Privacy policy

This policy explains what data SellerTacos collects, why we collect it, and how we use and protect it. We have written it in plain English. If anything is unclear, email us at [email protected].

1. Who we are

SellerTacos is an Amazon seller analytics platform operated by ZUMO Brands (trading as SellerTacos) (the “Company”, “we”, “us”). Our website is sellertacos.com.

2. What we collect

Account information

When you register, we collect your email address and a password (stored as a secure hash — we never store your password in plain text). If you enable two-factor authentication, we store an encrypted TOTP secret. If you contact us via live chat, your name and email address are shared with our support chat provider (see Sub-processors below).

Amazon store data

When you authorise SellerTacos to connect to your Amazon accounts, we import and store:

• Orders and order items (product, quantity, price, date, status — never buyer name, address, email, payment or tax details)
• Product listings (SKU, ASIN, title, category, sales rank, image URL)
• Sponsored Products advertising reports (search terms, bids, spend, impressions, clicks, sales)
• Brand Analytics reports (search query performance, search catalog performance)
• Sales & Traffic report data (sessions, page views, conversion rate, Buy Box percentage)
• Seller account region and marketplace identifiers

Amazon refresh tokens are stored encrypted using ASP.NET Core Data Protection. We never store these in plain text.

User-provided business data

You may optionally enter your own cost-of-goods (COGS), fee estimates and profit targets. This data is stored on our servers and used only to calculate the profitability metrics we display to you. It is never shared with Amazon or any third party.

AI Chat messages

If you use the AI Chat feature, your messages and the context we attach (summary metrics, not raw order data) are sent to third-party large-language-model providers to generate responses. See Section 5 (AI Chat) for details. Do not include personal information or confidential business data in AI Chat messages.

Usage data

We collect anonymised analytics about how the product is used (page views, feature interactions). We use PostHog for this, configured to avoid collecting personally identifiable information. We do not send your email address or store identifiers to analytics tools.

Support communications

If you contact us for support — by email or through the in-app live chat — we store your messages to help resolve your issue and improve the Service.

3. How we use your data

We use the data we collect to:

• Provide, operate and improve the Service.
• Calculate metrics — TACOS, organic share, net profit, break-even ACOS, market share — and display them in your reports.
• Sync your Amazon data on a schedule and notify you of significant changes (such as a revoked connection or a TACOS alert).
• Apply bid changes or negative keyword updates to your Amazon campaigns when you explicitly request it.
• Power the AI Chat feature by sending your messages and a summary of relevant metrics to a third-party LLM provider.
• Send transactional emails: email verification, password reset, team invitations and connection-revocation alerts.
• Detect and prevent abuse or unauthorised access.

We do not use your data for advertising, and we do not sell it to any third party.

4. Amazon API data use policy

SellerTacos accesses Amazon data only through the Selling Partner API (SP-API) and Amazon Advertising API, within the permissions you grant on Amazon's own consent pages. We comply with Amazon's Data Protection Policy and use Restricted Data Types only as explicitly permitted.

We never download buyer personally identifiable information (name, address, email, phone number, payment details) from orders. Our integration is configured to exclude these fields at the API level.

Where you initiate a write action — such as applying a bid change or pushing negative keywords — we make that change on your behalf through the Amazon Advertising API using the credentials you have authorised. We do not make unsolicited changes to your campaigns.

5. AI Chat

The AI Chat feature sends your messages, together with the store data the assistant looks up to answer them, to a third-party LLM provider. That data can include aggregate metrics (e.g. total ad spend, TACOS), search terms, product titles and SKUs, and the names, states, budgets and bids of your campaigns, ad groups and keywords. The provider may be OpenRouter, DeepSeek or Google Gemini, selected automatically based on availability. These providers process your input under their own privacy policies and may retain conversation data per their terms.

We do not send raw order data, buyer information, or your personal account details (email, name) to LLM providers. Responses generated by AI are for informational purposes only and do not constitute financial, legal or business advice.

When your role allows it, AI Chat can propose changes to your Amazon Ads account. A proposed change is applied only after you confirm it on a confirmation card, and every applied change is recorded in an audit log. If you do not wish to use this feature, simply do not open the Chat page.

6. Data sharing

We do not sell, trade or rent your personal information. We may share data with third-party service providers who help us operate the Service — hosting, email delivery, support, analytics — under confidentiality agreements. Current sub-processors include:

• Coolify / Hetzner — hosting and database
• Elastic Email — transactional email delivery
• PostHog — anonymised product analytics
• Cashfree — payment processing (receives billing and payment information for paid subscriptions)
• Tawk.to — live support chat on this website and the Help Center (receives what you type into the chat; the SellerTacos app itself has no chat widget)
• OpenRouter / DeepSeek / Google Gemini — AI Chat responses (receives your chat messages and aggregate metrics summaries; only used when you open the Chat page)

We may disclose data if required by law, a court order or to protect our rights and the rights of others.

7. Data retention

We retain your account and store data for as long as your account is active. If you delete your account, we delete your data within 30 days, except where retention is required by applicable law (for example, financial records).

Historical Amazon data is kept for up to 13 months on paid plans. Downgrading to the free plan reduces access to 90 days of history; data beyond that is kept but not shown until you upgrade again.

8. Security

We use industry-standard measures to protect your data, including HTTPS for all connections, encrypted storage of secrets and tokens, and per-account brute-force protection with account lockout. We notify affected users in the event of a data breach, in accordance with applicable law.

9. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. Cookies

We use a small number of cookies for authentication (an HttpOnly session cookie for your refresh token), security (CSRF protection) and preference storage. We do not use advertising or tracking cookies. No consent banner is shown because we do not use non-essential cookies.

11. Children

The Service is intended for business use and is not directed at children under 18. We do not knowingly collect data from children.

12. Changes to this policy

If we make material changes to this policy, we will notify you by email and in the app at least 14 days before they take effect.

13. Contact

For privacy questions or requests, contact us at [email protected].