Legal · updated 9 October 2026 · previous revision 8 October 2026

Privacy Policy

1. Who we are

This Privacy Policy explains how Polarstar OÜ (Estonian commercial register code 16838745, VAT number EE102694165, address: Tornimäe tn 5, 10145 Tallinn, Estonia), trading as SellerEngine, collects, uses and protects your information when you use our services (the "Services"), which include the SellerEngine website (sellerengine.app), the SellerEngine iOS app, and the SellerEngine tools: Sniper Hub, Sales Hub, PricePricer, Stock Control, TaxLedger, and Listing Health.

For the purposes of the EU General Data Protection Regulation ("GDPR"), Polarstar OÜ is the data controller for the personal data described below.

Contact: [email protected]

2. What data we collect

2.1 Account data

When you create a SellerEngine account, we collect:

• Name, company name, role title, and company size
• Email address
• Authentication metadata, including hashed password, email confirmation status, two-factor authentication enrollment status, and session metadata
• Subscription status and payment processor customer references, when billing is active

2.2 Amazon connection data

When you connect your Amazon account via Login with Amazon ("LwA") or an Amazon-authorized workflow, you authorize SellerEngine to read and write specific data on your behalf through the Amazon Ads API and, where enabled, the Amazon Selling Partner API ("SP-API"). We process:

• Advertising metrics: campaigns, ad groups, keywords, product targets, search terms, impressions, clicks, spend, orders, sales, and bid history.
• Seller operations data: SKU catalog, inventory snapshots, stock coverage, sales history, Amazon fee estimates, listing status, settlement data, and tax-related operational data where the relevant module is enabled.
• Tax compliance data (TaxLedger module): when you enable the TaxLedger module and authorize Amazon's restricted Tax role, we process Amazon VAT/tax reports that include buyer personal data (name and billing/shipping address) strictly to generate VAT invoices and tax reports for your statutory tax compliance. Buyer personal data is used only for the authorized tax-compliance purpose, not for marketing, profiling or AI requests. The infrastructure providers used to operate SellerEngine may process or store it for that purpose; disclosures to authorities are made only where legally required. Access to restricted Amazon tax reports depends on the permissions Amazon actually grants. Retention is limited to the applicable legal purpose and is subject to the deletion process and implementation limitations in section 7.
• Write actions you initiate: bid changes, negative keyword additions, harvested keywords, ASIN targets, pricing exports, listing updates, and other module-specific actions. Every live write requires an explicit user action or an approved workflow — we do not execute live Amazon writes from the demo environment.
• OAuth tokens: a refresh token issued by Amazon, which we store encrypted at rest. We do not store your Amazon password — the credential exchange happens entirely on Amazon's domain.

Demo mode is isolated from registered user workspaces. Demo sessions use fictional data, do not use your Amazon tokens, and do not call Amazon connections.

2.3 Operational logs

We keep audit logs of every write action initiated through our tools, including:

• Timestamp, action type (e.g. RAISE BID, LOWER BID, Add negative keyword, Harvest keyword, Price export, or Stock recommendation), and the parameters sent to Amazon or generated locally.
• Amazon's response (success, error code, error message).
• A snapshot of relevant metrics at the moment of the change, so you can evaluate whether your changes worked.

Our published retention limits remain 180 days for operational write-action logs and 30 days for ordinary technical data. Our review identified gaps in their automatic enforcement. The current sync-event cleanup removes older events after seven days but retains the latest event for each account, application, domain and event type. It does not establish automatic 180-day deletion of all write-action or security audit records.

Some records can therefore remain longer than the published limits while we correct the implementation and verify the affected stores. This correction does not authorize longer retention or waive your rights. We will not describe deletion as complete solely because a cleanup job ran. The limited account-deletion and fraud-prevention records are described in section 7.

2.4 Technical data

Requests can include an IP address, browser or app information and a timestamp, used for service operation, security and abuse investigation. The published 30-day limit for ordinary technical data is not yet enforced uniformly across all audit and security records. We are correcting this gap; we do not claim that all IP addresses and browser information are automatically removed after 30 days. The separate handling of account-deletion records is described in section 7.

2.5 SellerEngine iOS app

The SellerEngine iOS app for iPhone and iPad shows the workspace data described above and adds no new categories of Amazon data. When you use it, we process:

• Sign-in: your account email address and password, checked by our servers as described in §2.1, and a two-step verification code. We link each app session to your account by your SellerEngine user ID and email address. The app itself does not store your password.
• App session tokens: after sign-in, our servers issue the app an access token that lasts one hour and a refresh token that lasts up to 30 days and is replaced each time it is used. The app keeps the refresh token in the iOS Keychain, on that device only and never synced to iCloud, and keeps the access token in memory. We store only one-way hashes of these tokens, together with the device name iOS gives the app (usually just the model, such as "iPhone") and when the session was created and last used. Signing out removes the tokens from your device and tells our servers to end the session.
• Face ID, Touch ID and device passcode: when you unlock the app, iOS checks your face, fingerprint or passcode on the device itself. SellerEngine never receives biometric data or your passcode; the app only learns whether the check succeeded. Your choice to unlock automatically is stored on the device.
• Technical data: requests from the app carry your IP address and an app identifier with the app and iOS versions. These records are subject to the retention limits and current enforcement limitations explained in section 2.4.
• Product images: product thumbnails load directly from Amazon's image servers, which receive your IP address as they would for any image on the web.

No tracking. The app contains no advertising or analytics SDKs, does not use the device advertising identifier, and does not track you across apps or websites owned by other companies. We use data from the app only to provide the Services.

2.6 Sale notifications in the iOS app

Sale notifications are available in the SellerEngine iOS app from version 3.6. They are optional and need your permission in iOS. We only receive a push token if you allow notifications for SellerEngine on your device. Sale alerts then start on for all your marketplaces, and you can change or stop them at any time (see "How to opt out" below). For sale notifications we process:

• Device push token: the token Apple issues so that notifications reach your device. We store it encrypted, linked to the app session that registered it, together with the app and iOS versions, the device model, whether notifications are allowed in iOS, and when we last sent a notification to it.
• Notification encryption key: the app creates an encryption key pair on your device. Only its public half is sent to us, and we use it solely to encrypt the notification content for that device. The private half stays in the iOS Keychain on the device, is never synced to iCloud and never leaves the device.
• Time zone and language: your device's time zone and its language and region setting, used to time and present notifications for where you are, for example to apply quiet hours in your local time.
• Notification preferences: whether sale alerts are on, which marketplaces and minimum order amount they cover, one notification per order or a summary, whether amounts are shown, the sound, and quiet hours. When you change them, they are stored with your account and apply to all your devices.
• Notification content: the Amazon marketplace (for example Amazon.de), the order amount and the number of units, and optionally the product name and image. Product images are downloaded from Amazon's image servers without your account credentials. Several orders at once arrive as one summary with the number of orders, the total and the marketplaces. Amounts appear only in the body of a notification, never in its title, and you can hide them. Notifications never contain buyer data (no buyer name, address or messages) and never the Amazon order number. This content is end-to-end encrypted: our servers in the EU encrypt it for each notification with the key generated on your device, and only the app on that device can decrypt it, locally.
• Duplicate check: so that each order notifies you only once, we keep a one-way hash of the Amazon order number with its marketplace and purchase time, and delete it after 14 days.

Daily summary. This option is off by default. If you enable it, we use your preferred time and device time zone to send yesterday's gross sales, units, orders, profit, the change from the same weekday a week earlier and the top product. The summary content is encrypted for your device in the same way as sale alerts. We store the date of the last summary to avoid sending it twice.

Near-instant sale alerts. When this feature is enabled, Amazon order-change notifications pass through Amazon Web Services SQS in Ireland (EU). We use the seller, order status, marketplace, purchase time and product identifiers and quantities to match the order to your account and prevent duplicate alerts. The consumer does not read buyer fields. These alerts show the product and units without an order amount; the later sales synchronization does not send a second alert for the same order.

Delivery by Apple. Notifications are delivered through the Apple Push Notification service, operated by Apple Inc. Apple only routes them: it receives the device push token, a generic "New sale" or "Daily summary" text and the encrypted content, which it cannot read. Apple processes this only to deliver the notification to your device, acting as our processor for that delivery (see §4.1 and §5). The app then decrypts the content on your device and shows the sale details in place of the generic text. If the content cannot be decrypted on the device, the notification shows only the generic alert text. We do not send Apple your email address or any other account data.

Retention and deletion. We stop sending to a device as soon as its app session ends, when the app reports that notifications are off in iOS, or when Apple reports that the token is no longer valid. The device push token, the public encryption key and the other device details are deleted when you sign out of the app on that device; when we sign out all your devices, for example after you reset or change your password, turn off two-step verification, or your account is locked after repeated failed verifications; and when you delete your account (§7). When an app session ends in any other way, for example because it expired, or when Apple reports that a token is no longer valid, we delete that device's details 30 days later. Your notification preferences are deleted with your account.

How to opt out. Turning sale notifications off never limits the rest of the app. You can:

• turn off Sale alerts in the app under Account › Notifications, which stops them on all your devices; the same screen lets you limit them by marketplace, minimum amount or quiet hours, and hide amounts;
• turn off notifications for SellerEngine in iOS Settings › Notifications › SellerEngine, which stops them on that device;
• sign out of the app on a device, which deletes that device's push token from our servers; or
• delete your account, which deletes all of the above.

2.7 What we do not collect

• Your Amazon Seller Central credentials.
• Buyer personal data beyond what tax compliance requires: outside the TaxLedger module (see §2.2), our tools operate on your seller operations and advertising data — not on buyer personal data. We do not collect buyer contact details, buyer messages, or any buyer marketing data, and we do not access buyer personal data for any module other than TaxLedger.
• Payment card data — billing, when applicable, is processed by a certified PCI-DSS payment processor; we only store the processor's customer reference.

3. Why we process your data (legal basis)

Under GDPR, we rely on the following legal bases:

• Contract (Art. 6(1)(b) GDPR): to provide the Services you signed up for — read your Amazon advertising data, execute the changes you initiate, and show you the results.
• Legitimate interest (Art. 6(1)(f) GDPR): to keep the Services secure, prevent abuse, debug operational issues, and improve the product. You can object to this processing at any time.
• Legal obligation (Art. 6(1)(c) GDPR): when we have to retain certain records for accounting, tax, or compliance reasons.

4. Who we share data with

We share the minimum necessary data with the following categories of recipients. Provider contracts and transfer safeguards are reviewed separately from the technical controls. A link to a provider's public terms is not proof that a particular account has accepted those terms.

4.1 Service providers and recipients

The following register names providers used by SellerEngine, including historical processing that remains relevant to retained records. A provider is not necessarily a processor for every service: its role depends on the service and applicable agreement. The list is not a certification that every account-specific agreement or transfer safeguard has been completed.

No blanket EEA-only processing guarantee applies. Encryption at the application layer protects selected secrets and encrypted backup contents; it does not mean every provider receives only unreadable data. The services and limitations below supplement the AI description in section 4.4.

4.2 Categories of recipients

• Amazon connections: when you connect an Amazon account or execute an approved action, we send the relevant request to Amazon Ads API or SP-API. This is the core service mechanism — we do not "share" data in a marketing sense.
• Infrastructure providers: Cloudflare, Hetzner and Backblaze provide edge services, databases, object storage, backend processing and backups. Application-layer encryption is used for Amazon refresh tokens, authentication secrets and encrypted backup contents. Application data that a service needs to process is not all opaque to the provider.
• Payment provider: Stripe processes payment and billing data. SellerEngine never receives or stores full payment card details. Stripe Tax calculates VAT under your account's jurisdiction.
• Email services: Namecheap Private Email handles service and support mail and current outreach transport. Google Gmail API was used for historical outreach. Email records can include a contact address, message content and, for seller service digests, the seller's own operational data. Mail already delivered to a recipient is not erased by deleting a SellerEngine account.
• Apple: if you turn on sale notifications in the iOS app, Apple's push service receives the device push token, delivery metadata and a generic "New sale" text, only to route each notification to your device. The notification content is end-to-end encrypted and Apple cannot read it (§2.6).
• Authorities: where required by law (e.g. tax audits, valid court orders). We will notify you unless prohibited from doing so.

We do not sell, rent, or trade your data. We do not share your advertising data with other SellerEngine users. We do not use your data to train machine-learning models for other customers.

4.3 Changes to subprocessor list

We will notify customers via email and update this Privacy Notice at least 30 days before adding or replacing a subprocessor. If you object to a new subprocessor, you may terminate your subscription before the change takes effect.

Correction of previous disclosures: some providers listed here were already used but were not named in the earlier public table. We have not established that the promised advance notice was sent for every historical addition. This correction records those existing data flows; it does not retroactively provide advance notice, obtain consent, activate a new provider or remove your right to object. We will retain evidence of the current correction notice and apply the existing advance-notice requirement to future provider additions or replacements.

4.4 AI features and data use

Listing Health and Listing Copilot use the OpenAI API to draft listing text, research competitor products, select keywords and answer listing questions. The free listing report also uses the OpenAI API. The optional semantic review in Sniper Hub uses OpenRouter to assess whether search terms are relevant to a product. These providers are based in the United States. AI processing is not guaranteed to stay in the EEA.

Depending on the feature, the request contains your question, listing and public catalog text, product attributes, approved keywords or search terms. Do not include buyer information or secrets in a question. Our input safeguards remove identified buyer, address, Amazon order-number and credential fields and reject file and image inputs. An AI answer cannot authorize a change to your Amazon account; you must approve the specific action before it is sent to Amazon.

SellerEngine does not use seller or Amazon Information to train, fine-tune or improve AI models, including across customers. OpenAI requests set store: false. This setting is not a claim of Zero Data Retention. Provider-side training restrictions, retention settings and contract acceptance are separate controls; our account-specific OpenAI and OpenRouter agreement evidence is still being completed. We do not claim that all such agreements have been executed.

The deployed AI request wrapper records the time, provider, feature, model, request identifier, outcome, HTTP status and elapsed time. These audit events do not contain prompt or response text. Suggestions saved in your workspace are separate from these audit records. AI answers can be incorrect: check them before publishing or acting on them. Questions about AI data use can be sent to [email protected].

5. International transfers

SellerEngine uses providers with EEA, global and non-EEA processing. Cloudflare's Western Europe storage location preference is not an EEA-only jurisdiction restriction. Hetzner backend hosting and the configured Backblaze backup region are in the EU. OpenAI, OpenRouter and MerchantWords involve US-based services; OpenRouter's final model host has not yet been established in our account evidence. Google services, payment processing and email services can involve processing outside the EEA. The 17TRACK location material reviewed for this assessment identifies China and the United States; the location of our API queries has not been confirmed. Amazon requests are routed through the relevant marketplace infrastructure. The register in section 4.1 distinguishes known configuration from unresolved evidence; a provider's headquarters is not a guarantee of every processing location.

If you turn on sale notifications in the iOS app, Apple's push service, which Apple operates worldwide, routes them to your device, so routing metadata may be processed outside the European Economic Area: the device push token and delivery metadata such as when a notification is sent and its generic "New sale" text. The notification content is encrypted on our servers in the EU before it reaches Apple, passes through Apple only in that encrypted form, and can only be decrypted on your device. No customer content is readable by Apple. Routing metadata can still be processed outside the EEA (see §2.6).

Transfer safeguards depend on the provider and the applicable agreement. Account-specific evidence for OpenAI, OpenRouter and certain communication providers is still being completed; this notice does not certify that every required transfer agreement has already been executed. Contact [email protected] for the current provider and safeguard register.

6. Your rights

Under GDPR you have the right to:

• Access: ask us what data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your account and associated data.
• Restriction: ask us to stop processing while a dispute is resolved.
• Portability: receive a copy of your data in a machine-readable format (JSON).
• Objection: object to processing based on legitimate interest.
• Withdraw consent: revoke the LwA authorization at any time directly from your Amazon account — we will no longer be able to read or write on your behalf from that moment.
• Complain: lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

To exercise any right, email [email protected]. We will reply within 30 days.

7. Account deletion

Account deletion is intended to be permanent. The current workflow removes the account and associated data from several live stores and requests cleanup in other systems. A successful response does not yet prove that every backend, object version, backup and provider copy has been erased. We are implementing a tracked, per-store workflow with verification and error handling. We do not currently guarantee an immediate, complete erasure across all systems.

Under the deletion policy approved on 8 October 2026, Amazon Information must be removed when no longer necessary and within 30 days after a valid deletion request, subject only to a documented applicable legal requirement. That is a required limit, not evidence that every retained copy already complies. Encrypted backups, retained object versions, Redis persistence, database recovery copies and relevant service-provider copies must be considered. The remediation and verification plan targets 20 October 2026; until verified, we will not claim universal completion or issue an executed deletion certificate.

The application currently retains a deletion security record with a pseudonymous identifier and deletion metadata. Its IP address and User-Agent cleanup is configured at 365 days; the remaining record has no automatic expiry. An event or a cleared-systems flag alone is not independent proof that every store was cleared.

A separate anti-trial-abuse record contains a keyed hash of the Amazon seller identifier and trial dates, with no automatic expiry in the current implementation. It is used to compare identifiers and must not be described as anonymous or incapable of association with an account. These retained records require an applicable purpose, access restrictions and a reviewed retention decision; naming them here does not establish a right to retain them indefinitely or an exemption from applicable deletion requirements.

A temporary deletion marker helps prevent background jobs from recreating an erased account's data. Other possible retained copies include mail already delivered and records subject to a specific legal preservation requirement. Any applicable exception must be identified and explained; we do not assume that all provider records are covered by account deletion.

Revoking Amazon authorization prevents future authorized API access; it does not itself erase previously collected data or prove a complete clean state. To request deletion, ask about a retained record, or obtain the actual completion status, contact us using section 11. Your rights in section 6 remain unchanged.

8. Cookies and web analytics

Session cookies support sign-in and other essential service functions. SellerEngine has also used PostHog for website and web-application analytics, including identified seller profiles and interaction events. Historical records reviewed for this assessment included seller email, subscription plan, marketplace and signup information, as well as clicked-element text from application pages. That processing was not entirely anonymous and must not be described as essential-session-cookie use only.

The static web releases reviewed on 7 October did not introduce or reactivate a PostHog loader. That does not delete historical PostHog records or establish the behavior of every cached client or app version. Analytics behavior, cookies and any required consent controls are being reconciled separately; this notice does not claim that historical consent has been established or that optional analytics may be activated without the required notice and choice.

Google Fonts resources are loaded by web pages, which sends the visitor's IP address and browser request information to Google. The native iOS app's separate description in section 2.5 is not a claim about tracking in the web application.

9. Security

We use TLS for data in transit and application-layer encryption for Amazon refresh tokens, authentication secrets and encrypted backup contents. Access controls and metadata audit records support security investigations. These controls do not mean that every provider receives only encrypted application data. We assess incidents and make the notifications required by applicable law, including notifying affected individuals where required.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the most recent revision.

This revision corrects descriptions of existing processing and known implementation gaps. It does not authorize new processing, extend a retention period, remove a contractual notice requirement or establish that a historical notice was sent. The actual publication date and customer-notice date will be recorded separately. Any future material change remains subject to the notice requirement above.

11. Contact

Questions or concerns about your data:
Email [email protected]
Postal: Polarstar OÜ — Tornimäe tn 5, 10145 Tallinn, Estonia