Privacy Policy

What I collect

• Account info: your email and a hashed password (I never store your password in readable form).
• Amazon authorization: a refresh token you grant via Amazon's own consent screen, plus your Seller ID.
• An optional third-party sales-data API key, if you choose to add one.
• Your settings and run history. The pricing changes and removals the tool made for you.
• Billing: handled by Stripe. I never see or store your card number.

How it's used

Only to run the tools you signed up for. Pull your stranded report, analyze it, update your prices, and email you what changed. That's it. I don't build advertising profiles and I don't use your data to compete with you.

How it's protected

Your Amazon token and any optional third-party API key are encrypted at rest (AES via Fernet); the encryption key is stored separately from the database. Everything travels over HTTPS (with HSTS). Each customer's data is isolated. One account can never read another's. Passwords are salted and hashed, never stored in the clear. Login is rate-limited, and the database is not publicly exposed. We handle data obtained through Amazon's Selling Partner API (“Amazon Information”) in line with Amazon's Data Protection Policy and Acceptable Use Policy.

How long we keep it (retention & deletion)

We keep data only as long as needed to run the service:

• Your Amazon refresh token and any optional third-party API key are wiped automatically when your subscription ends (we no longer need them).
• Amazon Information is destroyed within 30 days of it no longer being needed, of cancellation, or of a deletion request — usually much sooner.
• Your account, settings, and run history are removed on account deletion. Billing records may be retained by Stripe as required for tax/accounting.

If something goes wrong (breach notification)

If we ever confirm a security incident affecting your data, we notify Amazon within 24 hours where Amazon Information is involved, notify affected users without undue delay, and comply with any applicable breach-notification laws.

Who it's shared with

Only the services required to make the tools work:

• Amazon SP-API. To read your reports and update your listings (actions you authorize).
• A third-party sales-data service of your choosing. Only if you supply that service's API key, and only to look up pricing data for your own items.
• Stripe. For payments.
• Fly.io. Hosting. Gmail. To email you run summaries.

I never sell your data to anyone, for any reason.

Your control & your rights

Cancel any time from the billing portal. You can revoke the app's Amazon access from your Seller Central at any moment. You may request a copy of the account data we hold, ask us to correct it, or ask us to delete your account and stored data — email the contact below and we'll act within 30 days (typically sooner). Depending on where you live, you may have additional rights under laws such as the GDPR/UK GDPR or US state privacy laws (e.g., CCPA); we honor those requests.

Not Amazon

SellCrate is an independent tool and isn't affiliated with, endorsed by, or operated by Amazon.

Questions or a deletion request? max@maxxmultimedia.org. See also the Terms of Service and Disclaimer.