Privacy Policy

Last updated: May 2026  ·  Effective date: May 1, 2026

1. Who We Are

YX Weekly is an AI-powered analytics platform for Amazon sellers. We provide weekly performance reports, advertising optimization, inventory tracking, and AI-driven operational insights through authorized access to your Amazon store data via the Amazon Selling Partner API (SP-API).

For privacy-related inquiries, contact us at: [email protected]

2. Data We Collect via Amazon SP-API

When you authorize YX Weekly to connect to your Amazon seller account, we access the following data types through the Amazon SP-API — all of which are non-PII (non-personally identifiable) operational data:

• Order statistics — aggregate order counts, sales totals, and revenue reports. We access order-level data for statistical purposes only; we do not collect or store buyer names, shipping addresses, phone numbers, or email addresses.
• Inventory data — stock levels, ASIN inventory status, FBA/FBM fulfillment data.
• Listing data — product titles, descriptions, prices, images, ASIN identifiers, and listing performance metrics.
• Advertising data — campaign performance, keyword bids, impressions, clicks, and ad spend from the Amazon Advertising API.
• Sales reports — traffic data, conversion rates, and sales performance reports via the Reports API.

What we do NOT collect

Account information

To use YX Weekly, you create an account using a username and email address. We collect only the information necessary to provide our service and maintain your account.

3. How We Use Your Data

All data accessed through the Amazon SP-API is used exclusively to provide and improve our services to you as an Amazon seller. Specifically:

• Generating weekly performance reports and operational dashboards
• Providing AI-driven insights, advertising optimization recommendations, and inventory alerts
• Tracking listing performance, keyword rankings, and competitive analysis
• Detecting operational anomalies and compliance risks

We do not use your Amazon store data for advertising or marketing purposes. We do not sell, rent, or otherwise commercially exploit your data. We do not use SP-API data beyond the scope of services explicitly authorized by you.

4. Data Sharing

We do not sell or rent your data to any third party. We share data only in the following limited circumstances:

• Cloud infrastructure provider: Your data is stored on Supabase (hosted on AWS infrastructure, us-east-1 region). Supabase processes data solely to provide infrastructure services and is bound by strict data processing agreements. No Amazon SP-API data is shared with Supabase beyond what is necessary for secure storage and retrieval.
• Amazon: SP-API authorization data is shared with Amazon as required to maintain the OAuth connection between your seller account and our platform.
• Legal requirements: We may disclose data if required by law, court order, or regulatory authority.

In all cases, we share only the minimum data necessary. We do not share Amazon store data with any advertising networks, data brokers, or third-party analytics services.

5. Data Retention and Deletion

• Amazon SP-API data: Retained only while your SP-API authorization is active. Upon revocation of authorization, all associated Amazon store data is deleted or anonymized within 7 business days.
• Account data: Retained while your account is active. Upon account cancellation, personal account information is deleted or anonymized within 30 business days.
• Transaction records: Retained for a minimum of 3 years as required by applicable accounting and tax regulations, after which they are anonymized.

You may request deletion of your data at any time by contacting [email protected]. We will confirm receipt and complete the deletion within 15 business days.

6. Security

We implement industry-standard security measures to protect your data:

• Data in transit: All communications between your browser, our servers, and the Amazon SP-API are encrypted using TLS 1.2 or higher (HTTPS).
• Data at rest: All stored data is encrypted using AES-256 encryption provided by our cloud infrastructure (Supabase/AWS).
• Access control: We apply the principle of least privilege — only personnel with a demonstrated need can access Amazon-related data. All internal access is governed by role-based permissions.
• Audit logging: Access to Amazon data is logged and regularly reviewed to detect unauthorized access or anomalies.
• SP-API credentials: Amazon OAuth tokens (refresh tokens) are stored encrypted and never exposed in logs or to unauthorized parties.

7. SP-API Authorization and Revocation

You authorize YX Weekly to access your Amazon store data via the Amazon SP-API through Amazon's official Login with Amazon (LWA) OAuth 2.0 flow. You may revoke this authorization at any time through:

• Your YX Weekly account settings under "Store Management → Amazon Authorization"
• Your Amazon Seller Central account under "Apps & Services → Manage Your Apps"

Revocation takes effect immediately — we stop all SP-API calls for the relevant store upon revocation. Associated data is deleted within 7 business days as described in Section 5.

8. Your Rights

You have the right to:

• Access the data we hold about you and your store
• Correct inaccurate information
• Delete your data (subject to legal retention obligations)
• Revoke SP-API authorization at any time
• Export a copy of your data upon request

To exercise any of these rights, contact [email protected]. We will respond within 15 business days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notice at least 7 days before the changes take effect. Your continued use of YX Weekly after the effective date constitutes acceptance of the updated policy.

10. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your data:

Email: [email protected]
Please include "Privacy" in the subject line. We respond to all privacy-related inquiries within 10 business days.