DRAFT - for review by a lawyer. Not legal advice and not yet in force. Text marked [like this] still has to be filled in or confirmed.

Privacy Policy

This explains what personal data SELLINTEL handles, why, for how long, and what you can do about it. It is written for sellers in the UK and follows the UK GDPR and the Data Protection Act 2018.

1. Who we are

SELLINTEL is an online dashboard for Amazon sellers. It is provided by [LEGAL ENTITY NAME], a company registered in [England and Wales] under number [COMPANY NUMBER], with its registered office at [ADDRESS] ("we", "us"). You can reach us about privacy at [PRIVACY EMAIL]. [ICO registration number, if required]

2. Our role

We play two different roles, depending on the data:

Controller for the data we need to run our own relationship with you: your account, billing, support and the security of the service.
Processor for the business data you bring into your workspace (for example your Amazon sales, stock, costs and supplier invoices). We handle it only to provide the service to you and on your instructions. The terms for this are in our data processing terms [link to DPA, to be written].

3. What we collect

Your account

Your email address, a securely stored password (we cannot read it), the name you give your workspace, the people you invite to it and their role.

Billing

Billing is not switched on yet. When it is, payments will be handled by Stripe. We will keep your plan, billing period, invoices and payment status, but never your full card number; Stripe holds that.

Accounts you connect

Amazon. You can connect your own Amazon seller account through Amazon's Selling Partner API. We ask Amazon only for read-only access with these roles: Inventory and Order Tracking, Finance and Accounting, Amazon Fulfillment, Product Listing and Pricing. We do not ask for any restricted role, so Amazon does not give us buyer names, addresses or other buyer personal data. We keep the authorisation token Amazon gives us, encrypted, plus your seller ID and marketplace. Amazon asks you to renew this authorisation once a year.
Keepa. You can add your own Keepa API key. It is stored encrypted, is only used for requests made for your workspace, and is never shown back to you in full or sent to your browser.

Your customers' data

SELLINTEL is built so that it does not need your buyers' personal data, and the Amazon roles we use do not provide it. If personal data of other people ends up in your workspace anyway (for example a name on a supplier invoice you upload), we treat it as your data and process it only as your processor.

Usage, security and error data

Our servers record technical information such as the time of a request, IP address, the part of the service used and error messages. We use it to keep the service secure, stop abuse and fix faults. We do not use advertising trackers.

Support access

We look inside your workspace only when you ask us for help, when we must investigate a security problem, or when the law requires it. Such access is limited to what is needed and is logged.

4. How we use your data

Purpose	Lawful basis (UK GDPR art. 6)
Creating and running your account and workspace, showing your dashboard	Contract
Fetching your Amazon and Keepa data with your keys	Contract (on your instruction)
Billing, once switched on	Contract; legal obligation for accounting records
Security, fraud and abuse prevention, error fixing	Legitimate interests
Service emails (sign-in, verification, important changes)	Contract
Product news, only if you ask for it	Consent (you can withdraw any time)

We do not sell personal data and do not use it for automated decisions that have legal or similar effects on you.

5. Who we share it with

We use a small number of providers (sub-processors). Each is bound by a contract that protects your data.

Provider	What for	Where
Hostinger [legal entity]	The virtual server that runs SELLINTEL, including its database (Supabase, run by us on that server) and file storage	[data centre country]
Stripe [legal entity]	Payments, from when billing starts	[UK/EU/US]
[Email provider]	Sign-in and service emails	[country]

When you connect Amazon or Keepa, data is exchanged with them on your instruction and under their own terms; they are not our sub-processors. We may also disclose data if the law requires it, or to a buyer of our business under the same protections.

6. International transfers

[Where the server is located. If any provider handles data outside the UK, the safeguard used, e.g. UK adequacy regulations, or the International Data Transfer Agreement / UK Addendum to the EU standard contractual clauses.]

7. How we protect your data

All connections use HTTPS.
Every workspace is separate: each record belongs to one workspace, and the database checks on every request that you belong to it.
Amazon tokens and Keepa keys are stored encrypted and are only used on our server.
Read-only Amazon access, and the smallest set of roles we need.
Backups are encrypted before they leave the server.

8. How long we keep it

Data	Kept for
Account and workspace data	While your account is open
After you ask to delete your workspace	Switched off straight away, erased within [30 days]
Encrypted backups	Up to [14 days], then overwritten
Server and security logs	[30 days]
Billing records	[6 years] (tax and accounting rules)

9. Your rights

Under the UK GDPR you can ask for access to your data, correction, erasure, restriction, data portability, and you can object to processing based on legitimate interests or withdraw consent. Two of these you can do yourself in SELLINTEL:

Export: the workspace owner can download all workspace data as a JSON file.
Delete: the workspace owner can ask for the workspace to be deleted; it is switched off at once and erased as set out in section 8.

For anything else write to [PRIVACY EMAIL]. We answer within one month. You can also complain to the Information Commissioner's Office (ico.org.uk); we would appreciate the chance to fix things first.

10. Requests from your customers

We do not hold your buyers' personal data through Amazon. If one of your customers contacts us about data in your workspace, we will pass the request to you and help you answer it.

11. Cookies and similar technologies

We do not use advertising or tracking cookies. The dashboard stores your sign-in session in your browser's local storage so you stay signed in; it is strictly necessary and is removed when you sign out. [If analytics are added later, describe them here and ask for consent first.]

12. Children

SELLINTEL is a business tool and is not meant for anyone under 18.

13. Changes to this policy

If we change this policy in a way that matters, we will email workspace owners before the change takes effect. The date at the bottom shows the latest version.

For the lawyer: points to review

Legal entity, address, company number, privacy contact; whether ICO registration (data protection fee) is needed.
The controller/processor split in section 2, and the data processing terms (DPA) that still have to be written.
Lawful bases in section 4, especially legitimate interests (a short LIA may be needed).
Sub-processor list and contracts: Hostinger (entity and data-centre country), email provider, Stripe once billing starts.
International transfers (section 6) and the safeguard to name.
Retention periods in section 8 (30 days after deletion, backup and log periods, 6 years for billing records).
Whether Amazon's Data Protection Policy and Acceptable Use Policy for Selling Partner API developers require extra wording.
Cookie/local-storage statement under PECR.
Age statement and whether any consumer-law wording is needed (customers are businesses).
Breach notification wording and timelines towards customers.

Last updated: [DATE] · Draft 0.2 (2026-10-13)