Privacy policy

Draft · legal review pending

This page explains what ACoSmate stores about you and about the Amazon advertising accounts you connect, why, for how long, and how to have it removed. It is written to be read, not skimmed; if anything here is unclear, write to hello@acosmate.com.

1. Who is responsible

ACoSmate (the "operator", "we") is the data controller for the account data described below. The legal entity and postal address will be stated here once legal review is complete. Contact: hello@acosmate.com.

2. What we store, and why

Data	Why	Kept for
Your email address and a hash of your password; two-factor secret if you enable it	To sign you in and keep your account yours	Until you delete your account
Your Amazon Ads authorisation (a refresh token issued by Login with Amazon)	To read your advertising data and, only if you enable it, to apply the changes you approve	Until you disconnect the account or revoke access at Amazon; encrypted at rest with a key unique to your account
Advertising data from Amazon Ads: campaigns, ad groups, targets, search terms, bids, budgets, spend, clicks, impressions, orders and sales figures	To produce the Wasted Spend Ledger, recommendations and reports	At most 18 months, as Amazon's terms require; deleted within 30 days of disconnecting
Bulk reports you upload	To produce the ledger without an Amazon connection	Same as above
Your decisions in the app (approve, skip, reject, settings, notes)	So the rules and the audit trail reflect what you chose	Life of the account
Questions you ask the assistant and its answers	To answer you and to check the answer against your data	90 days
Server logs (IP address, request path, timestamp)	Security and troubleshooting	30 days

We do not receive or store Amazon customer data: no buyer names, addresses or order-level personal data reach ACoSmate. We do not sell data, and we do not use one customer's data to advise another.

3. Where the data lives and who else touches it

ACoSmate runs on a server we control in the European Union (France), operated by Contabo GmbH. The following sub-processors may handle data on our behalf:

• Contabo GmbH (Germany) — server hosting in the EU.
• Anthropic (USA) — the language model behind the assistant. It receives the aggregated advertising figures needed to answer a question and never receives your Amazon credentials or your password.
• Cloudflare — domain name resolution for acosmate.com.
• Amazon — the Amazon Ads API and Login with Amazon, under Amazon's own terms.

4. How it is protected

Amazon credentials are encrypted at rest with a per-account key that is itself wrapped by a master key held only on the server. All traffic uses TLS. Sign-in is protected by rate limiting; two-factor authentication is available to every user and required for account owners performing sensitive changes. Every account's data is isolated at the database layer; nothing is shown across accounts.

5. Your rights

You can export your data, correct it, or have it deleted by writing to hello@acosmate.com. Deletion is completed within 30 days. You can revoke ACoSmate's access to your Amazon account at any time from your Amazon account settings; we then stop reading data and delete what we hold within 30 days. Under the GDPR you may also complain to your national data protection authority.

6. Cookies

The application uses two cookies, both strictly necessary: one that keeps you signed in and one that protects forms against cross-site requests. The public website sets no cookies, loads nothing from third parties, and uses no analytics.

7. Changes

When this policy changes, the date at the top changes and account owners receive an email. The previous version remains available on request.