Marketplace votes
If you vote for the next marketplace, we store your work email, company and answers to follow up about eComm Router. Results only ever show totals. One vote per email. Ask us through the contact form to delete your vote.
Your data and access
Privacy Policy
What eComm Router receives, what it keeps, and how you can remove access.
Effective date and last updated: November 7, 2026.
Who this policy covers
This policy explains what onboard dot ai LLC, a California limited liability company doing business as OnBreeze (“OnBreeze”, “we”) collects when you use eComm Router, why, where it is kept, and for how long.
- Sellers and their teams: people who create an account, join a workspace or connect a Walmart Marketplace account.
- Visitors: people who read this site, send the contact form or vote.
- Buyers: people who bought from a seller on Walmart Marketplace. We never interact with them. Their information reaches us only inside the seller’s Walmart data.
The service is for business use. It is not for children, and we do not knowingly collect a child’s information.
What we collect and why
| Category | Examples | Why |
|---|---|---|
| Account and sign-in | Email address, Google account identifier, sessions | To sign you in and control access |
| Team and agency | Invited emails, roles, brand names, agency logos, a domain you verify | To run your workspace |
| Walmart API keys | Client ID and Client Secret | To call Walmart for you |
| Walmart Marketplace data | Items, prices, inventory, orders, returns, reports and account settings | To answer your requests and prepare the changes you ask for |
| Buyer information | Inside orders and returns. The Buyer information section below gives the detail | Walmart’s answers include it. We mask it |
| Connector requests | The tool, its arguments and outcome, with sensitive fields removed | Reliability, support and abuse prevention |
| Agent and device details | The Agent connections section below lists them | To help you tell agent connections apart |
| Usage and analytics | The Product analytics section below lists them | To run and improve the service |
| Messages | Contact form text, marketplace votes, the email you send us | To reply and to follow up |
For a connected account, eComm Router can also ask Walmart for an item report and keep its rows, so that item questions need fewer live reads. The table below gives how long.
We use IP addresses for a short time to apply rate limits. We store them only as hashed keys that expire.
If a paid plan starts, Stripe takes your payment details on its own pages. We do not receive your full card number.
Connector requests, not your full conversation
eComm Router receives connector requests and returns results. It does not receive your full Claude or Codex conversation. We keep redacted request and result details so our support team can look into problems. Access to them is restricted.
API keys stay in Google Secret Manager. Those support records exclude credentials, customer contact information, payment details, and signed download links.
Sign-in information
Google sign-in requests identity and email information only. It does not request access to Gmail or Google Drive. eComm Router stores your verified email and Google’s stable account identifier to match later sign-ins to your account. Account deletion removes this Google sign-in link.
Google access and refresh tokens are not retained. Signing in does not expand Walmart permissions or authorize a client to use seller data.
Email sign-in sends a one-time code through Postmark. Cloudflare Turnstile checks the email sign-in, contact and vote forms for abuse.
An owner or admin can choose to import people from Google Workspace. Only then does Google ask for directory access. We use that access for one read of names and emails, and we drop the token with that request.
Buyer information
- Order and return reads. eComm Router masks buyer names, emails, phones, street addresses, cities and postal codes before a result leaves the service. State and country stay. Your AI client receives the masked result. Walmart’s answer passes through our services in memory so that they can mask it.
- Report files. Order report workbooks are rewritten. Customer columns are masked, and any column we have not reviewed is masked too.
- Labels and claim files. Shipping labels, scan forms and claim documents can show buyer details. They are never given to an AI client. Only the person who ran the read can download them, in a signed-in browser.
- Captured data. For accounts in the capture pilot, we keep order facts and identifiers with ship-to state and five-digit postal code. We keep no buyer name, phone, email or street address.
- Business addresses. The address of a seller or of a Walmart facility is business data. We do not mask it.
We never contact your buyers, and we never use buyer information for marketing. A change that you approve can lead Walmart to notify a buyer.
Goals and history
Saved goals and decisions
eComm Router stores the notes you ask your client to save for the selected account and connection. Other authorized clients of that account and connection can read them. Notes are planning information, not verified Walmart facts or approvals.
Ask your client to clear the notes when you no longer need them. Disconnect and account deletion also erase saved context. Do not include customer personal data or secrets.
Captured Walmart data
For accounts in the capture pilot, eComm Router can store seller data for history and summaries. An owner or admin turns on the nightly data copy for each connection. Connecting keys does not start capture or backfill earlier data. Stored results show how fresh they are and what they cover. Missing history does not mean zero activity.
Captured history uses a rolling three-year retention window with scheduled cleanup. Disconnect and account deletion schedule removal of the connection’s captured data. Cleanup status can remain pending.
How long we keep records
| Record | Kept for | Details |
|---|---|---|
| Redacted request and result details | Up to 7 days | For our support team. Access is restricted. |
| Private downloads | Expire within 7 days | Access requires the owning account. Most files that a read delivers expire after 24 hours. A report file and a claim documents file stay 7 days. A claim documents file can hold buyer information. Claim evidence that you upload stays 7 days, and a short record of its deletion stays 30 days. |
| Basic activity events | Up to 90 days | Short facts about each request and connection, such as the tool, the outcome and the time. No request or response contents. |
| Daily usage totals | Up to 180 days | Usage added up by day. |
| Failed agent sign-in records | Up to 30 days | For our support team. Each record holds the time, the error, the agent’s client ID, internal account and authorization IDs, the Cloudflare data center and the client type. It never holds access tokens, refresh tokens or authorization codes. Deleted with your account. |
| Change records | At least 90 days | Unfinished changes stay until they are resolved, or until account deletion closes their records. Closing a record does not decide what happened to the change. Finished changes move to an archive after 30 days and stay with your account until you delete it. They can hold the previous and new values of the change. |
| Read evidence | 120 seconds | The answer to a verified read, kept so that a later step can use the same read. Order and return reads are never kept this way. |
| Stored Walmart report rows and listing-quality rows | Up to 7 days | Item and report rows that eComm Router requests, and Walmart’s listing-quality scores of a SKU. No buyer information. |
| Walmart API keys | Until you rotate them, disconnect or delete your account | Held in Google Secret Manager. They are never shown again. Cleanup deletes them after running requests end. |
| Captured Walmart data | Rolling 3 years | Only for accounts in the capture pilot. Database rows and archive files are deleted when they pass 3 years, or sooner on disconnect or account deletion. Turning the nightly data copy off stops new reads. Stored data still follows this period. |
| Audit log | 13 months | Entries are deleted with the account. |
| Saved goals and decisions | Until you clear them, disconnect or delete your account | Notes you ask your client to save. |
| Closed tasks | 90 days after closing | Task records of a connection. |
| Walmart notification records | Up to 30 days | Events that Walmart sends and our delivery records. Used only where notifications are on. |
| Production settings history | 400 days | Who turned a production change on or off, and hourly check results. |
| Account, team and agent connection records | Until you delete your account | Your email, sign-in link, team roles and agent connection records. |
| Marketplace votes | Until you ask us to delete them | Ask through the contact form. |
| Contact form messages | In our support mailbox until we no longer need them | The Service does not store them. They go to our support inbox by email. |
| Backups | Up to 7 days for captured data; up to 30 days for the Cloudflare database | Deleted records can remain in backups until those backups expire. We use backups only to restore the Service. |
Audit log
Each workspace has an audit log.
- What it covers
- Agent calls (including reads), prepared changes, approvals, executions, and account and team changes.
- What each entry names
- The eComm Router user and the agent connection, the connection and environment, the SKU, item, order or feed ids involved, the outcome, and Walmart reference ids.
- What it does not store
- Customer names, addresses or contact details, access tokens, or request and response contents.
- Who can read it
- Owners and admins can read the whole log. Members and viewers see their own entries.
- Kept for
- 13 months. Entries are deleted with the account.
Agent connections
These records help you tell your AI agent connections apart. They stay with your account and are deleted with it.
- We record for each connection
- The browser and operating system that approved it (for example Chrome on macOS)
- An approximate place: city, region and country from our network provider
- An optional name you give it
- The eComm Router user who approved it
- We record for each agent request
- The client name and version it reports
- The MCP protocol version and capability names
- The network type (cloud or direct) and network operator
- An approximate place, for direct calls only
- Whether a request signature verified
- Daily call counts
- We do not store
- IP addresses, access tokens, header values beyond those fields, or request and response bodies.
- HTTP header names
- Until October 29, 2026, we also recorded which HTTP header names agents send, never their values.
Product analytics
eComm Router uses PostHog (US Cloud) to understand how people find and use the product.
- On our pages
- A first-party script sends page views, page exits, clicks and a sample of session replays (about 1 in 4 browser sessions). Replays and click records mask all text, inputs and attributes. Sign-in codes, Walmart API key forms, consent details, deletion forms and seller data are excluded from replays and click records.
- From our server
- We send product events: sign-in steps, connection status, client authorization, change milestones and connector tool calls. Tool call events contain the tool name, outcome, timing and error code only, never the request arguments or results. Votes send the chosen marketplace and the advertising answer, never your email or company. Contact messages send the topic only.
- What identifies you
- Events use a random identifier and, after sign-in, your internal account ID. We do not send your email address, your IP address or location to PostHog. Web addresses are sent without query strings, except campaign tags (utm) and ad click IDs.
Cookies and browser storage
- ep_aid
- Random visitor identifier. First-party, HttpOnly, 1 year.
- ep_ft and ep_lt
- First and most recent campaign tags and ad click IDs. First-party, HttpOnly, 90 days.
- PostHog browser storage
- The PostHog script keeps its visitor and session identifiers in a first-party cookie and local storage.
If your browser sends Do Not Track or Global Privacy Control, eComm Router loads no analytics script, sets none of these cookies and sends no analytics events for your requests. To delete your analytics data, use the contact form; we delete the PostHog person and its events.
How we use data, and what we do not do
We use data to provide the service, secure it, support you, and improve it.
- We do not sell personal information, and we do not share it for advertising.
- We do not use your Walmart Marketplace data or personal information to train AI models.
- We do not combine one seller’s Walmart Marketplace data with another’s, or build cross-seller benchmarks from it.
- We never ask for your Walmart keys in chat or email.
Your AI client
When you ask your AI client for data, eComm Router returns that data to the client you chose. Its provider, for example Anthropic or OpenAI, handles it under its own terms and privacy policy. Choose and configure your AI client with that in mind.
Who receives data
The companies on the Subprocessors page receive data so that we can run the service. The people in your workspace see data according to their role. We disclose data when the law requires it, or to protect the service, our users or the public. Walmart can ask us for information about how the service reaches its systems. If we sell or transfer the business, data can move with it, and this policy still applies to it.
Where data is kept
- Google Cloud: the private service, files and the change ledger are in us-central1. Captured data is in us-central1 and the US multi-region.
- Cloudflare: the main database runs in Western North America, and the public service runs near it. Your traffic can enter Cloudflare’s network outside the United States if you or your agent are outside it.
- Not limited to the United States: Google Secret Manager keeps Walmart API keys with automatic replication, so Google chooses the locations of the encrypted copies. Cloudflare Workers KV copies OAuth tokens and grants across its global network.
- PostHog and Postmark: United States.
Control access and deletion
From your account, revoke a client, disconnect a Walmart Marketplace account, or review account deletion. Disconnect stops client access and schedules key deletion after active requests end.
Account deletion removes retained details and aggregates after any unfinished changes are resolved. The deletion review lists unfinished changes and the audit records we must keep. The status page reports pending cleanup instead of claiming deletion is complete.
The Data Processing Addendum gives each step and its timing.
Your rights
Depending on where you live, including California, you can have the right to know what personal information we hold, and to access, correct, delete or move it. You can also appeal a decision. We do not treat you differently for using these rights.
Use the contact form or email team@getonbreeze.com. We check that the request comes from you, and we answer within the time the law requires.
If you are a buyer, we hold your information only for the seller. We send your request to that seller and, where Walmart’s terms require, to Walmart.
Walmart
Your use of Walmart Marketplace is subject to Walmart’s own terms and the Walmart Privacy Policy. Walmart’s terms for its APIs also apply to data that comes from Walmart.
Changes and contact
We post changes here. We tell you about a material change by email or in the service.
onboard dot ai LLC (doing business as OnBreeze)
Email: team@getonbreeze.com
Contact page: Talk to the team