Privacy Policy

This Privacy Policy describes how SellerCopilot ("we", "us") collects, uses, stores, protects, shares, and deletes information when you use the SellerCopilot application and the website sellercopilot.ai (together, the "Service"). SellerCopilot is operated by Consultation IntelEcommerce inc., Quebec, Canada ("the Company").

1. Information we collect

We collect the following categories of information:

• Account information. When an account is created for you, we collect your name, email address, and a password (stored only as a salted cryptographic hash).
• Amazon selling data. When you authorize SellerCopilot to access your Amazon seller account through Amazon's Selling Partner API and/or Amazon Ads API, we retrieve business data for the accounts and marketplaces you authorize, including: sales and traffic reports, order reports, inventory and listing reports, Buy Box and offer data, Subscribe & Save data, financial transaction events, and advertising performance reports. We request only the data categories required to provide the analytics features described on our Analytics page.
• Data you upload. You may optionally upload report files (for example, CSV exports from your Amazon account, or Amazon's Fee Preview report) to supplement automated ingestion.
• Usage information. Standard technical logs (such as authentication events and error logs) needed to operate and secure the Service.

We do not sell data, do not use advertising trackers on this website, and do not collect data about Amazon shoppers beyond what Amazon's reports lawfully include. We do not store buyer names, email addresses, phone numbers or street addresses. To compute repeat-purchase analytics for your own account, the first street line of an order's ship-to address is read in memory and turned into a digest together with the city, state or province, postal code and country; the digest and those location fields are stored, the street line is not.

2. How we use information

• To provide the Service: dashboards, forecasts, daily recommendations, and reports about your own Amazon business.
• To generate AI-powered analyses of your business data. Written reports replace product names with placeholders before they are sent to our AI provider; the assistant sends product identifiers and titles so it can answer questions about specific products. Our Security page sets out what each feature sends. AI outputs are shown only to your account and to our team.
• To operate, secure, and improve the Service (authentication, error diagnosis, support).
• To communicate with you about your account (for example, email confirmation, invitations and password resets).
• To manage your subscription and billing.

We do not use your data to train machine-learning models, and we never use one customer's data to provide services to another customer. Our team reviews, internally, how recommendations perform across customer accounts in aggregate, to improve the Service; no customer is shown that review or another customer's data.

3. How we store and protect information

Data is transmitted over encrypted connections and held in an access-controlled PostgreSQL database in the United States. Amazon API credentials are encrypted at rest, passwords are stored only as salted hashes, and customer data is scoped to your own company account, by the application and, for the application's normal requests, by row-level security in the database, so your data is never visible to another customer. Information received through Amazon's Selling Partner API is handled in accordance with Amazon's Acceptable Use Policy and Data Protection Policy.

Our Security page describes these controls in full, including the specific algorithms used, how account isolation is enforced, how our AI features handle your data, and the buyer data we deliberately do not store.

4. How we share information

We do not sell or rent your information. We share data only with the service providers ("subprocessors") required to operate the Service, each bound to process data only on our instructions:

• Cloud hosting and database providers (Railway, Neon) — to run the application and store data.
• Network and security provider (Cloudflare) — to deliver the website and the application, protect them from abuse, and measure aggregate page traffic in the application (Cloudflare Web Analytics, which uses no cookies).
• AI processing provider (Anthropic) — to generate the AI analyses described above.
• Transactional email provider (Resend) — to deliver account emails such as email confirmation, invitations and password resets.
• Content delivery (Google Fonts, jsDelivr) — application pages load fonts and a charting library from these services, which receive your IP address and browser details.
• Business email (Zoho) — to receive and answer messages you send us.
• Payment processor (Stripe) — to process subscription payments. Stripe receives your email address and payment details directly; we do not receive or store full card numbers.

We may also disclose information if required by law, or to protect the rights, safety, or property of our users or the Company.

5. Data retention and deletion

• We retain your data while your account has a trial or a subscription, so the Service can provide historical analytics and trends.
• When your subscription ends, your Amazon connections are switched off so no new collection starts (a run already under way may finish), and a 30-day retention period starts. Your data is kept for at least the first 23 days of that period so you can resume, and our team deletes it before the 30 days are up. Deletion is carried out by a person, not automatically.
• If a free trial ends without a payment method, access is suspended, your Amazon connections are switched off, and the same 30-day retention period starts: add a payment method within its first 23 days to resume with your data; our team deletes it before the 30 days are up. Ask us at any time and we will delete it sooner.
• You may request deletion of your account and associated data at any time by contacting us. Upon a verified request, we delete the account's data from our production systems.
• You may revoke SellerCopilot's access to your Amazon account at any time from Amazon Seller Central, and its access to your advertising data from the Amazon account that granted it. After you revoke, Amazon no longer returns data to us under that authorization. If you revoke the Seller Central authorization, we notice the next time we request data from Amazon and Amazon refuses: no new collection starts for that Amazon account, and our team deletes the data collected from it within 30 days of noticing, unless you reconnect it first. Removing the Seller Central connection in SellerCopilot's settings has the same effect. Revoking or removing only the advertising access stops advertising collection but does not by itself delete stored data; it is deleted with your account, or on request.
• Records of AI usage and cost are kept for accounting and are not removed by account deletion. Our security access log, which records the email address and IP address used for sign-ins and administrative actions, is kept for 13 months and then deleted.

6. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us at the address below; we will respond within the timeframe required by applicable law.

7. International transfers

Your data is stored in the United States. Our service providers may process it in other countries, and requests reach the Service through Cloudflare's global network, which may process them at the location nearest you. The Company is based in Canada, and our staff may access data from Canada to operate and support the Service. Where data is transferred across borders, we rely on our providers' safeguards and contractual commitments consistent with applicable data-protection regulations.

8. Children's privacy

The Service is a business tool intended for use by adults and is not directed to children. We do not knowingly collect information from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated "Last updated" date.

10. Contact us

For privacy questions or requests, contact us at [email protected].