Legal

Privacy Policy

Last updated: October 9, 2026

Who we are
Data we collect
Amazon data
How we use data
Sharing
Security
Retention & deletion
Your rights
Cookies
Contact

This Privacy Policy explains how Your Company Name (“SellerEcom”, “we”, “us”) collects, uses, shares and protects information when you use our website and software service (the “Service”). The Service helps Amazon sellers automatically send Amazon's “Request a Review” solicitation for eligible orders using the Amazon Selling Partner API (“SP-API”).

1. Who we are

Your Company Name is the data controller for account information you give us. For data we retrieve from your Amazon seller account on your instructions, we act on your behalf as your service provider (processor). Contact details are in section 10.

2. Data we collect

Category	Examples	Source
Account data	Name, email address, hashed password	You, when you sign up
Amazon connection data	Selling partner ID, marketplace IDs, OAuth refresh token	Amazon, when you authorize the Service
Order metadata	Amazon order ID, purchase date, order status, estimated delivery date, fulfillment channel (FBA/FBM), order total and currency	Amazon SP-API Orders API
Service activity	Whether a review request was sent, scheduled, skipped or failed, with timestamps	Generated by the Service
Support messages	Name, email and message content you send through our contact form	You
Technical data	IP address, browser type and server logs, used for security and abuse prevention	Your browser

3. Amazon data and buyer information

We access only the SP-API roles needed to provide the Service. In particular:

We do not request, access or store buyer Personally Identifiable Information (PII). That includes buyer names, email addresses, phone numbers and shipping or billing addresses. The Service does not require restricted SP-API roles.
Review requests are sent by Amazon through Amazon's Solicitations API. We never contact your buyers directly and never see the email Amazon sends.
We use Amazon data only to provide the Service to the seller who authorized it. We do not use it to build profiles, for marketing, or to compete with Amazon or other sellers, and we never sell it.
We handle Amazon information in line with Amazon's Data Protection Policy and Acceptable Use Policy for SP-API developers.

4. How we use data

To provide the Service: syncing orders, deciding when each order is eligible, and sending review requests.
To show you your dashboard, order history and reporting.
To secure the Service, prevent abuse and fix problems.
To reply to your support requests and send essential service emails (for example, if your Amazon authorization stops working).
To meet legal obligations.

Our legal bases (where GDPR or similar laws apply) are performance of our contract with you, our legitimate interests in running a secure and reliable service, and compliance with law.

We do not sell or rent personal information. We share data only with:

Amazon, as required to call the SP-API on your behalf.
Infrastructure providers (cloud hosting, database and email delivery) who process data under written agreements and only on our instructions.
Payment processors, for paid plans. We never see or store full card numbers.
Authorities, when required by law or to protect rights and safety.

6. Security

All traffic to and from the Service is encrypted in transit with TLS (HTTPS).
Amazon OAuth refresh tokens are encrypted at rest with AES-based encryption. Passwords are stored only as salted bcrypt hashes.
Access to production systems is restricted to authorized personnel on a least-privilege basis and protected with multi-factor authentication.
We keep systems patched, monitor for suspicious activity and maintain an incident-response plan.
If a security incident affects Amazon information, we notify Amazon within 24 hours of detection, as required by Amazon's Data Protection Policy. We notify affected users and regulators as required by law.

7. Retention and deletion

Order metadata is kept while your Amazon account is connected, so we can show history and avoid duplicate requests.
When you disconnect an Amazon account, its stored token and order data are deleted from our active database immediately and purged from backups within 30 days.
When you delete your SellerEcom account, all associated data is deleted on the same schedule.
You can also revoke our access at any time in Seller Central under Apps and Services → Manage Your Apps.
Server logs are kept for up to 90 days.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to your data protection authority. To use these rights, email [email protected]. We reply within 30 days.

The Service is for businesses and is not directed at children under 16. Your data may be processed in countries other than your own; where required, we use appropriate safeguards such as standard contractual clauses.

9. Cookies

We use one strictly necessary, HTTP-only cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. If we add analytics in the future, we will update this policy and ask for consent where required.

10. Contact

Your Company Name
Street address, City, State/Province, Postal code, Country
Privacy: [email protected]
Support: [email protected]

We may update this policy from time to time. We will post the new version here and, for material changes, notify you by email. See also our Terms of Service.