Privacy policy

This policy explains which personal data Wondiru processes, why, and what rights you have.

This policy applies whether you sell as an individual or as a company.

Last updated: 10 November 2026.

Who is responsible

The controller of your data is ATELEI ENGINEERING, S.L.U., tax ID (NIF) B75064154, Lamisingo Iturria 1, Of. 108, 20303 Irún (Gipuzkoa), Spain.

Company registered in the Registro Mercantil de Gipuzkoa, Tomo 2552, Libro 0, Folio 126, Hoja SS-34348, Inscripción 1ª.

For any question about your data, write to: [email protected]

What data we process

• The authorisation Amazon gives us when you connect your account (a refresh token). We store it encrypted.
• Your Amazon seller identifier and the list of marketplaces in your account.
• Your Wondiru account: an internal identifier, its creation date and its language.
• For each screen: serial number, firmware version, last connection and settings. We also keep a fingerprint (hash) of the screen's token and of its device secret, never the token or the secret themselves.
• Technical logs of sign-ins, token renewals and errors. They contain your internal account identifier, your screens' serial numbers and, when you authorise Wondiru, your seller identifier. They do not contain IP addresses, tokens, codes, request contents or order data.
• To limit abuse, we use the IP address of each request to our server. We store only a hash of it, never the address itself.
• When you visit this website, Cloudflare processes your IP address to deliver the pages. We do not keep it.
• When you sign in to your account page: a session record, which expires after 12 hours at most.
• While you link a screen: a pairing record with the code and the screen, which expires after 10 minutes.
• If you write to us: your email address and your message.

Our server never stores orders, amounts or passwords. Amazon's order list can include the city, postcode and country of a delivery. Wondiru does not use, show or store them. It never asks for buyer names, email addresses or street addresses.

This website sets no cookies and uses no analytics. The account site, where you manage your screens, only uses the cookies needed to keep your session open and to protect the connection with Amazon.

Where the data comes from

We receive from Amazon, when you authorise Wondiru: your seller identifier, the list of marketplaces and the authorisation token.

Authorising Wondiru in Amazon is needed for the service to work. Without it, the screen cannot show your figures.

Why we process it and on what legal basis

• To provide the service you ask for: link your screens, give them access to your figures and keep their settings. The legal basis is the contract between you and us.
• To keep the service secure, fix errors and limit abuse, through the technical logs and the IP hashes. The legal basis is our legitimate interest in protecting the service and its users.
• To answer your messages. The legal basis is taking steps at your request before a contract, or performing it.
• To meet legal obligations, for example when an authority lawfully requires data. The legal basis is compliance with a legal obligation.

We do not use your data for advertising and we do not sell it.

Providers and other recipients

• Our server and its data are hosted in the European Union (AWS, Ireland).
• Cloudflare serves this website and processes visitors' IP addresses to do so. It also routes the email sent to [email protected].
• Email sent to [email protected] is delivered to a mailbox of Google Workspace (Google Ireland Limited).

We do not give your data to anyone else unless the law requires it.

International transfers

Your data is hosted in the European Union (AWS, Ireland). Amazon Web Services, Cloudflare and Google belong to groups based in the United States, and they may process limited data outside the European Economic Area. When they do, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

To get a copy of these safeguards, write to [email protected].

How long we keep it

• While your account exists, we keep its data so that the service works.
• If your account has no current Amazon authorisation, we delete it 30 to 32 days after we notice. A daily job does it; a failed run can delay the deletion, never bring it forward.
• An authorisation stops being current when you remove its region on your account page, when Amazon rejects it because you withdrew access in Seller Central (we notice the next time one of your screens asks for credentials), or 365 days after you gave it, even if Amazon still accepts it.
• If no screen of yours is switched on and online, we may not notice that you withdrew access. The account is then deleted at most 397 days after you gave its last authorisation, as long as the daily runs complete.
• Authorising any region again cancels the deletion. If that attempt fails, the 30 days start again. Linked screens do not keep the account.
• We then delete the encrypted Amazon authorisations, the screens and their settings, the sessions and the account.
• If you delete your account on your account page, we delete the Amazon authorisations we hold at once, and then everything else. If that deletion is interrupted, what is left is deleted at most 32 days later. Backups keep it for at most 14 more days.
• If you unlink a screen, we delete its details and settings.
• Database backups keep deleted data for at most 14 days. It is then gone.
• After a deletion, the internal account identifier remains for about a day, until the next daily clean-up.
• We keep technical logs, with the identifiers they contain, for 13 months, even after an account is deleted.
• The IP hashes used to limit abuse expire after 2 hours. The database then deletes them automatically, usually within a few days.
• We keep support emails until your request is closed, and for at most 12 months.

Your rights

You can ask for access to your data, its rectification or erasure, the restriction of its processing and its portability. You can also object to its processing.

To exercise these rights, write to [email protected]. We store no name or email address for your account. To find it we will ask for the serial number shown on your screen, and we may ask for further proof that the screen is yours.

You can also delete your account yourself, while you are signed in, on your account page

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Automated decisions

We do not make automated decisions about you and we do not create profiles.

How we protect the data

• Amazon authorisations are encrypted with a dedicated key in AWS Key Management Service.
• The database and its backups are encrypted at rest.
• Connections to our server use HTTPS with TLS 1.2 or higher.
• Only one person can access the infrastructure, and that access requires multi-factor authentication.
• The logs never record tokens, codes or the contents of requests.

Changes to this policy

If we change this policy, we will publish the new version on this page with its date.

This policy is published in several languages. If the versions differ, the English version prevails, except where the law lets a consumer rely on the version in their language.