Data Protection Policy

Draft under review. This page is not legal advice and may change before launch. Last updated: 11 October 2026.

1. Scope

This policy applies to information we receive from Amazon's Selling Partner API on a seller's behalf ("Amazon Information"), and, once it opens, from the Amazon Ads API (see the Amazon Ads Data Policy).

2. Use

Amazon Information is used only to show the seller their own profit, fees, payouts, inventory and reports. It is never sold or rented, never used for advertising, never combined to profile buyers, never shared with data brokers, and never used to train third-party models.

3. What we do not take

Buyers' names, addresses, phone numbers and e-mails are not requested or stored.

4. Access

Each customer's workspace is separate. Every request is checked so a user sees only their own workspace; automated tests try to cross workspaces and must fail.
Staff access to a customer's account only with the customer's permission: read-only, time-limited, e-mailed to the customer and logged.

5. Protection

Encryption in transit (TLS 1.2 or newer) and at rest (encrypted server disk).
Amazon access keys and two-step secrets encrypted again inside the application (AES-256-GCM).
Passwords stored as one-way hashes. Secrets kept in a managed secrets store, not in code. Logs contain no passwords or access keys.

6. Retention and deletion

Active account: data kept. Inactive account: kept 6 months, then deleted.
On disconnect: access keys deleted immediately.
On request: deleted within 30 days. Backups: daily server snapshots kept 7 days.

7. Incidents

We will notify Amazon within 24 hours of detecting an incident affecting Amazon Information, and affected customers without undue delay.

8. Testing and assurance

We have no independent penetration test and no certification yet. We will publish them here when they exist.

9. Contact

info@sellergrid.co. See also the Privacy Policy.