Privacy Policy

Who we are

In this policy, "we" and "us" mean SellerBox, a Delaware corporation. For any question about your data, write to support@sellerbox.dev.

What we collect

When you visit this website

We use an analytics service to count visits and to learn how people use the site. It records the pages you open, the clicks you make, and a replay of the session. Text you type into forms is masked in the replay. The service receives your IP address, which it uses to estimate your country and city. It sets cookies to recognise a return visit.

When you sign up on this website

The signup form asks for your name, email, brand or agency name, job title, and what you want to automate. The form sends these answers to us by email through a form service. We use them to reply to you and to set up your box.

When you have an account

• Your email address and name, and the emails and names of the teammates you invite.
• Your passkeys (public keys only) and your sign-in sessions. We do not use passwords.
• Your box details: its box name (the start of its address), its size, the public part of your SSH key, and the client ID of your Amazon app.
• Your subscription status, which Polar sends to us.

When we contact you first

We sometimes email Amazon sellers and agencies about SellerBox. For this we use business contact details that are publicly available, such as a name, a work email, a job title and a company. If you ask us to stop, we stop and remove you from the list on the same day.

Service providers

We use service providers for hosting, analytics, forms, payments (Polar) and email. Each one receives only the data it needs for its part. Your box and our account database are in the EU. Some providers keep data in the United States. For the list of providers, write to us.

Your box and your data

Your box is a server that belongs to your account alone. The Amazon data it syncs, the automations you build, and the files you keep on it are your data. We do not look at it, sell it, or use it to train anything.

• Amazon credentials. The secret for your Amazon app goes from your computer to your box directly. We never receive it. We keep only the app's client ID, to link the app to your box.
• Access to the box. Only your SSH key can log in to the box. We hold no key to it.
• Web traffic to the box. When you open your box in a browser, the request goes through our gateway. The gateway checks that you are a member of the team, then sends the request on. So this traffic, which can include Amazon data, passes through a server that we operate. We do not store it.
• Claude. Claude runs on your computer, on your own Anthropic account. What you send to Claude is between you and Anthropic, under their terms.

How long we keep it

• Box data. Kept for the data retention period of your plan while you pay. When you cancel, or your subscription ends, we delete the server and keep the disk for 30 days, so you can come back to it. After 30 days we delete the disk. Deleted data cannot be recovered.
• Backups. We do not make backups of your box today. The disk is stored on more than one physical machine, which protects it from a hardware fault, not from deletion or from a mistake on the box.
• Unpaid signups. If a checkout is not finished, we delete that account data about one day after the checkout link ends.
• Account and billing data. Kept while you have an account, and after that for as long as the law requires for tax and billing records.
• Signup form answers and email. Kept in our mailbox until you ask us to delete them.

Security

Every connection uses TLS. Sign-in uses passkeys or one-time email codes, never passwords. Sign-in links and setup tokens are stored only as hashes. Each box is on its own server and its own disk. No system is perfectly secure. If we find a breach that affects your data, we will tell you without delay.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, or to delete it. You can also object to an email from us, or tell us to stop. Write to support@sellerbox.dev and we will reply within 30 days. The data on your box is already yours: you can copy it or delete it at any time.

If you are in the EU or UK, you can also complain to your local data protection authority.

Changes

If we change this policy, we update the date at the top of this page. If a change affects how we use your data, we tell account holders by email before it applies.