Privacy Policy

SellerLegend Limited ("SellerLegend", "we", "our", "us") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, and protect your information when you use our services.

1. Who We Are

SellerLegend Limited is a UK company (Company No. 10320585), registered at 57 Cartland Road, Sparkbrook, Birmingham, B11 1EQ, United Kingdom.

• For account and billing data, SellerLegend acts as a Data Controller.
• For Amazon marketplace data processed through our platform, SellerLegend acts as a Data Processor on behalf of our customers.

You can contact us at [email protected] for any privacy-related questions.

2. What Data We Collect

• Account Data: name, company details, email, billing address, tax identifiers, subscription/payment details.
• Amazon Data: orders, sales, order metadata, product data, and limited buyer location metadata (ZIP / postal code, city, state or region, and country) imported from your Seller Central account. We do not request access to Amazon's restricted buyer personal information, and we do not receive buyer telephone numbers or complete street addresses. Where Amazon includes them in the data it provides, a shipping recipient name is stored with the order and the anonymised Amazon relay email address with a seller-feedback entry; some older orders may still hold a buyer email address that Amazon provided before it stopped doing so.
• Support Data: conversations with our helpdesk, support tickets.
• Technical Data: IP addresses, login events, usage logs, security events.
• Sign-up attribution: when you create an account, the marketing page you signed up from, the website that referred you, campaign tags in the link (e.g. utm_source) and your cookie choices at that moment; and a record of the Terms of Service and Privacy Policy versions you accepted, with the time and IP address of acceptance.
• AI Assistant Data: where you use the AI assistant — the questions you send, the assistant's replies, and metadata about the data lookups performed to answer them (which lookup, when, and whether it succeeded).
• Google Sign-In: if you create an account or sign in with Google, Google shares your name, email address and Google account ID with us.

We do not intentionally collect special category data (e.g., health, religion).

3. How We Use Your Data

We use your data to:

• Deliver our SaaS services and provide analytics from your Amazon Seller Central account.
• Answer your questions through the AI assistant, where you choose to use it.
• Manage billing, subscriptions, and customer support.
• Monitor system performance, detect fraud, and secure our platform.
• Check the country of your IP address when you create an account, because SellerLegend is not available in every country.
• Comply with legal and tax obligations.
• Understand which of our pages and advertising campaigns lead to sign-ups and paying customers.
• Send you occasional news about SellerLegend features and offers by email, unless you opt out (at sign-up, or with the unsubscribe link in any such email).

4. Legal Bases for Processing

We rely on the following legal bases under GDPR and UK GDPR:

• Contract performance (to provide the services you subscribed to).
• Legitimate interests (e.g., payment retries, fraud detection, improving our service).
• Legal obligations (e.g., tax record retention).
• Legitimate interests for sign-up attribution (understanding which of our pages and campaigns lead to new accounts) and for keeping proof of which Terms of Service and Privacy Policy versions you accepted.
• Consent for analytics and advertising cookies and similar technologies, which are used only after you allow them in our cookie banner. You can withdraw your consent at any time through the "Cookie Settings" link; this does not affect processing that took place before you withdrew it.
• Legitimate interests for occasional product news emails to our customers. You can object at any time, at sign-up or with the unsubscribe link in every such email.
• Contract performance for the AI assistant, when you choose to use it.
• Contract performance and legitimate interests for the Intercom chat inside the dashboard (answering your support requests and helping you use the service).
• Legitimate interests (preventing fraud) for the checks that stop abuse of the referral programme.

You need to provide your account and billing details to use SellerLegend; without them we cannot provide the service. Optional items, such as product news emails, are not required.

5. Data Retention

• Active accounts: data retained while your subscription is active.
• Demo accounts: accounts created through our live demo, and the email address used to create them, are automatically deleted 24 hours after creation.
• Payment arrears: if a payment fails, we retry it, then restrict and later deactivate the account. A deactivated account follows the closed-account timeline below.
• Closed accounts: Amazon marketplace data is deleted within 90 days of final closure. Your sign-in details are deleted within 90 days of closure. Your name, email address and billing details are kept with your billing records for 7 years after closure, to meet our tax obligations, and are then anonymised.
• AI assistant conversations: deleted 30 days after a conversation's last activity, or when you delete it yourself. A conversation containing Amazon data is deleted within 14 days if your Amazon authorisation is revoked or expires, ahead of that window. All of your conversations are deleted with your account.
• Billing records: retained for 7 years after account closure, to meet our tax obligations.
• Logs: sign-in and API access logs are retained for up to 3 years for fraud detection and breach investigation. Your account activity history, which records sign-ins, failed sign-in attempts and security changes such as two-factor settings, including the IP address, browser and approximate location, is kept for 7 years from each event, together with records of the dashboard pages you use, as evidence of account access and service use for billing purposes.
• Support conversations: deleted 36 months after they end.
• Sign-up attribution and acceptance records: sign-up attribution is deleted within 90 days of account closure. Records of the Terms and Privacy Policy versions you accepted are kept for 7 years after closure, as evidence of our agreement with you, and then deleted. Records of your consent choices and other account activity are kept for 7 years from when they happen.

6. Sharing Your Data (Sub-Processors)

We use trusted third-party providers ("Sub-Processors") to deliver our services (e.g., AWS, Stripe, Intercom, and our AI model providers OpenAI and Anthropic). On sellerlegend.com, the Intercom Messenger live chat is loaded only when you open it (by clicking the chat button) and is then treated as strictly necessary to provide the support you asked for. Once you are signed in to the SellerLegend dashboard, Intercom loads automatically as part of the service, so that you can reach our support team and receive service messages. See our Cookie Policy for the full disclosure and the cookie identifiers Intercom sets.

• A current, regularly updated list is published here: View Sub-Processors List.
• Customers will be notified of material changes to this list.
• Advertising partners. If you allow Marketing cookies, our advertising partners receive data through their tags to measure our advertising (see our Cookie Policy). If you also arrived through one of our Google ads, we send Google Ads the ad click identifier (gclid) with the time and amount of your first payment, so we can see which campaigns bring paying customers; no name or email address is sent. We do not send it if you declined Marketing cookies or have withdrawn that consent. Advertising partners act as independent controllers of the data they receive and are listed separately on our Sub-Processors page.

Data Processing Agreement. For customers acting as data controllers under GDPR / UK GDPR, a Data Processing Agreement aligned with Article 28 is available on request (English only) — contact [email protected].

6a. The AI Assistant

Where it is available on your account, the SellerLegend AI assistant answers questions about your own account data and about our documentation. Using it is optional.

What we send to our AI model providers. When you ask the assistant a question, we send your question, the conversation so far, and the results of the specific data lookups needed to answer it. Those results are restricted by field allowlists to your own Amazon business data — order identifiers, order dates and statuses, totals, fees, profitability figures, product identifiers such as SKU and ASIN, inventory and shipment data, advertising campaign data, your account title and seller ID, and data-sync timestamps. Your own name and your warehouse addresses are sent where a question needs them; your email address is not. We send this data solely to generate your answer.

What we never send. Buyer-identifying data is excluded from what the assistant can retrieve at all: buyer and recipient names, buyer email addresses, telephone numbers, and buyer street addresses, cities, states, postcodes and countries are removed before any lookup result leaves our systems. Customer feedback content, our API keys and our internal error details are likewise never sent.

Who processes it. Our AI model providers are OpenAI and Anthropic, both listed on our Sub-Processors page. Which provider handles a given conversation depends on the model configured for your account. Neither provider uses your data to train its models, and each acts as our processor under a data processing agreement.

Please do not enter your customers' personal details. The assistant is designed so that buyer personal data is not sent to our model providers, and we automatically detect and remove email addresses, telephone numbers and card-like number sequences from what you type before it is sent. That detection is a safeguard, not a guarantee — please do not enter your customers' personal details into the assistant.

7. International Data Transfers

• For US providers certified under the EU-US Data Privacy Framework and UK Extension, we rely on those certifications.
• For other transfers outside the UK/EEA, we use the 2021 Standard Contractual Clauses (SCCs) + UK Addendum.

8. Your Rights

You have rights under GDPR and UK GDPR to:

• Access your data
• Rectify inaccuracies
• Request erasure
• Restrict processing
• Data portability
• Object to processing
• Object to direct marketing at any time
• Withdraw your consent at any time, where we rely on consent

These rights cover your AI assistant conversations as well as your account data. You can view and delete any conversation from within the assistant at any time.

Requests can be made at [email protected]. We aim to respond within 10 business days.

9. Security Measures

We implement appropriate technical and organisational measures, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Multi-factor authentication and role-based access controls.
• Hosting on AWS with ISO27001/PCI-DSS certifications.
• Daily encrypted backups, geo-redundant storage, tested recovery.
• Continuous logging, monitoring, and vulnerability scanning.
• Regular staff training on confidentiality and data protection.

In addition, SellerLegend maintains Cyber and Data Liability Insurance with Hiscox, providing coverage for cyber incidents and data protection risks.

10. Data Breaches

In the unlikely event of a personal data breach, we will notify affected customers and regulators (where required) without undue delay, and always within 24 hours of becoming aware.

11. Children

Our services are not directed to children under 16. We do not knowingly collect data relating to children.

12. Automated Decision-Making and AI

Our AI assistant is an automated system. It answers questions, its answers can contain errors, and it takes no action on your account or on Amazon on your behalf. Figures it reports are calculated by our application rather than generated by the AI model, and it is not a source of financial, tax or legal advice. It does not make decisions about you.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Some account actions happen automatically: if a subscription payment fails, the account is restricted and later deactivated, and a cancelled subscription ends at the close of its billing period. If you think one of these was applied in error, contact us at [email protected] and a member of our team will review it.

13. Complaints

If you believe your data has been mishandled, you may lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.

14. Language

This document is provided in English, Arabic, Simplified Chinese, and German. The site also includes a language switcher in the top navigation so visitors can change locale at any time. The English version of this Privacy Policy (and our Cookie Policy, Notice at Collection, and Sub-Processors page) is the authoritative source — in case of any inconsistency between language versions, the English version governs.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish the updated version on this page with a new "Last updated" date. If a change materially affects how we use your personal data, we will tell you before it takes effect by a notice in the SellerLegend dashboard, and we may also email the account owner. We do not ask you to accept this Policy; it describes what we do. Earlier versions are available on request from [email protected].

16. Referral Programme

If you join SellerLegend through another customer's referral link, we record the connection between your account and the referring account in order to operate the programme and issue any reward due. On the referral page, the referring customer sees only limited information about the people they invite, namely a partially masked name, the date they signed up, and whether they have reached paid status; when a referral earns them a reward, the email telling them so includes your name. They never see your contact details, billing information or account data. An email address provided at referral signup is used to create and operate that account; it is not shared with the referring customer or used for marketing on their behalf.

To detect self-referral and abuse, we check a small number of signals: whether the IP address used at signup matches one the referring account has used recently, whether the email address belongs to a disposable email service, and whether the payment card identifiers (the last four digits and expiry date) or the connected Amazon merchant identifier match those of the referring account. A referral that matches one of these checks is held for internal review instead of being rewarded automatically. The reasons are visible only to SellerLegend administrators; the referring customer sees only the referral's status.

We hold the referral link identifier in your existing site session. The referral programme does not set any additional tracking or advertising cookie.