs (IP address, user agent, pages requested, timestamps).
  • QR short-link redirect events (afterbox.co) used to route you to the right page.
  • Essential cookies for login sessions and security.
  • [FUTURE: scan analytics — aggregated counts of page views and scans per product, shown to the seller.]

1.4 Spam and abuse protection

Our sign-up, login and password-reset forms use Google reCAPTCHA, which collects hardware and software information and sends it to Google to tell humans from bots. Use of reCAPTCHA is subject to Google's Privacy Policy and Terms.

We do not use SMS, and we do not use Google Analytics or Google APIs for tracking. [Confirm before publishing.]

2. How we use information

  • Provide, maintain and secure the Service (accounts, dashboards, QR codes, insert-card PDFs, public pages).
  • Verify warranty registrations against the seller's uploaded order reports.
  • Send transactional emails: warranty confirmations, double opt-in confirmation requests, sign-up alerts, billing and security notices, and the weekly digest to sellers.
  • Process subscriptions and payments.
  • Prevent fraud, spam and abuse, and enforce our Terms.
  • Improve and troubleshoot the Service.
  • Comply with legal obligations.

We do not sell personal information. We do not use buyer data for our own marketing, and we do not use it to send buyers anything other than what they signed up for on behalf of the seller.

3. Legal bases (EEA / UK users)

  • Contract — running your seller account and providing the Service.
  • Consent — buyer warranty registrations and email subscriptions (given by ticking a consent box; email subscriptions require a second confirmation by email). You can withdraw consent at any time.
  • Legitimate interests — security, fraud prevention, service improvement.
  • Legal obligation — tax, accounting and legal requests.

4. Who we share information with

  • The seller whose card you scanned (for buyers): the seller receives your registration or subscription so they can honor your warranty and, if you opted in, email you. The seller's own privacy policy governs their use of that data.
  • Service providers who process data for us: hosting and infrastructure; transactional email delivery; payment processing (e.g. Stripe, when enabled); Google (reCAPTCHA); Telegram (only if a seller connects it).
  • Future integrations, only when a seller turns them on: Amazon Selling Partner API (order verification), and email platforms such as Klaviyo and Mailchimp or webhooks the seller configures. Data goes to those services at the seller's direction.
  • Legal and safety: where required by law, or to protect rights, safety and the integrity of the Service.
  • Business transfers: in a merger, acquisition or sale of assets, subject to this Policy.

Amazon, Etsy and other marketplaces are not affiliated with afterbox and do not receive your data from us unless a seller enables an integration.

5. Marketplace data

Sellers must use buyer information only as permitted by the marketplace's rules and applicable law. afterbox is designed so that pages and emails contain no review requests, no incentives, and no instructions to move communication off the marketplace. We may suspend accounts that use the Service in violation of those rules.

6. Email, consent and unsubscribing

Every marketing-type email sent through afterbox is double opt-in: you must confirm via a link before you are subscribed, and we store the timestamp. Every email includes an unsubscribe link. Unsubscribing stops further emails from that seller. Transactional emails (e.g. a warranty confirmation) are sent because you requested them.

7. Retention

  • Seller account data: while your account is active, then deleted or anonymized within [30/90] days after account closure, except where we must keep records (e.g. billing, tax, disputes).
  • Buyer registrations and subscribers: kept for as long as the seller keeps them in their dashboard, or until the buyer requests deletion or unsubscribes. When a seller closes their account, their buyer data is deleted within [30/90] days.
  • Order reports: kept until the seller deletes them or closes their account.
  • Logs: typically [30–90] days.
  • Backups: overwritten on a rolling schedule of up to [30] days.

8. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA and similar laws), you may have the right to access, correct, delete, restrict or port your personal information, to object to processing, and to withdraw consent.

  • Buyers: contact the seller whose product you registered, since they control your data. You can also email us at [email protected] and we will forward or action the request on the seller's behalf.
  • Sellers: manage your data in your dashboard or email [email protected].

You may also complain to your local data protection authority. California residents: we do not sell or "share" personal information for cross-context behavioral advertising.

We respond within 30 days (or the period required by law).

9. Security

We use HTTPS, hashed passwords, access controls that separate each brand's data, optional two-factor authentication, rate limiting and CAPTCHA on public forms. No system is perfectly secure; we will notify affected users and regulators of a breach as required by law.

10. International transfers

We and our providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

11. Children

The Service is not directed to children under 16 [13 in the US], and we do not knowingly collect their data. If you believe a child has provided information, contact us and we will delete it.

12. Cookies

We use only essential cookies (login session, security, CAPTCHA). We do not use advertising cookies. If this changes we will update this Policy and, where required, ask for consent.

13. Sellers acting as controllers

If you are a seller, you are responsible for: having a lawful basis to collect buyer data, publishing your own privacy policy (you can link it in your brand settings), responding to buyer requests, and honoring unsubscribes. A Data Processing Addendum is available on request at [email protected].

14. Changes

We may update this Policy. If changes are material we will notify sellers by email or in the dashboard before they take effect. The "Last updated" date shows the current version.

15. Contact

SATE LLC 1117 Scanlon Dr., Wheeling, IL 60090 Email: [email protected]