Privacy Policy

1Who we are

RippleEffect SARL 16 Rue Cuvier, Lyon, 69006, France SIREN: 983096462 (RCS Lyon)

For any questions about this policy or your data, contact us at legal@rippleeffect.agency.

2What this policy covers

This policy covers the data our applications access through the Selling Partner API and the Amazon Ads API when you connect your Amazon accounts to RippleEffect, and the details you submit through the free audit form on this website. It does not cover Amazon's own handling of your data (governed by Amazon's privacy policies) or any other RippleEffect service you engage separately.

3How we access your account

We access your Seller Central and Amazon Advertising accounts using Login with Amazon (OAuth 2.0). You authorise each application on Amazon's own consent screen, signed in to your own account. Amazon then issues us a secure token tied to your account.

• We never see or store your Amazon username or password.
• Authorization is granted by you and can be revoked by you at any time (see section 10).
• Access is limited to the permissions (roles and scopes) you approve. Ripple Labs requests no role that contains buyer personal information.

4What data we access

Through the Selling Partner API (Ripple Labs), we may access and process data from your Seller Central account, including:

• Listings: titles, bullet points, images, A+ content and listing status;
• Prices and Buy Box status;
• Inventory levels, inbound shipments and fulfilment status;
• Order counts and sales totals by product and by day (order data is used as totals only);
• Account health, performance metrics and Selling Partner Insights;
• Settlement reports and fee breakdowns;
• Brand Analytics reports such as search terms and repeat purchase behaviour.

Through the Amazon Ads API, we may access and process advertising data from your account, including campaigns, ad groups, keywords, targets and ads; bids, budgets and settings; performance and reporting metrics; account-level settings; and billing data exposed by the API.

Through this website, when you submit our contact form, we collect the details you provide: your brand name, your Amazon store link, your monthly sales band and your email address. We do not use third-party advertising trackers on this site.

Amazon account data is commercial and performance data about your business. We do not request, and Ripple Labs is not permitted to receive, buyer names, addresses, phone numbers or other buyer personal information. We only access what we need to provide our services to you.

5Why we process it and our lawful basis

We process your Amazon account and advertising data to deliver the services set out in our agreement with you: reporting on sales and stock, warning you of stock-outs, checking that listings are live and priced correctly, updating listing content and prices you have approved, and managing advertising. We process audit-form details solely to prepare and send your audit and to follow up on it.

Under the EU GDPR and UK GDPR, our lawful bases are:

• Performance of a contract — to provide the services you have engaged us for; and
• Legitimate interests — to operate, secure, audit, and improve our advertising management systems, balanced against your rights.

6How we use it

We use your data to:

• Manage and optimise your Amazon advertising campaigns;
• Produce weekly reports, stock forecasts and restock recommendations;
• Check listings and prices, and apply changes you have approved;
• Maintain an audit log of changes made to your account;
• Diagnose issues and improve the reliability of our management systems.

We do not sell your data, and we do not use it for advertising or profiling unrelated to managing your account.

7Automated processing and AI

Our management systems use automated tools and artificial intelligence to analyse account and performance data and to propose changes. Changes to listings and prices are applied only after a client has approved them, and advertising changes are subject to human review in line with our agreement with you. No decision producing legal or similarly significant effects on an individual is made solely by automated means.

8Third parties and sub-processors

We do not sell or share your data with any outside party for their own use. To deliver our services we use trusted providers ("sub-processors") that hold or process data on our behalf under contract. These currently include:

• Amazon — the source of the account and advertising data;
• Amazon Web Services (London region) — encrypted storage of account data and API credentials;
• Vercel — hosting of this website and the client authorisation pages;
• Anthropic (Claude) — AI processing of account and advertising data;
• Notion — change logging and record-keeping;
• Google (Drive / Sheets) — reporting;
• Resend — delivery of contact-form and notification emails.

We provide an up-to-date list of sub-processors on request.

We require our sub-processors to protect your data and to process it only as needed to provide their services to us.

9Data storage, security, and retention

• Access tokens and other credentials are stored in AWS Secrets Manager, encrypted, and never kept in code, documents, chat or email.
• Data is encrypted in transit (TLS 1.2 or higher) and at rest, with access limited to named RippleEffect staff using multi-factor authentication.
• We keep security logs for at least 12 months and review them regularly.
• We retain your account and advertising data only while we provide services to you and to meet legal, audit, or record-keeping obligations. Within 30 days of an engagement ending we revoke our access, delete your Amazon data, and delete or return other data in line with our agreement. Contact-form details are deleted once your enquiry is closed, or sooner on request.
• Should any buyer personal information reach us unintentionally, it is deleted within 30 days.
• We report any security incident involving Amazon data to Amazon within 24 hours of detection, and notify affected clients.

10Revoking access

You can withdraw Ripple Labs' access to your Seller Central account at any time in Seller Central under Apps and Services, then Manage Your Apps. You can withdraw our advertising application's access through your Amazon account settings (Login with Amazon connected applications). Or contact us at legal@rippleeffect.agency. Revoking access stops all further processing through the API.

11International transfers

Some of our sub-processors — including AI and hosting providers — may process data outside the European Economic Area and the UK (for example, in the United States). Where this happens, we rely on appropriate safeguards — such as the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement — to protect your data.

12Your rights

Under the EU GDPR and UK GDPR you have rights to access, correct, delete, restrict, or object to the processing of personal data we hold about you, and to data portability. To exercise these rights, contact legal@rippleeffect.agency.

You also have the right to complain to a supervisory authority. As RippleEffect is established in France, our lead authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr. Clients and individuals in the UK may also contact the Information Commissioner's Office (ICO) — ico.org.uk.

13Changes to this policy

We may update this policy from time to time. The current version is always available at this URL, with the effective date shown at the top.

14Contact

RippleEffect SARL 16 Rue Cuvier, Lyon, 69006, France legal@rippleeffect.agency