Agentic Sellar
Agentic Sellar / Information

Privacy Policy

Updated 2026-10-19

Last updated: 2026-10-19 Effective: 2026-10-19

This Privacy Policy describes how 11978853 CANADA INC. ("Agentic Sellar," "we," "us," or "our") collects, uses, and discloses information when you use the Agentic Sellar platform at agenticsellar.com (the "Service").

Agentic Sellar is a hosted service that connects authorized Amazon Ads and Seller Central accounts to dashboards, a REST API, and a managed Model Context Protocol (MCP) server. We act as a Solution Provider and Registered Advertising Developer with Amazon, operating under the authorization each seller-customer grants us to access the Amazon Ads API and Selling Partner API (SP-API).

1. Information We Collect

1.1 Information You Provide

When you create an account, connect services, or configure optional features, we collect:

  • Account information , email address, password (stored as a bcrypt hash; we never store the plaintext), organization name, and user display name.
  • Amazon API credentials , OAuth refresh tokens and application credentials needed to call the Amazon Ads API and SP-API on your behalf. These are encrypted at rest using AES-256-GCM.
  • AI-client authorization data , registered-client metadata, scoped grants, selected Amazon-account bindings, hashed access and refresh tokens, expiry times, and revocation state. The connected AI client receives a token for Agentic Sellar, not an Amazon credential.
  • Product configuration , plan, selected ASINs for retained history, Amazon regions and profiles, and any dashboard, goal, permission, or optional automation settings you choose.
  • Optional LLM provider credentials , an Anthropic, OpenAI, or Google API key only if you enable a feature that asks you to provide one. The core MCP and REST connection does not require your LLM key.

1.2 Information We Retrieve From Amazon

With the authorization you grant via Amazon OAuth, we can retrieve:

  • Amazon Ads data , campaign, ad-group, keyword and target structure; bids and budgets; advertising profiles; and reporting data such as impressions, clicks, cost, attributed sales, purchases, search terms, and advertised products.
  • Seller Central data , catalog and listing information, inventory, aggregate order metrics, financial events and fee records, and other non-restricted operations exposed by the connected application's SP-API roles.
  • Live responses and temporary reports , Access-plan operations generally call Amazon at request time. Generated advertising reports can be stored temporarily for up to 72 hours so a client can poll and retrieve them.
  • Selected retained history , Data plans store supported non-PII history for the marketplace-specific ASINs you activate, subject to the retention schedule below.

We do not request SP-API roles for end-buyer names, addresses, phone numbers, email addresses, or shipment-address data.

1.3 Information We Do Not Collect

We explicitly do not collect or store:

  • Customer names, addresses, phone numbers, or other end-buyer PII.
  • Your bank or payment information (billing is handled by our payment processor Stripe).
  • Cross-site browsing history or advertising profiles.

1.4 Technical Information

We collect standard server logs (such as IP address, user agent, request path, and timestamp) for security, debugging, and rate-limit enforcement. We also use cookieless website analytics for page views and conversion events. First-touch landing path, referring host, and UTM parameters are kept in session storage and sent only if you create an account. We do not put email addresses or Amazon data in analytics events. Server logs are retained for 30 days.

2. How We Use Information

2.1 Core Service Functions

  • Authenticating you and maintaining your session.
  • Authorizing connected clients , issuing scoped, expiring tokens for the Amazon accounts a workspace owner approves.
  • Calling Amazon APIs on your behalf , returning live data, requesting reports, retaining eligible history, and submitting confirmed writes under the scopes you approved.
  • Displaying dashboards, usage, and receipts , presenting supported Amazon data and an audit trail of API and agent activity.
  • Providing optional automation features , computing metrics and proposing or executing actions under the separate settings and permissions you enable.

2.2 AI Clients and Optional LLM Processing

  • Connected AI clients: When you ask a connected client such as Claude or ChatGPT to use Agentic Sellar, the Service returns the requested Amazon data or operation result to that client. The client provider processes that content under its own terms and your account settings. We do not control what the client retains after receiving it.
  • No Amazon-token passthrough: Connected clients receive scoped Agentic Sellar tokens. We do not send them Amazon refresh tokens, application secrets, or your optional LLM API key.
  • Optional model-backed features: If you configure an Agentic Sellar feature with your own Anthropic, OpenAI, or Google API key, we may send the provider aggregate, pre-computed performance metrics, applicable search-term text, configured goals, and the instructions needed to provide that feature. We do not send credentials, server secrets, end-buyer PII, or shipment-address data.
  • Validation: Optional model-generated actions pass through server-side schema, numerical, permission, and leakage checks before they can enter an execution workflow.
  • Training: We do not use your Amazon data to train our own or a third party's model. A connected client or optional model provider has its own data-use and retention terms, which you should review.

2.3 We Do NOT

  • Sell your data, ever.
  • Share your Amazon data with other customers.
  • Use your Amazon data for advertising to you or anyone else.
  • Train machine-learning models on your data.
  • Access your account or data except to provide, secure, maintain, or support the Service, to act on your requests, or where required by law.

3. How We Share Information

We share information only in these narrow circumstances:

3.1 Service Providers

  • Hosting and compute: Vercel and Neon process data on our behalf under standard GDPR/CCPA Data Processing Addendums.
  • Background processing: Inngest carries background-job metadata and non-credential event payloads used for sync and report workflows.
  • Website analytics: Vercel Analytics receives cookieless page-view and conversion-event data. We exclude email addresses, Amazon credentials, and Amazon account data from event properties.
  • Connected AI clients: We return requested results to an AI client only after an authorized user grants that client access. The client provider then processes those results under its own terms.
  • Optional LLM providers: If you enable a model-backed feature, we proxy the necessary minimized content to the provider you chose using your API key.
  • Error monitoring: Our hosting platform's log streams (Vercel) receive exception data that is scrubbed of credentials and sensitive fields.

3.2 Amazon

We make authenticated calls to Amazon Advertising and SP-API on your behalf. Amazon's own privacy policies govern their handling of those calls.

3.3 Legal Requirements

We may disclose information if required by law, court order, or to protect our or users' rights, property, or safety.

3.4 Business Transfers

If 11978853 CANADA INC. is involved in a merger, acquisition, or asset sale, user data may transfer as part of that transaction. We will provide notice before your data becomes subject to a different privacy policy.

4. Data Retention and Deletion

  • Account data: retained while your account is active and for 30 days after deletion, unless law requires longer.
  • Amazon credentials: encrypted refresh tokens are deleted immediately upon disconnection from our service.
  • AI-client grants and tokens: access ends at expiry, revocation, or deletion. Token values are stored as hashes; grant metadata and call receipts may be retained while the account is active and as reasonably needed for security, abuse prevention, billing, and dispute resolution.
  • Access-plan data: ordinary live-operation responses are returned to the caller and are not added to retained analytics. Generated advertising reports are deleted after their temporary 72-hour retrieval window.
  • Campaign and performance data: active Data plans retain newly collected, non-PII history for up to 13 months when it remains necessary for the analytics features you use. ASIN selection is marketplace-specific. When you cancel, move to Access, or deactivate an ASIN in a marketplace, affected history remains recoverable for 90 days before deletion. You can request earlier deletion.
  • Audit log: retained for 7 years to comply with tax and financial-record requirements. You may request pseudonymization.
  • Server logs: 30 days.
  • LLM proxy logs: 0 days. We do not persist request/response content.

To request deletion: email privacy@agenticsellar.com with your organization ID. We will confirm deletion within 30 days.

5. Your Rights

5.1 All Users

  • Access , export all data we hold about you, in JSON.
  • Correction , request correction of inaccurate data.
  • Deletion , request deletion subject to the retention schedule above.
  • Portability , we provide exports in standard formats.
  • Opt-out of marketing , any marketing email includes an unsubscribe link. Service emails (security alerts, billing) cannot be opted out of while the account is active.

5.2 GDPR (EEA residents)

If you are in the European Economic Area, you have the rights above plus: the right to object to processing, the right to restrict processing, the right to lodge a complaint with your supervisory authority, and the right to withdraw consent. Our legal basis for processing is (a) contract performance (the service you signed up for), (b) legitimate interest (security, fraud prevention), and (c) your consent (for LLM processing where you chose the provider).

5.3 CCPA (California residents)

California residents have the right to know what personal information we collect, use, disclose, and sell; the right to delete; and the right to non-discrimination for exercising these rights. We do not sell personal information.

5.4 Contact

Privacy requests: privacy@agenticsellar.com Data Protection Officer: privacy@agenticsellar.com

6. Security

  • Encryption at rest: AES-256-GCM for all credentials and tokens. Keys are managed in our hosting provider's secret manager and never logged.
  • Encryption in transit: TLS 1.2 minimum for all API traffic.
  • Access control: database access is scoped by organization_id at the query layer (multi-tenant row-level isolation is enforced in application code and verified on every query).
  • Authentication: bcrypt password hashing (cost factor 12). API keys and AI-client token values are stored as cryptographic hashes rather than plaintext.
  • Least privilege: staff access to production data is role-restricted and logged; production access requires MFA.
  • Vulnerability management: we run automated dependency scanning and patch critical vulnerabilities within 72 hours.

Despite these measures, no system is perfectly secure. If you believe your account has been compromised, contact security@agenticsellar.com immediately.

7. International Data Transfers

Data is stored and processed in the United States. If you are outside the US, your data is transferred to the US under Standard Contractual Clauses (for EEA customers) or your explicit consent at signup.

8. Children

The Service is not directed to anyone under 18. We do not knowingly collect information from anyone under 18. If we learn we have collected information from a minor, we will delete it.

9. Changes to This Policy

We will notify you by email at least 30 days before material changes take effect. Continued use after that period constitutes acceptance of the new policy.

10. Contact

11978853 CANADA INC. Privacy: privacy@agenticsellar.com Security: security@agenticsellar.com Support: support@agenticsellar.com