Privacy Policy
1. Who we are
MerchPilot (merchpilottool.com) is a private, internal software tool operated by Agnes Vigilia-Marayas, located in the United States ("we", "us"). It is used solely to manage advertising for the operator's own Amazon Merch on Demand products. MerchPilot has no public registration, no customer accounts and is not offered or sold to third parties.
Contact: malliegalland@hotmail.com
2. Scope
This policy explains what data MerchPilot accesses, how it is used and protected. Access to the tool is limited to the owner and authorized administrators.
3. Data we access
- Amazon Ads data, accessed through the Amazon Ads API only after the account owner authorizes it via Login with Amazon: advertising profiles, campaigns, ad groups, product ads, keywords, targets, negative keywords, budgets, bids, keyword and bid recommendations, and performance reports (impressions, clicks, spend, sales, orders and related metrics).
- Authorization credentials: OAuth access and refresh tokens issued by Amazon for this application.
- Merch sales data from the operator's own Merch on Demand accounts (units, royalties, returns, cancellations), imported for internal reporting.
- Administrator login data: email address and session information needed to sign in to the tool.
MerchPilot does not collect data about Amazon shoppers or end customers, and does not use advertising data to identify individuals.
4. How we use data
- Display advertising performance and sales reporting for the operator's own products.
- Draft Sponsored Products campaigns, keywords, targets and bid suggestions for owner review.
- Apply campaign changes to Amazon Ads only after explicit owner approval, and keep a log of each change and its outcome.
Data is used only to operate the tool for the operator's own business. It is never sold, rented or used for any third party's advertising.
5. AI processing
To generate campaign drafts, relevant advertising and product data (for example ASINs, product titles, keywords and performance metrics) may be sent to an AI service provider, OpenAI (or another provider configured by the operator), acting as a data processor. No Amazon credentials or tokens are ever sent to the AI provider. AI outputs are suggestions only and are never published without owner approval.
6. Sharing
We do not share Amazon Ads data with third parties, except with service providers strictly necessary to run the tool (hosting provider Vultr and the AI provider above), under their confidentiality and security terms, or where required by law.
7. Storage and security
- All traffic is encrypted with HTTPS/TLS.
- OAuth tokens and client secrets are stored server-side only, encrypted at rest, and never exposed to the browser.
- Access is restricted to authenticated administrators; there is no public sign-up.
- Servers are hosted by Vultr in the United States.
8. Data retention
Advertising and reporting data is kept only as long as needed for historical reporting, up to 24 months. Authorization tokens are deleted immediately when access is revoked. All Amazon Ads data is deleted within 30 days after the integration is disconnected or the tool is retired.
9. Revoking access
The Amazon account owner can revoke MerchPilot's access at any time from their Amazon account settings (Login with Amazon – apps and services), or by contacting us at the email above. Once revoked, MerchPilot can no longer access the Amazon Ads account.
10. Cookies
MerchPilot uses only essential session cookies required to keep administrators signed in. No advertising or third-party tracking cookies are used.
11. Children
MerchPilot is not directed to children and does not knowingly process children's data.
12. Changes
We may update this policy from time to time. The "Last updated" date above shows the latest revision.
13. Contact
Questions about this policy: malliegalland@hotmail.com