Login with Amazon — Privacy Notice

1. What this notice covers

AcosControl ("we", "us") offers Login with Amazon so you can connect your Amazon Advertising account without copying API keys by hand. This notice explains exactly what Amazon shares with us when you give consent, what we do with it, how long we keep it, and how to take it back.

It supplements our Privacy Policy; where this notice is silent, that policy applies. It describes the AcosControl service at acoscontrol.com and nothing else.

2. What we ask Amazon for

When you choose Login with Amazon we request one permission: advertising::campaign_management. That is the permission that lets a tool read your advertising performance and manage your campaigns on your behalf — it is the whole function of AcosControl.

We may additionally request profile, which tells us your Amazon name, email address and a user identifier. It is used only to recognise you across sign-ins and to tell a genuine agency apart from a duplicate signup. Amazon asks you to approve each permission, and we receive only what you approve.

3. What we receive, and what we never receive

Through the permission above, we receive:

• A token that lets us call the Amazon Advertising API on your behalf.
• The list of advertising accounts and marketplaces your Amazon login can reach.
• Advertising performance data for those accounts — campaigns, ad groups, keywords, search terms, placements, impressions, clicks, spend, sales, orders and Kindle pages read.

We do not receive, and cannot see:

• Your Amazon password.
• Your payment card details.
• Your personal Amazon shopping or purchase history.
• Your KDP royalty statements or bank details.
• Anything about Amazon accounts your login does not already have access to.

4. How we use it

• To show you your advertising performance, including history Amazon's own reports cannot produce.
• To make the changes you ask for — bids, budgets, pausing, negative keywords.
• To keep your data current, by fetching updates on a schedule and receiving Amazon Marketing Stream messages.
• To calculate what you are charged, which is based partly on your advertising spend.
• To contact you about the service, and to investigate a problem when you report one.

We do not sell your data, we do not share it with other customers, and we do not use it to advertise to you.

5. How it is stored

Your Amazon token is encrypted at rest on our server and is never sent back to a browser — not even yours. Your advertising data is stored in our database, on a server we control, and is readable only by your own account and anyone Amazon confirms has access to the same advertising account.

Access is enforced on the server, not in the page. A request for another customer's data is refused whoever makes it.

6. Who else sees it

• Amazon — the source of the data, and the recipient of the changes you ask us to make.
• Amazon Web Services — receives Marketing Stream messages into a queue we own, so your data reaches us within the hour.
• Stripe — processes payments. Stripe receives your billing details and the spend figure your charge is calculated from. It does not receive your advertising data.

Nobody else. If that ever changes, this page changes with it — an unnamed recipient is an undisclosed one.

7. Taking it back

You can disconnect at any time, in either direction:

• In AcosControl — Settings → Disconnect. This deletes the stored token and stops all further access immediately.
• At Amazon — your Amazon account → Login with Amazon settings → remove AcosControl's permission. This revokes our access even if you never open AcosControl again.

Disconnecting stops future access. To have the advertising data we already hold deleted as well, ask us and we will delete it.

8. How long we keep it

Your token is kept until you disconnect or revoke it. Advertising data is kept while your account is open, because its value is historical — comparing this month to the same month last year is the point. When you close your account we delete your advertising data and your token, keeping only what we are required to keep for tax and accounting.

9. Contact

Questions about this notice, or a request to delete your data: support@acoscontrol.com.