SellersOS
SELLERSOS LLC
Privacy Policy
1. Who we are
SellersOS is a software platform for Amazon sellers operated by SELLERSOS LLC, a United States limited liability company registered at 30 N Gould St Ste N, Sheridan, WY 82801, United States (“SellersOS”, “we”, “us”). We are the data controller for information regarding our direct customers and website visitors, and a data processor for the Amazon seller and operational data we access on our customers’ behalf.
SellersOS is an independent software provider. SellersOS is not affiliated with, endorsed by, or sponsored by Amazon.com, Inc. or its affiliates.
2. Data we process
2.1 Amazon seller data (processed on your behalf)
When you authorize SellersOS through Amazon’s official OAuth workflow, we access operational data through the Selling Partner API (SP-API) and the Amazon Ads API under authorized scopes:
| Category | Examples |
|---|---|
| Orders and settlements | Order identifiers, item prices, quantities, marketplace IDs, purchase dates, settlement reports and disbursement records |
| Fees and finances | Referral fees, FBA fulfillment fees, storage and aged inventory charges, promotions, refunds, reimbursements and claims |
| Inventory and catalogue | SKU, ASIN, FNSKU, available and inbound quantities, dimensions, weight attributes, listing statuses and catalog metadata |
| Returns and disposals | Customer return reasons, quantities, disposition statuses, removal orders and liquidation records |
| Amazon Advertising | Sponsored Products, Sponsored Brands and Sponsored Display campaigns, ad groups, targeting, keywords, search terms, bids, budgets, impressions, clicks, spend and attributed sales |
We do not request, require, or persist buyer personally identifiable information (PII). SellersOS does not request or require Restricted SP-API roles for buyer personally identifiable information as part of its standard analytics, inventory, listing, profitability, or advertising services. Buyer names, shipping street addresses, buyer email addresses, and telephone numbers are excluded from our reporting and analytics pipelines. Where raw transport payloads contain such fields, they are dropped at ingestion and are never stored in persistent databases.
2.2 Customer account data (we are the controller)
- Name, work email address, company name, website, role and country
- Authentication credentials (bcrypt-hashed passwords, session tokens, MFA authentication state)
- Subscription billing details processed securely by our PCI-DSS compliant payment provider (we never store full payment card numbers)
- Customer support correspondence and configuration preferences
2.3 Website and demonstration data
- Information submitted through our demo or onboarding forms: name, work email, brand name, marketplaces, annual revenue band and inquiry notes.
- Inputs provided in our interactive profit and ROI calculator. These calculations are processed in-memory or stored with an irreversible one-way cryptographic hash of IP addresses strictly for rate limiting and DDoS prevention.
- Standard edge server logs (request path, HTTP method, timestamp, user agent, response code), retained for diagnostic and security purposes.
3. Why we process it, and on what basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing authorized analytics, replenishment forecasts, listing operations and advertising management | Performance of a contract |
| Responding to demo inquiries, onboarding assistance and customer support | Legitimate interests / Steps prior to contract |
| Securing the platform, preventing fraud, unauthorized access and service abuse | Legitimate interests / Legal obligation |
| Subscription invoicing, accounting compliance and statutory tax record keeping | Legal obligation |
| Product performance monitoring using non-identifying, aggregated operational metrics | Legitimate interests |
4. Amazon data commitments
SellersOS strictly adheres to the Amazon Data Protection Policy (DPP) and Acceptable Use Policy (AUP). In particular:
- Purpose limitation. Amazon seller information is used exclusively to provide the contracted service to the selling partner who authorized it. It is never used for another seller, never used for cross-seller benchmarking, and never used for our own retail or commercial operations.
- No resale, monetization, or pooling. We do not sell, license, monetize, share, or disclose Amazon Information to unauthorized third parties. We do not aggregate or pool Amazon data across sellers into public or market-wide datasets.
- No AI model training. Amazon Information is not used to train third-party or general-purpose artificial intelligence or machine learning models. AI-enabled functionality, if offered, is subject to the same seller authorization, data minimization, tenant isolation, and purpose-limitation controls as all other SellersOS capabilities. Amazon API credentials, buyer PII, and security secrets are strictly prohibited from being supplied as model inputs.
- Least privilege. We request only the specific API roles and scopes necessary for the features you explicitly select. Write operations (such as advertising bid changes or inventory feeds) are disabled by default and require explicit seller activation.
- Revocation. You may revoke authorization at any time directly through Amazon Seller Central or Amazon Advertising console. Upon revocation, data ingestion ceases immediately.
5. Sharing and sub-processors
We do not sell personal data or Amazon Information. We do not license or disclose Amazon Information to unauthorized third parties. Amazon Information may be processed only by approved service providers and sub-processors strictly necessary to operate the SellersOS platform, subject to written confidentiality, security, and data-protection agreements:
| Sub-processor | Service provided | Data processed |
|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure, application hosting, PostgreSQL database hosting, encrypted backups, KMS key management and logging | Authorized SellersOS service data (encrypted in transit and at rest) |
| Cloudflare, Inc. | DNS management, TLS termination, edge DDoS protection and Web Application Firewall (WAF) | HTTP request metadata and transit traffic |
| Namecheap, Inc. (PrivateEmail) | Transactional customer email delivery and customer support ticketing | Customer contact name, email address and correspondence |
| Stripe, Inc. | Subscription billing management and payment processing | Customer billing contact name, business address, email and payment token |
We may disclose information where required by applicable law, subpoena, or lawful government order, or to protect the security and integrity of our systems. Customers will be notified prior to the engagement of any new sub-processor that accesses Amazon Information.
6. Security measures & Amazon DPP compliance
SellersOS implements comprehensive administrative, technical, and physical safeguards in full alignment with published Amazon Selling Partner API Data Protection Policy (DPP) requirements (including Key Security Controls effective August 2026) and Amazon Ads Partner Network Policies:
- Encryption in transit and at rest. All external and internal communications require TLS 1.2 or higher (TLS 1.3 preferred where supported) with HTTP Strict Transport Security (HSTS). All database volumes, object stores, and automated backups are encrypted at rest using AES-256 managed via AWS Key Management Service (AWS KMS).
- Web Application Firewall (WAF) & API Gateway protection. All internet-facing public endpoints and API gateways are protected by a Web Application Firewall (WAF) with managed rule sets defending against OWASP Top 10 vulnerabilities, automated bot abuse, SQL injection, cross-site scripting (XSS), and Layer 7 DDoS attacks.
- Workforce device storage encryption & screen locking. All workforce workstations, developer laptops, and administrative devices accessing platform infrastructure enforce full-disk storage encryption (BitLocker, FileVault, or LUKS with AES-256) and an automatic screen lock policy configured to activate after no more than 15 minutes of inactivity.
- Workforce endpoint security & anti-malware (EDR). Administrative and developer devices maintain centrally managed endpoint protection / anti-malware software with automated definition and signature updates.
- Access controls, MFA & lockout. Multi-Factor Authentication (MFA) is mandatory for all user accounts accessing Amazon Information, including customer accounts, seller workspace team members, engineering, and administrative personnel. Passwords enforce 12+ characters with mixed character classes (uppercase, lowercase, numbers, symbols), prohibit containing usernames, email prefixes, or brand identifiers, enforce a minimum 1-day age and maximum 365-day expiration, and enforce a 10-history restriction. Temporary account lockouts of at least 30 minutes are enforced after no more than 10 failed login attempts within a 30-minute window. Terminated user and employee credentials are revoked within 24 hours; access permissions undergo formal quarterly audits.
- Tenant data isolation. Each seller's operational data is strictly isolated logically at the database layer. There are no shared cross-tenant analytics tables and zero cross-account data pooling.
- Credential protection. Amazon OAuth refresh tokens, client secrets, and API keys are encrypted and stored strictly server-side in restricted secret storage. Credentials are never exposed to client-side code, web browsers, or application logs.
- Network and database isolation. Production databases are deployed in private network subnets with no direct public internet listener, accepting connections exclusively from authorized application security groups.
- Vulnerability management & logging. Monthly automated vulnerability scans across dependencies and host infrastructure. Critical vulnerabilities are remediated within ≤ 7 calendar days; High vulnerabilities within ≤ 30 calendar days. Centralized security audit logs are retained for at least 12 months in tamper-resistant storage.
- 24-Hour Amazon incident response. Where a security incident involves Amazon Information or credentials, SellersOS will notify Amazon at security@amazon.com within 24 hours of detection and coordinate fully with Amazon.
7. Retention and deletion
| Data Category | Retention Period & Deletion Commitment |
|---|---|
| Non-PII Amazon Information | Retained only for as long as necessary to provide the authorized service, and for no longer than 18 months unless longer retention is required by applicable statutory law. |
| Buyer Personally Identifiable Information (PII) | Not stored or persisted. SellersOS does not request or require Restricted SP-API roles for buyer PII. Customer names, shipping addresses, email addresses, and telephone numbers are excluded from our systems and dropped at ingestion. |
| Security and Audit Logs | Retained for a minimum of 12 months for security monitoring and auditability, designed to exclude PII unless specifically required for security investigations. |
| Customer Account & Billing Records | Retained for the active duration of the commercial subscription, plus the statutory retention period required for tax, financial accounting and legal obligations. |
| Trigger-Based Deletion Commitment (Amazon DPP §1.7) | SellersOS securely deletes Amazon Information within 30 days after whichever occurs first: Amazon instructs us to delete it; the customer withdraws permission, disconnects access, revokes authorization, or closes the account; we identify that our entitlement to process it has ended; or our participation in Amazon Services ends or expires. Where retention is legally mandatory, we retain only the necessary records for the mandated purpose and duration. |
SellersOS securely deletes Amazon Information within 30 days after whichever occurs first: Amazon instructs us to delete it; the customer withdraws permission, disconnects access, revokes authorization, or closes the account; we identify that our entitlement to process it has ended; or our participation in Amazon Services ends or expires. Where retention is legally mandatory, we retain only the necessary records for the mandated purpose and duration. Data ingestion ceases immediately upon disconnect or revocation, and sellers may also request self-service or manual data deletion at any time by contacting privacy@sellersos.net. Completion of data deletion is confirmed in writing.
8. Your rights
Under applicable data protection legislation (including GDPR and CCPA/CPRA where applicable), you have the right to request access to, rectification of, portability of, or erasure of your personal data; to restrict or object to certain processing; and to withdraw consent. Requests may be directed to privacy@sellersos.net and are answered within 30 days.
9. Cookies and tracking
The public marketing website sets zero third-party advertising, tracking, or profiling cookies.
A single client-side preference key is maintained in local storage (sellersos-lang) to preserve
your preferred language setting. Fonts and stylesheets are self-hosted on our domain, ensuring no external
requests are dispatched to third-party CDNs while viewing this site.
The authenticated SellersOS application utilizes strictly necessary, encrypted HTTP-only session cookies to preserve authentication state. These cookies are essential for system operation.
10. International data transfers
Primary processing infrastructure is located in the United States (Amazon Web Services, AWS Region us-east-1). Where international transfers occur, we implement appropriate safeguards including standard contractual clauses and strict technical encryption safeguards.
11. Children's privacy
SellersOS is an enterprise business-to-business platform designed strictly for commercial Amazon sellers. We do not knowingly collect or solicit personal data from any person under the age of 16.
12. Changes and contact
Any material updates to this Policy will be posted to this page with an updated effective date. If changes materially affect the processing of Amazon Information, registered customers will receive prior email notification before changes take effect.
SELLERSOS LLC
30 N Gould St Ste N, Sheridan, WY 82801, United States
General contact: admin@sellersos.net
Privacy enquiries: privacy@sellersos.net
Security reports: security@sellersos.net