Privacy Policy

1. Who we are

Zarox Ltd ("Zarox", "we", "us") operates zarox.io, a platform that automates and optimizes Amazon Ads campaigns. We are registered at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ in England and Wales. For any privacy question, contact us at contact@zarox.io.

2. Data we collect

We collect and process the following categories of personal data:

• Account data — your name, email address, and account identifiers, handled through our authentication provider, Clerk.
• Billing data — subscription and payment metadata handled through Stripe. We do not store full card numbers; Stripe processes payment details directly.
• Amazon account data — the advertising and business data you authorize us to access on your behalf, including campaigns, keywords, performance reports, and per-product sales, price, and stock data. Section 3 describes how we handle it.
• Usage & support data — pages you visit and support-chat messages via Tawk.to, which loads only after you accept cookies.

3. Amazon Information

When you connect your Amazon accounts, you authorize us to access data through the Amazon Advertising API and the Amazon Selling Partner API on your behalf. Amazon calls this "Amazon Information", and we handle it on the terms below in addition to the rest of this policy.

• What we access. Your advertising data (campaigns, ad groups, keywords, targets, and performance reports) and business data for your own catalogue (aggregated sales and traffic per ASIN, retail price, and stock availability). Our Selling Partner API access is read-only.
• What we do not access. We request no personally identifiable information about Amazon buyers. We do not retrieve buyer names, addresses, contact details, or order-level records, and we hold no restricted permissions that would expose them.
• Why we use it. Solely to operate the service for you — to calculate your true advertising cost of sale, to separate advertising-driven sales from organic sales, and to set bids and campaign structure on your behalf.
• How we protect it. Amazon Information is transmitted only over TLS 1.2 or higher and is encrypted at rest. The OAuth refresh tokens that authorize our access are encrypted before storage and are never written to logs. Access to production systems is limited to named staff and protected by multi-factor authentication.
• How long we keep it. When you revoke our authorization, close your account, or ask us to erase your data, we delete the credentials that let us reach your Amazon accounts and stop retrieving Amazon Information. Existing advertising and performance records are anonymized — unlinked from you and your Amazon accounts — or deleted once they pass the retention periods in section 8.
• Who else sees it. We do not sell, rent, or otherwise share Amazon Information, and we never use one customer's Amazon Information to inform another customer's results. The only third parties that may hold it are the sub-processors listed on our Sub-processors page.

4. How we use your data

We use your data to provide and operate the service (managing and optimizing your Amazon Ads campaigns), to bill you, to provide support, to secure the platform, and to comply with our legal obligations.

5. Legal bases (GDPR Article 6)

We rely on: performance of a contract to provide the service you signed up for; legitimate interests to secure and improve the platform; consent for non-essential cookies and live chat; and legal obligation where the law requires us to retain or disclose data.

6. Sharing & sub-processors

We share personal data only with the sub-processors needed to run the service. A current list is published on our Sub-processors page. We do not sell personal data.

7. International transfers

Some of our processors (including Clerk, Stripe, and Tawk.to) are based in the United States. Where personal data is transferred outside the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses.

8. Retention

We keep personal data for as long as your account is active and as needed to provide the service. We apply an automated retention schedule per data category:

• Account erasure. When you delete your account, we wait a 30-day grace period (during which you can undo the request). After that we permanently delete your identity and cancel your subscription.
• Advertising & performance data. Your campaign, report, and bid data is not deleted on erasure but is anonymized — unlinked from you so it can no longer identify you.
• Category limits. Older operational data (such as raw reports and bid history) is automatically deleted once it passes its category retention period.
• Billing records. A minimal, pseudonymous billing record is retained to meet legal, accounting, and tax obligations.

9. Your rights

Under the GDPR you may access, rectify, erase, restrict, port, or object to the processing of your personal data, and withdraw consent at any time. You can download a copy of your data and delete your account directly from your account settings; for other requests contact contact@zarox.io. You also have the right to lodge a complaint with your local data protection authority.

10. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can accept or reject non-essential cookies via the banner shown on your first visit.

11. Contact

Questions about this policy or your data? Email contact@zarox.io or write to Zarox Ltd, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.