Privacy policy
Last updated 3 November 2026. This policy explains how SellerPilot (“SellerPilot”, “we”) handles personal data when you use getsellerpilot.com, the SellerPilot app, and the SellerPilot connector for Claude and ChatGPT. It is written to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR, wherever you are.
Who is responsible for your data
The data controller is SellerPilot (the operator of getsellerpilot.com). Contact: support@getsellerpilot.com. For the Amazon data you connect, you (the seller) decide what SellerPilot may access, and SellerPilot processes it to provide the service to you.
What we collect
- Account: your email address, your seller account name, your plan and billing status, and the team members you invite. Card details are collected and stored by Stripe, not by us.
- Amazon data you authorize: from the Selling Partner API and the Amazon Ads API: advertising profiles, campaigns and reports; orders (products, quantities, prices, dates, and the ship-to city, region and country); inventory; listings and catalog data; returns, reimbursements, settlements and fees; seller feedback and review request status. We do not load buyer names, buyer email addresses, phone numbers or street addresses.
- Amazon authorization tokens: refresh tokens that let SellerPilot act for you, stored encrypted (AES-256-GCM).
- Vendor Central data you authorize: purchase orders, shipment notices, invoices and their results, vendor sales, traffic, inventory, margin and forecast reports, and dropship orders. For dropship orders we keep the order number, items, dates, ship method and the ship-to city and country; customer names, street addresses and phone numbers are not stored.
- Your settings and actions: targets, rules, product costs, message templates, approvals and the change log.
- WhatsApp alerts, only if you switch them on: your phone number (stored encrypted), your consent with its date, and the alerts sent.
- Technical data: sign-in sessions and basic server logs for security and troubleshooting.
- Founding Seller Program applications (no account needed): your name, email, the Amazon marketplaces you sell in, your monthly sales band, what you want help with and where you heard of SellerPilot; if you add them, your company, store link, country, role, years selling, ad spend, products, Brand Registry, other channels, tools and your note. With them we keep the link or ad that brought you to the page (campaign tag, ad click id or referring site), when you applied, and a keyed one-way hash of your IP address to limit repeated sending. If the page's bot check is on, Cloudflare Turnstile checks the browser that sends the form.
- Offer and fraud checks: when you choose a plan, use a promo or referral code, or make your referral link, we keep keyed one-way hashes (not the values themselves) of your browser's device id and fingerprint (screen, time zone, language, graphics card), your IP address and your card's fingerprint from Stripe, so that each promo and referral offer is used once per seller. IP hashes count for 90 days. We cannot and do not read your computer's hardware or MAC address.
Why we use it, and our lawful bases
- To provide SellerPilot (performance of our contract with you): show your data, propose changes, make the changes you approve or allow, send the alerts, summaries and reports you choose, run SellerPilot AI (the daily note each morning, and Ask SellerPilot and Write with AI when you use them), and manage your account and team.
- To bill you and keep records (contract, and our legal obligations): payments, receipts, invoices and tax records.
- To keep the service secure and working (our legitimate interests): preventing abuse and fraud, troubleshooting, and service emails such as trial reminders and security notices. We balance these interests against your rights and keep only what is needed.
- Founding Seller Program applications (your consent, which you give with the form): to review your application, reply to it, decide on a place, and see which channels bring sellers to the program. Only SellerPilot's own team reads them. If you get a place, we email you a few short questions during your free period; answering is up to you. Withdraw consent and have your application deleted at any time by writing to support@getsellerpilot.com.
- WhatsApp alerts and marketing emails (your consent): sent only after you opt in. You can withdraw consent at any time (reply STOP on WhatsApp, use the unsubscribe link in an email, or change your settings); this does not affect what was sent before.
We do not sell your data, do not use it for advertising, do not use it to train AI models ourselves, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Amazon data
Amazon data is used only to provide SellerPilot to the seller who authorized it, as Amazon's Data Protection Policy and Acceptable Use Policy require: never for any other purpose, never sold or shared for advertising. Buyer personal information is not stored; for Vendor Central dropship orders, Amazon's shipping labels and packing slips are passed to you without being saved. Every buyer message SellerPilot sends goes through Amazon's own Buyer-Seller Messaging.
Claude, ChatGPT and other assistants
If you connect SellerPilot to an AI assistant, the questions you ask and the answers SellerPilot returns pass through that assistant under your own account with the company that provides that assistant, under its terms. You can disconnect at any time from your account page.
Who processes data for us (sub-processors)
We share data only with the providers that help us run SellerPilot, only what each one needs, under written data processing agreements:
- Database and hosting: Supabase, in the European Union (Frankfurt, Germany). Stores your SellerPilot data and runs the service.
- Payments: Stripe. Card details and payments; card numbers never reach SellerPilot.
- Email delivery: Resend. Sign-in links, receipts and the emails you choose to get.
- AI model provider: for SellerPilot AI (Ask SellerPilot and Write with AI when you use them, and the daily note each morning, which you can switch off in Settings › Notifications): your question and the store figures needed to answer it, never buyer names or addresses and never your Amazon login. It processes data outside the EU and the UK, including in China, its terms do not rule out using what it receives to improve its models, and transfers to it are not covered by Standard Contractual Clauses. Don't want this? Switch the daily note off and don't use Ask SellerPilot or Write with AI; nothing else is sent to it.
- WhatsApp messaging: Meta (WhatsApp Business Platform), only if you switch on WhatsApp alerts. It may process data outside the EU and the UK.
- Website hosting: serves this public website and passes AI-assistant connections (mcp.getsellerpilot.com) to the service (encrypted in transit; no account data stored), in Malaysia.
- Bot check on the Founding Seller Program form: Cloudflare (Turnstile), only when you send that form. It may process data outside the EU and the UK.
- Website analytics: Google (Google Analytics 4), only on the public pages and only if you accept analytics cookies: pages viewed, links clicked, device and approximate location. It may process data outside the EU and the UK.
- Amazon: the Selling Partner API and Amazon Ads API, for the data you authorize and the changes you approve. Amazon processes this data on its side under its own terms.
The full list of sub-processors by name and location is available on request: write to support@getsellerpilot.com with the subject “Sub-processors”. We will update this list before adding a provider that processes your personal data.
International transfers
Your SellerPilot data is stored in the European Union (Germany), encrypted in transit and at rest. Some providers above process data outside the EU and the UK. When personal data leaves the EU or the UK, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, with additional safeguards where needed. The exception is our AI model provider (see above): it offers no such clauses, so SellerPilot AI sends it only business figures, never buyer personal data or logins, and only for the AI features described above. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Account data: kept until you delete it or ask us to. History used by the tools (daily totals, orders, search share, ranks, the change log) covers up to 2 years, seller feedback and claims 3 years, payments, fees and refunds from Amazon 25 months, send logs 13 months, and raw report rows 60 days (the full table is on the security page). When your plan ends, your data is kept until you delete it or ask us to, so you can come back.
- After you cancel: your account and data stay so you can restart without setting anything up again. Nothing runs on your Amazon accounts while you have no plan. You can delete everything at any time with Delete my data on your account page (deleted at once: marketplaces, loaded Amazon data, stored Amazon logins, connections and your SellerPilot login), or by writing to support@getsellerpilot.com (we confirm it is you and delete within 30 days). You can also remove SellerPilot's access in Seller Central and Amazon Ads at any time.
- Invoices and billing records: kept as long as tax and accounting law requires.
- Founding Seller Program applications: deleted 12 months after the application or our last decision on it, unless you claimed a place: then it stays with your SellerPilot account and is deleted with it. Sooner on request.
- Technical logs: kept for 30 days.
Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your personal data and get a copy of it;
- rectification: have inaccurate data corrected;
- erasure: have your data deleted;
- portability: receive your data in a common machine-readable format, or have it sent to another provider;
- restriction: ask us to limit how we use your data;
- objection: object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent where we rely on it, at any time;
- complain to a supervisory authority, such as the data protection authority where you live or work (in the UK, the Information Commissioner's Office).
How to exercise them: many need no request: you can see and export your data in the app, correct your account details, and delete all your data from your account page. For anything else, write to support@getsellerpilot.com with the subject “Privacy request”, from your account email. We answer within one month, and may ask you to confirm your identity. You can also revoke SellerPilot in Seller Central (Apps and Services) and in Amazon Ads at any time.
Cookies and browser storage
SellerPilot uses only the browser storage the site needs to work: your sign-in session, your theme (light or dark) and similar settings. If you arrive from a link with a campaign tag or an ad click id (the code an ad network such as Google, Microsoft or Meta adds to an ad link), it is kept in your browser and sent with your sign-up, so we know which link or ad brought you. It stays with SellerPilot and is not shared; we will update this policy before we ever report sign-ups back to an ad network.
Security
See the security page. If we learn of a personal data breach affecting your data, we will tell you and the supervisory authority where the law requires, without undue delay.
Children
SellerPilot is a business service and is not meant for anyone under 18.
Changes
We will post changes here and email account holders about material ones before they apply.