Privacy Policy

SellerGuy processes account identity, session state, subscription status, uploaded files, workspace files, chat messages, tool calls, schedule records, connection metadata, and usage telemetry needed to operate the service.

When you connect apps, you authorize SellerGuy through the provider-specific OAuth flow. Amazon Selling Partner API access and Amazon Advertising access each use SellerGuy's direct Login with Amazon connection. Gmail uses Pipedream-managed OAuth and its credential proxy. Amazon API connections do not route through Pipedream; Gmail content read or sent through it may contain whatever information you choose to exchange by email.

SellerGuy stores only non-secret connection projections in the seller workspace. Refresh tokens for SellerGuy's direct Amazon connections are encrypted at the application layer with AES-256-GCM in the backend database; credentials for the Pipedream-managed Gmail connection remain with Pipedream. Provider tokens are never written to the seller workspace or exposed to the AI model.

Connected apps may include Amazon Seller, Amazon Ads, and Gmail.

When you connect an Amazon Selling Partner or Amazon Advertising account, SellerGuy accesses your Amazon data — listings, orders, reports, pricing, advertising metrics, and related records — only to operate the features you request. Reads run on demand, including read-safe report creation when the provider marks it non-mutating. Seller mutations such as listing changes, advertising changes, and customer solicitations require an authorized operator's explicit one-time approval. SellerGuy decides and performs the change on its own servers; approval is only ever given from a surface where the approver is authenticated — the signed-in SellerGuy dashboard, or a provisioned approver's click in an allowed Slack conversation.

We do not sell Amazon Information, share it for advertising, use it to build cross-seller profiles, or use it for any purpose other than operating SellerGuy for you. Amazon Information is retained only as long as needed for the requested workflow and is deleted on request or account closure.

SellerGuy uses service providers to operate the product: Cloudflare (application hosting, compute, object storage, edge security, and application logs and execution traces), Supabase (authentication, account, billing, usage, and encrypted direct-OAuth records), OpenRouter and its selected model providers (all text and vision inference), Google AI (image generation), Slack (customer messaging, approvals, and file transport), Pipedream (managed OAuth and credential proxy for Gmail), Stripe (payments), and SerpAPI (public marketplace lookups).

Only content needed for the feature you request is sent to the relevant provider. For example, a model receives the conversation and selected workspace evidence; Cloudflare records execution traces with timing and usage but without message or tool contents; and Slack receives the messages and files exchanged through the Slack surface. SellerGuy does not use customer content to train its own models. Each external provider processes data under its own service terms and SellerGuy configuration.

Until September 24, 2026, SellerGuy also sent bounded prompt, tool, session, and usage traces to Langfuse EU Cloud (Ireland) for reliability and debugging. SellerGuy no longer sends data to Langfuse; the historical traces remain in that project until they are deleted.

Importing a product does not make it public: the merchant chooses the product details, price, policies and offer to publish for shoppers and external assistants.

For direct purchases, the secure checkout page collects your shipping name, address, email and phone. SellerGuy encrypts these details in the order ledger and sends the shipping details needed for delivery to Amazon Multi-Channel Fulfillment. Stripe receives payment information directly and the address needed to calculate tax. SellerGuy does not receive or store your full card number.

The shopping connector exposes approved product details, the quoted total, order status, tracking and cancellation or refund status through limited order access. It does not return your shipping address, card details or payment secret to the assistant. The assistant host processes the information it receives under its own privacy policy. Keep checkout links and order access private.

Encrypted shipping details and browser checkout access are removed 30 days after an order completes, is cancelled or otherwise settles. An unresolved order under merchant review retains the information needed for reconciliation until it is resolved. Order and payment records remain available for support and accounting. Contact us about access or deletion requests.

If you authorize the SellerGuy plugin in an external assistant such as ChatGPT or Claude, that host can retrieve your linked profile, Amazon connection details and live data from your connected Seller Central and Amazon Ads accounts on your behalf. The connection requires an active MCP free trial or SellerGuy plan. Its Amazon reports permission lets the host acquire reports, check their progress and read their data; those reports may also be visible to your SellerGuy agent. This connection does not expose provider credentials, other workspace files or saved SellerGuy work, run SellerGuy conversations, inspect images, send messages or approve changes. The external host receives the information its tool calls retrieve and processes it under its own terms and privacy policy. Disconnecting it, in the assistant or with Disconnect on SellerGuy's Connections page, stops future authorized reads; it does not remove information the host has already received.

Uploads, analysis, product work, memories, schedules, and other durable seller files remain until you delete them, a verified deletion request is completed, or the account is closed. Automatic cleanup in the seller workspace is narrow: an upload that no product work references is removed 30 days after it was added, oversized tool results saved under the analysis folder are removed 30 days after they complete, and finished background job records are pruned on the same window. Acquired report batches and the source data SellerGuy reads from a connected account are not removed by that cleanup; source data is replaced on each refresh, and both are deleted on a verified deletion request or account closure. Evidence of an approved change is kept with its audit record. Cleanup never deletes analysis files or task plans.

Operational logs, billing records, and provider-side telemetry may be retained as required for security, debugging, accounting, and abuse prevention. Cloudflare keeps application logs and execution traces for seven days.

Disconnecting an app in Connections stops SellerGuy's access through it; it does not delete the data already synced. To delete your data, ask through an authorized Slack conversation or email us for full account and data deletion. We action verified deletion requests within 30 days.

Data is encrypted in transit with TLS. Cloudflare and Supabase provide encryption at rest for their managed storage. Seller data is isolated by authenticated user id and workspace prefix, and each seller's files live in a dedicated per-seller workspace. Agent-authored code runs in a sandboxed interpreter that can read that seller's workspace evidence but cannot read provider credentials.

Direct provider OAuth refresh tokens are encrypted at the application layer with AES-256-GCM before persistence, with the encryption key held separately in Cloudflare Workers Secrets. Provider credentials stay in the TypeScript capability plane; the model, the workspace, and the sandboxed code interpreter never receive them.

For the Amazon-specific control set mapped to Amazon's Selling Partner API Data Protection Policy, see the Amazon Data Protection Policy.

Privacy questions, data access, and deletion requests: szymon@sellerguy.ai.