Privacy Policy
Last updated: October 9, 2026
This Privacy Policy explains how Your Company Name (“SellerSprig”, “we”, “us”) collects, uses, shares and protects information when you use our website and software service (the “Service”). The Service helps Amazon sellers automatically send Amazon's “Request a Review” solicitation for eligible orders using the Amazon Selling Partner API (“SP-API”).
1. Who we are
Your Company Name is the data controller for account information you give us. For data we retrieve from your Amazon seller account on your instructions, we act on your behalf as your service provider (processor). Contact details are in section 10.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, hashed password | You, when you sign up |
| Amazon connection data | Selling partner ID, marketplace IDs, OAuth refresh token | Amazon, when you authorize the Service |
| Order metadata | Amazon order ID, purchase date, order status, estimated delivery date, fulfillment channel (FBA/FBM), order total and currency | Amazon SP-API Orders API |
| Service activity | Whether a review request was sent, scheduled, skipped or failed, with timestamps | Generated by the Service |
| Support messages | Name, email and message content you send through our contact form | You |
| Technical data | IP address, browser type and server logs, used for security and abuse prevention | Your browser |
3. Amazon data and buyer information
We access only the SP-API roles needed to provide the Service. In particular:
- We do not request, access or store buyer Personally Identifiable Information (PII). That includes buyer names, email addresses, phone numbers and shipping or billing addresses. The Service does not require restricted SP-API roles.
- Review requests are sent by Amazon through Amazon's Solicitations API. We never contact your buyers directly and never see the email Amazon sends.
- We use Amazon data only to provide the Service to the seller who authorized it. We do not use it to build profiles, for marketing, or to compete with Amazon or other sellers, and we never sell it.
- We handle Amazon information in line with Amazon's Data Protection Policy and Acceptable Use Policy for SP-API developers.
4. How we use data
- To provide the Service: syncing orders, deciding when each order is eligible, and sending review requests.
- To show you your dashboard, order history and reporting.
- To secure the Service, prevent abuse and fix problems.
- To reply to your support requests and send essential service emails (for example, if your Amazon authorization stops working).
- To meet legal obligations.
Our legal bases (where GDPR or similar laws apply) are performance of our contract with you, our legitimate interests in running a secure and reliable service, and compliance with law.
5. Sharing
We do not sell or rent personal information. We share data only with:
- Amazon, as required to call the SP-API on your behalf.
- Infrastructure providers (cloud hosting, database and email delivery) who process data under written agreements and only on our instructions.
- Payment processors, for paid plans. We never see or store full card numbers.
- Authorities, when required by law or to protect rights and safety.
6. Security
- All traffic to and from the Service is encrypted in transit with TLS (HTTPS).
- Amazon OAuth refresh tokens are encrypted at rest with AES-based encryption. Passwords are stored only as salted bcrypt hashes.
- Access to production systems is restricted to authorized personnel on a least-privilege basis and protected with multi-factor authentication.
- We keep systems patched, monitor for suspicious activity and maintain an incident-response plan.
- If a security incident affects Amazon information, we notify Amazon within 24 hours of detection, as required by Amazon's Data Protection Policy. We notify affected users and regulators as required by law.
7. Retention and deletion
- Order metadata is kept while your Amazon account is connected, so we can show history and avoid duplicate requests.
- When you disconnect an Amazon account, its stored token and order data are deleted from our active database immediately and purged from backups within 30 days.
- When you delete your SellerSprig account, all associated data is deleted on the same schedule.
- You can also revoke our access at any time in Seller Central under Apps and Services → Manage Your Apps.
- Server logs are kept for up to 90 days.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to your data protection authority. To use these rights, email privacy@sellersprig.com. We reply within 30 days.
The Service is for businesses and is not directed at children under 16. Your data may be processed in countries other than your own; where required, we use appropriate safeguards such as standard contractual clauses.
9. Cookies
We use one strictly necessary, HTTP-only cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. If we add analytics in the future, we will update this policy and ask for consent where required.
10. Contact
Your Company Name
Street address, City, State/Province, Postal code, Country
Privacy: privacy@sellersprig.com
Support: support@sellersprig.com
We may update this policy from time to time. We will post the new version here and, for material changes, notify you by email. See also our Terms of Service.