Privacy Policy

1. Who we are

Zarox Ltd ("Zarox", "we", "us") operates zarox.io, a platform that automates and optimizes Amazon Ads campaigns. We are registered at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ in England and Wales. For any privacy question, contact us at [email protected].

2. Data we collect

We collect and process the following categories of personal data:

• Account data — your name, email address, and account identifiers, handled through our authentication provider, Clerk.
• Billing data — subscription and payment metadata handled through Stripe. We do not store full card numbers; Stripe processes payment details directly.
• Amazon account data — the advertising and business data you authorize us to access on your behalf, including campaigns, keywords, performance reports, and per-product sales, price, and stock data. Section 3 describes how we handle it.
• Usage & support data — pages you visit and support-chat messages via Tawk.to, which loads only after you accept cookies. With the same consent, we also collect masked session replays around errors via Sentry, to diagnose bugs.

3. Amazon Information

When you connect your Amazon accounts, you authorize us to access data through the Amazon Advertising API and the Amazon Selling Partner API on your behalf. Amazon calls this "Amazon Information", and we handle it on the terms below in addition to the rest of this policy.

• What we access. Your advertising data (campaigns, ad groups, keywords, targets, and performance reports) and business data for your own catalogue (aggregated sales and traffic per ASIN, retail price, and stock availability). Our Selling Partner API access is read-only.
• What we do not access. We request no personally identifiable information about Amazon buyers. We do not retrieve buyer names, addresses, contact details, or order-level records, and we hold no restricted permissions that would expose them.
• Why we use it. Solely to operate the service for you — to calculate your true advertising cost of sale, to separate advertising-driven sales from organic sales, and to set bids and campaign structure on your behalf.
• How we protect it. Amazon Information is transmitted only over TLS 1.2 or higher and is encrypted at rest. The OAuth refresh tokens that authorize our access are encrypted before storage and are never written to logs. Access to production systems is limited to named staff and protected by multi-factor authentication.
• How long we keep it. When you revoke our authorization, close your account, or ask us to erase your data, we delete the credentials that let us reach your Amazon accounts and stop retrieving Amazon Information. Existing advertising and performance records are anonymized — unlinked from you and your Amazon accounts — or deleted once they pass the retention periods in section 8.
• Who else sees it. We do not sell, rent, or otherwise share Amazon Information, and we never use one customer's Amazon Information to inform another customer's results. The only third parties that may hold it are the sub-processors listed on our Sub-processors page.

4. How we use your data

We use your data to provide and operate the service (managing and optimizing your Amazon Ads campaigns), to bill you, to provide support, to secure the platform, and to comply with our legal obligations.

We also send service emails about your own account: a weekly digest of what Zarox changed, and exception alerts when something on your Amazon Ads account needs your attention. You can turn either off from the Notifications card in your account settings, or from the unsubscribe link in any of those emails.

5. Legal bases (GDPR Article 6)

We rely on: performance of a contract to provide the service you signed up for; legitimate interests to secure and improve the platform; consent for non-essential cookies and live chat; and legal obligation where the law requires us to retain or disclose data.

6. Sharing & sub-processors

We share personal data only with the sub-processors needed to run the service. A current list is published on our Sub-processors page. We do not sell personal data.

7. International transfers

Some of our processors (including Clerk, Stripe, and Tawk.to) are based in the United States. Where personal data is transferred outside the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses.

8. Retention

We keep personal data for as long as your account is active and as needed to provide the service. We apply an automated retention schedule per data category:

• Account erasure. When you delete your account, we wait a 30-day grace period (during which you can undo the request). After that we permanently delete your identity and cancel your subscription.
• Advertising & performance data. Your campaign, report, and bid data is not deleted on erasure but is anonymized — unlinked from you so it can no longer identify you.
• Category limits. Older operational data (such as raw reports and bid history) is automatically deleted once it passes its category retention period.
• Billing records. A minimal, pseudonymous billing record is retained to meet legal, accounting, and tax obligations.

9. Your rights

Under the GDPR you may access, rectify, erase, restrict, port, or object to the processing of your personal data, and withdraw consent at any time. You can download a copy of your data and delete your account directly from your account settings; for other requests contact [email protected]. You also have the right to lodge a complaint with your local data protection authority.

10. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can accept or reject non-essential cookies via the banner shown on your first visit.

11. Links in our emails

When you open a link in an email we send you, we record that the page was opened and which buttons you pressed, against a code in that link that identifies the business we wrote to. We do this under legitimate interests: understanding whether our outreach is useful to the businesses we write to.

The record holds the code, the action and the time, and nothing else: no IP address and no browser details, and this record stores nothing on your device. Records are deleted after 180 days. To be deleted sooner, or to object, email [email protected].

The code stays in the address of the page, so our live chat provider (only after you accept cookies) and our error-monitoring service can see that address. The book-a-call button passes the code to Calendly, so that a booking can be matched to the email we sent.

12. Contact

Questions about this policy or your data? Email [email protected] or write to Zarox Ltd, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.