Privacy Policy

1. Who we are

AMZ Selling Tools (“we”, “us”, “our”) operates an Amazon product tracking service that monitors product listings, prices, BSR rankings, ratings, review counts and availability, records where listings rank in Amazon search results for keywords you choose, and fetches the customer reviews of listings you choose (the public review text and reviewer display names as Amazon publishes them), across multiple Amazon marketplaces. This policy describes what personal data we process when you use the service.

2. Data we collect

• Account data — email address, hashed password, and account creation timestamp. Collected when you register.
• Billing data — Stripe customer ID, last 4 digits of the payment card, and billing history. The full card number is held by Stripe; we never see or store it.
• Tracking data — the Amazon ASINs, marketplaces and search keywords you choose to track, plus the price / BSR / rating snapshots, the search-result rank records (including the result cards Amazon showed for the keyword) and the reviews fetched (public text, rating, reviewer display name, date, image links) for them over time. This is service-functional data; the service cannot work without it.
• Technical logs — IP address, user-agent, request paths, and error traces. Retained for debugging and abuse detection.
• Analytics — Cloudflare Web Analytics records aggregate pageview counts, referrer, country, and Core Web Vitals via a cookieless beacon. No personal identifiers are tied to analytics events.

3. How we use it

• Provide and operate the tracking service.
• Process payments and reconcile credit balances (via Stripe).
• Send service emails (account verification, billing receipts, support replies).
• Detect and prevent abuse, fraud, and security incidents.
• Comply with legal obligations and respond to lawful requests.

Under the UK GDPR / EU GDPR, our lawful basis is performance of contract for account / billing / tracking data, and legitimate interest for technical logs and abuse prevention. The reviews we fetch for you include the reviewer display names Amazon publishes; we process them on the basis of legitimate interest, keep no other information about reviewers, and show a review only to accounts that track that listing.

4. Cookies

We use a single first-party authentication cookie (a session JWT) so you stay logged in across visits. The cookie is `HttpOnly`, `Secure`, and `SameSite=Lax`. We do not use advertising or cross-site tracking cookies. Our analytics provider (Cloudflare Web Analytics) is cookieless — no consent banner is required for analytics under current UK ICO and EU EDPB guidance.

5. Sub-processors

We share the minimum data necessary with the following sub-processors:

• Stripe (Stripe, Inc.) — payment processing. Receives your email, billing address (if you provide one), and payment method. Stripe is the data controller for payment-card data.
• Cloudflare (Cloudflare, Inc.) — CDN, DDoS protection, and cookieless web analytics. Sees request metadata (IP, headers, URL).
• Email delivery provider — sends transactional email (verification, receipts, password reset). Receives your email address and the message body.

6. Data retention

We retain account and tracking data for as long as your account is active. If you delete your account, we erase personal data within 30 days, except where retention is required by law (e.g. billing records for tax compliance — typically 7 years). Technical logs are retained for up to 90 days. Keyword rank records are kept for as long as the account is active; the full search-result card lists behind each scan are kept for 90 days; a deleted keyword line and its history are purged 30 days after deletion. Fetched reviews are kept while any review line tracks the listing and are deleted 90 days after they were last seen once none does; the list of reviews each run brought in is kept for a year; a deleted review line and its run history are purged 30 days after deletion.

7. Your rights

If you are in the EU, UK, or another jurisdiction that grants similar rights, you can:

• Request a copy of the personal data we hold about you (right of access).
• Request correction of inaccurate data (right to rectification).
• Request deletion of your data, subject to legal retention obligations (right to erasure).
• Export your data in a machine-readable format (right to portability).
• Object to processing based on legitimate interest.
• Withdraw consent for any processing based on consent.
• Lodge a complaint with your local data protection authority (e.g. the ICO in the UK).

To exercise any of these rights, contact us through the feedback form in the application or via the contact email below.

8. International transfers

Our servers and the servers of our sub-processors (Stripe, Cloudflare) may be located outside the UK / EU. Where data leaves the UK / EU, transfers rely on the sub-processor’s Standard Contractual Clauses or an equivalent UK / EU adequacy mechanism.

9. Children

The service is intended for use by Amazon sellers. It is not directed at children under 16, and we do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

For any privacy-related questions or to exercise the rights above, contact us through the feedback form in the application, or by email at [email protected].