Privacy Policy

Who we are

AcosControl ("we", "us") operates acoscontrol.com, a subscription tool that helps authors and sellers manage their Amazon advertising. This policy explains what personal data we collect, why, who we share it with, and the rights you have over it.

We are the data controller for the information described here. Contact: support@acoscontrol.com.

We do store your advertising data

AcosControl is a hosted service, not a browser tool. To show your performance over time and to make recommendations, we copy your Amazon advertising data onto our servers and keep it there while your account is open. We are saying this plainly because it is the single most important fact in this policy.

We do not sell your data, and we do not use it to advertise to you or anyone else.

What we collect

Account information — your email address, your name if you provide one, your password (stored only as a salted hash), or, if you sign in with Google, the email address and basic profile Google returns.

Amazon Advertising data — once you connect your Amazon account: your advertising profiles and marketplaces, campaigns, ad groups, keywords and targets, bids and placement adjustments, and the performance figures behind them (impressions, clicks, spend, sales, orders, ACOS), together with a record of changes made through the app. This is business data, though it can relate to you as a sole trader.

Amazon authorisation tokens — the access and refresh tokens that let us call Amazon on your behalf. These are encrypted at rest and are never shown in the interface or sent to your browser.

Billing information — your subscription status, trial and renewal dates, the ad-spend total used to calculate your fee, and invoice history. Card details are entered directly with our payment processor and never reach our servers; we see only the card type, last four digits, expiry and the processor's customer reference.

Technical and usage data — IP address, browser and device type, pages and features used, timestamps, and error diagnostics. We use this to keep the service secure, to apply rate limits, and to understand which features are worth building on.

Support correspondence — anything you send us by email.

Why we use it, and our legal basis

• To provide the service — connect to Amazon, import and store your data, produce recommendations, apply the changes you approve. Basis: performance of our contract with you.
• To bill you — run the trial, calculate the fee including the ad-spend component, take payment, issue receipts. Basis: contract, and legal obligation for tax records.
• To support you — answer questions, investigate faults and check that your data imported correctly. By accepting our Terms of Service you authorise our named administrators to view your account for this purpose; each access is logged. Basis: contract and our legitimate interest in running a working service.
• To keep the service secure and reliable — abuse prevention, rate limiting, diagnostics, backups. Basis: legitimate interest.
• To improve the product and measure our marketing — aggregate usage analysis and conversion measurement. Basis: legitimate interest.
• To send service messages — billing notices, security alerts, material changes to these terms, and performance reports and alerts about your campaigns. Basis: contract. These are not marketing and cannot be opted out of while you hold an account.
• To send marketing e-mails — tips, product news and offers. Basis: our legitimate interest in telling customers about the service. Every marketing e-mail has an unsubscribe link, and unsubscribing does not affect your account.

Who we share it with

We share personal data only with the following categories of recipient, and only as far as each needs it:

• Amazon Advertising — we call Amazon's API with your authorisation to read your data and to submit the changes you approve.
• Our payment processor — to take payment and manage your subscription. They act as an independent controller for card data under their own privacy policy.
• Our hosting and infrastructure providers — the servers and databases the service runs on, under contract and instruction.
• Analytics and advertising measurement — events about how our website is used are sent to Google (Google Analytics and Google Tag Manager) and Meta (the Meta Pixel), and Microsoft (Microsoft Clarity) records how pages are used. See "Cookies and measurement" below.
• Professional advisers and authorities — where we are legally required to disclose, or need to establish or defend a legal claim.

If the business is ever sold or merged, your data may transfer to the buyer; we will tell you before that happens and the buyer will be bound by this policy or one no less protective.

We never sell your personal data, and we do not share your advertising performance with other customers or with your competitors.

Signing in with Google

If you choose to sign in with Google, Google tells us your email address, name and profile picture so we can create and identify your account. We request nothing beyond that, and we do not read your Gmail, Drive, Contacts or Calendar.

AcosControl's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access at any time in your Google Account permissions.

Cookies and measurement

We set a small number of strictly necessary cookies to keep you signed in and to keep the service secure. These cannot be turned off without breaking the product, and they do not require consent.

We also run analytics and advertising measurement on our website, using Google Analytics and Google Tag Manager, the Meta Pixel, and our own event log (dl.acoscontrol.com). These tools set cookies and send events to Google and Meta. The events record which pages and features were used and whether a sign-up or subscription resulted — they do not carry your Amazon advertising figures.

We also use Microsoft Clarity on the website and in the app to see how pages are used: it records clicks, taps, scrolling and page layout (session replays and heatmaps), and sets its own cookies. Inside the signed-in app, all text on screen is masked in your browser before anything is sent, so your campaigns, keywords, books and figures never reach Microsoft; the free tools mask the reports you drop into them in the same way. Clarity links visits to an account only by a one-way coded version of its internal ID — never your name or email address. Microsoft's use of this data is described in the Microsoft Privacy Statement.

You can block or delete these cookies in your browser settings at any time; strictly necessary cookies remain.

How long we keep it

• While your account is open — account details and advertising data are kept so your history stays intact.
• After you close your account — we delete or anonymise your advertising data within 90 days, and revoke and delete your Amazon tokens immediately on disconnection.
• Billing records — kept for 7 years where tax and accounting law requires it.
• Backups — deleted data persists in encrypted backups for up to 35 days before those rotate out.
• Security logs — up to 12 months.

Security

• All traffic is served over HTTPS.
• Amazon tokens and service credentials are encrypted at rest with AES-256-GCM; the keys are held outside the database.
• Passwords are stored only as salted hashes — we cannot read them.
• The database is not exposed to the public internet, and per-customer access is enforced at the database level, not only in the interface.
• Administrative access is restricted and logged.

No service can promise perfect security. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.

Where your data is held

Our servers are located in the European Union, and the company is based in Canada. If you are in the UK, EEA or elsewhere, your data may therefore be transferred and accessed internationally. Where that happens we rely on adequacy decisions or Standard Contractual Clauses, and we apply the safeguards in this policy regardless of where the data sits.

Your rights

Depending on where you live (GDPR in the UK/EEA, PIPEDA in Canada, CCPA/CPRA in California, and similar laws elsewhere) you can ask us to:

• Give you a copy of the personal data we hold about you, in a portable format.
• Correct anything inaccurate.
• Delete your data — you can close your account and delete your data from within the application.
• Restrict or object to a particular use, including any based on legitimate interest.
• Withdraw consent you have given, without affecting what was done before.
• Not be subject to a decision with legal effect made solely by automated means — our recommendations are advisory and you choose what to apply.

Email support@acoscontrol.com and we will respond within 30 days. We will not charge you or degrade your service for exercising these rights. If you are unhappy with our response you can complain to your data protection authority — in the UK the ICO, in Canada the Office of the Privacy Commissioner.

Children

AcosControl is for business use and is not directed at anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.

Changes to this policy

We update this policy when our data handling changes. The date at the top always reflects the current version, and we will email you before any change that materially affects your rights.

Contact

Privacy questions or requests: support@acoscontrol.com. See also our Terms of Service.