Privacy Policy
Automation Alchemists — Return Label Converter & CP Bot
Last updated: 15 August 2026
1. Introduction & Scope
This Privacy Policy explains how the Return Label Converter web application and the CP Bot Chrome extension (“we”, “our”, “the Service”) collect, use, store, and protect your data. The Service is developed and operated by Automation Alchemists.
The Service comprises two products that share a single Supabase backend and user account system:
- Return Label Converter — A web application for creating premium, clean eBay AU return labels from Amazon AU return QR codes, barcodes, or printable labels.
- CP Bot (CopyPaste Bot) — A Manifest V3 Chrome extension for Australian eBay-to-Amazon dropship order fulfilment. It copies buyer addresses from eBay AU Seller Hub and fills Amazon AU checkout forms.
By using either product, you agree to the practices described in this policy.
CP Bot is a non-API tool — it never holds your eBay or Amazon credentials
CP Bot is not an API integration. It does not connect to eBay’s or Amazon’s developer APIs, and it is not a registered application on either marketplace. It works only inside your own browser, on pages you are already signed in to and viewing — performing the same copy-and-paste steps you would otherwise do by hand, just faster and more accurately.
What this means for you:
- No marketplace credentials are ever requested, stored, or transmitted. CP Bot never asks for your eBay or Amazon password, API key, developer key, or OAuth token, and holds none of them. There is no marketplace credential of yours for us to lose.
- No third-party account authorisation. You are not granting an external application standing access to your eBay or Amazon account, so there is no connected-app permission to audit or revoke later.
- Nothing acts on your behalf while you are away. There is no server-side process that signs in as you. CP Bot only does something when you click one of its buttons, in a browser tab you have open. Close the browser and nothing continues.
- Your marketplace sessions stay yours. CP Bot uses the session you are already signed in to; it never creates, shares, or exports that session.
- Uninstalling ends all access immediately. Because access depends entirely on the extension running in your browser, removing it removes the access — there is nothing left connected on the marketplace side.
CP Bot never places an order and never completes a payment. It prepares checkout details for you — addresses and gift messages — and deliberately refuses to activate purchase controls such as “Place your order”, “Buy now” on a checkout page, or any subscription sign-up and payment button. The final decision to buy is always yours, made by you, on Amazon’s own page.
2. Data We Collect
All data is associated with your authenticated user account. The following tables detail what each product collects.
2a. Return Label Converter
| Category | Data Fields | Storage Location |
|---|---|---|
| Selected Images | Return label, QR code, or barcode images you choose for conversion | Held in your browser for the conversion only — never uploaded to or stored on our servers |
| Generated Labels | Converted/rendered label output images (PNG, JPG, or PDF) | Generated client-side; not stored server-side |
| Label History | Template ID, item name, quantity, order reference, and a one-way fingerprint (hash) of the source image — the image itself is not included and cannot be reconstructed from it | Supabase database, private to your account (row-level security) |
2b. CP Bot Chrome Extension
| Category | Data Fields | Storage Location |
|---|---|---|
| Authentication | Email address, Supabase session tokens | Supabase Auth, browser cookies, Chrome extension storage |
| eBay AU Order Data | Order IDs, buyer names, street addresses (street lines, suburb, state, postcode, country), phone numbers (when present on the order), item titles, quantities, source URLs | Chrome session storage, Supabase cloud clipboard (auto-expires after 5 minutes) |
| Amazon AU Data | Order references, ASINs, Amazon account email | Supabase fulfillment logs |
| Fulfillment Logs | eBay order ID, Amazon order reference, buyer name, postcode, item title, quantity, fulfilment status, address validation warnings, Amazon account | Supabase database, private to your account (row-level security) |
| Activity & Event Logs | Event type (e.g. paste success, checkout error, scan), eBay order ID, extension version, event detail metadata | Supabase database, private to your account (row-level security) |
| Gift Message Settings | Gift enabled flag, message text, sender name | Chrome local storage and your private settings record in Supabase |
| Gift Templates | Template name, gift message text, sender (from) name, display order | Supabase database, private to your account (row-level security) |
| Subscription Status | Whether your account has an active CP Bot subscription, its status, and the current period end date. Read only — CP Bot never writes subscription data | Supabase database, managed by Automation Alchemists, private to your account (row-level security) |
| User Settings | Automation toggles (enabled, auto-select address, auto-mark ordered, show address check above “Place your order”) | Chrome local storage and your private settings record in Supabase |
| Safety & Automation State (local only) | Address verification result for the current checkout, the buyer address it was checked against, paste pacing counters, and the in-progress automation hand-off that lets a multi-step run (such as Buy Now) continue across Amazon page changes | Chrome session storage only — cleared when the browser session ends; never sent to our servers |
3. How We Use Your Data
Return Label Converter
- Label conversion: Processing uploaded return label images (QR codes, barcodes, printable labels) and rendering clean, eBay-suitable return labels for download.
- History: Recording which labels you have converted so you can re-access or re-download them.
CP Bot
- Order fulfilment: Copying buyer shipping addresses from eBay AU order pages and filling them into Amazon AU checkout/address forms.
- Address verification: Reading the delivery address shown on the Amazon AU checkout page and comparing it to the buyer address you intended to use, then displaying a colour-coded result. This is an advisory safety check only — it never blocks, changes, or completes an order. The comparison runs entirely in your browser and the result is never sent to our servers.
- Buy Now (product pages): On an Amazon AU product page, clicking Amazon’s own “Buy Now” button for you, declining Amazon’s Prime offer if it appears by following Amazon’s own “No thanks” decline link, and then filling the buyer address on the checkout page that opens. This automation stops at the filled checkout — it never places the order, never completes a payment, and never accepts a Prime or other paid subscription. If the decline link cannot be found, CP Bot stops and asks you to continue manually rather than clicking anything else.
- Manual address edit: Letting you correct a scanned address before it is used. Edits are held in browser session memory for that session only and are never stored on our servers.
- Cross-device sync: Temporarily storing addresses in a cloud clipboard so you can copy on one device and paste on another (entries auto-expire after 5 minutes).
- Fulfillment tracking: Logging which eBay orders have been fulfilled and their corresponding Amazon order references.
- Activity monitoring: Recording automation events (successes, failures, errors) so you can review your fulfilment history and diagnose issues.
- Gift templates: Storing reusable gift message presets (up to 5 per account) so you can quickly apply saved messages during checkout automation.
- Subscription check: Reading whether your account has an active CP Bot subscription, to authorise access to the CP Bot dashboard. This is a read-only check — CP Bot never creates or modifies subscription records.
- Authentication: Verifying your identity and securing access to your data. You sign in with your Automation Alchemists email and password directly on this site, and the same account works across Automation Alchemists products. Accounts are created on the Automation Alchemists website. We never see or store your password — it is handled by our authentication provider.
4. Data Storage & Security
- Server-side data is stored in Supabase (hosted on AWS infrastructure). All data is transmitted over HTTPS (TLS encryption in transit).
- Row Level Security (RLS) is enforced on every database table — each user can only read, update, or delete their own rows.
- The extension never stores or transmits the Supabase service-role key. Only the public anon key is used, scoped by RLS policies.
- Local extension data (settings, cached orders) is stored in
chrome.storage.localandchrome.storage.session, accessible only to the extension. - Label images you select are processed entirely in your browser and are never uploaded to our servers. Only the conversion record described in Section 2a is saved, and it holds a one-way fingerprint of the image rather than the image itself.
5. Data Retention & Deletion
- Cloud clipboard entries auto-expire and are deleted after 5 minutes.
- Fulfillment logs and activity logs are retained indefinitely for your records. You can request deletion at any time (see Section 8).
- Label history is retained until you delete it from your account or request account deletion. Source label images are never stored on our servers, so there is nothing of them to retain.
- Gift templates are retained until you delete them from your Settings page or request account deletion.
- Subscription records are held by the Automation Alchemists platform for as long as your subscription exists and are removed on account deletion.
- Account deletion: If you delete your Supabase account, all associated data (fulfillments, activity logs, settings, gift templates, subscription records, label history) is automatically cascade-deleted.
6. Third-Party Services
The Service integrates with the following third-party providers:
- Supabase — Authentication, database, and file storage. See Supabase Privacy Policy.
- Vercel — Web application hosting, analytics, and performance monitoring (via Vercel Analytics and SpeedInsights). See Vercel Privacy Policy.
We do not sell, trade, or share your data with any other third parties.
7. Chrome Extension Permissions
The CP Bot extension requests the following permissions. Each is required for the functionality described:
| Permission | Purpose |
|---|---|
| ebay.com.au | Inject content scripts on eBay AU Seller Hub order pages to read buyer shipping addresses for cross-platform fulfillment. |
| amazon.com.au | Inject content scripts on Amazon AU product, checkout, and address pages to autofill buyer addresses into shipping forms, fill gift message fields, read the on-page delivery address to verify it matches the intended buyer, start the Buy Now flow from a product page, and detect the active Amazon account. Purchase controls are never activated: address and gift steps only. Detecting the signed-in Amazon account briefly opens Amazon's account-switch page in an unfocused background window, which closes automatically. |
| rccp.automationalchemists.com | Keep the extension and this web application in sync on the same signed-in account, so settings, gift templates, and fulfilment data match and signing out here also signs the extension out. At browser startup the extension may briefly open this dashboard in an unfocused background window to refresh the session, closing it automatically. |
| storage | Persist user settings, gift message options, cached order data, safety state (address verification result and paste pacing counters), and the authentication session locally within the extension. |
| tabs | Read the URL of the tab an action was triggered from so the correct page-specific action runs, send status updates to the extension's own content scripts, and open eBay order detail pages in an unfocused background window for batch scanning (closed automatically when scanning finishes). |
| webNavigation | Detect Amazon AU sign-out, web app sign-out, and Amazon account-switch navigation events, solely to keep the signed-in account status shown in the extension accurate. Navigation data is not stored or transmitted. |
8. Your Rights
You have the right to:
- Access all data associated with your account via the CP Bot Admin dashboard and your Account page.
- Delete individual fulfillment records, activity logs, gift templates, and label history entries at any time.
- Export your data by contacting us (see Section 10).
- Delete your account entirely, which will cascade-delete all associated data across both products.
- Uninstall the CP Bot extension at any time. Local extension storage is automatically cleared on uninstall. Server-side data remains until account deletion.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of the Service after changes constitutes acceptance of the revised policy.
10. Contact
If you have questions about this Privacy Policy or want to exercise your data rights, please contact us at:
dsclub.au@gmail.com