Privacy & Data Protection Policy

1. Information We Collect

We may collect the following types of information:

2. How We Use Your Information

We use your information to:

• Provide, operate, and improve the App
• Perform tasks you request on your behalf (e.g., PPC audits, keyword research, customer support triage)
• Generate reports, spreadsheets, and analytics deliverables
• Personalize your experience and remember your preferences
• Communicate with you about updates, features, or support
• Monitor performance, security, and usage trends
• Comply with legal obligations

We do not sell your personal data.

We do not use your data to train AI models. Your data is used solely to provide services to you.

3. Transparency & Disclosure

We are committed to being clear and honest about our data practices:

• We clearly disclose what data we access from your connected accounts and for what purpose
• Our application uses artificial intelligence to analyze data and generate outputs — we are transparent about the use of AI models, their accuracy, and data freshness
• We disclose any third parties with whom your data is shared, and for what purposes
• We will notify you of any material changes to our data practices

4. Amazon Data Handling

As an authorized Amazon SP-API application, we adhere to Amazon's Data Protection Policy and Acceptable Use Policy:

• We access Amazon data only to perform activities you have explicitly authorized
• Customer PII from Amazon is retained for no longer than 30 days after order delivery and only for order fulfillment, tax calculation, tax invoices, and legal requirements
• Non-PII Amazon data is deleted within 18 months unless longer retention is required by applicable law
• We do not use Customer PII for marketing, advertising, or any purpose other than merchant-fulfilled shipping and legal compliance
• We do not aggregate data across multiple seller accounts
• We do not disclose your Amazon data to other application users, affiliated entities, or outside parties except as required to perform authorized activities on your behalf
• Upon Amazon's request, we will permanently and securely delete all Amazon data within 30 days

5. Legal Basis for Processing

Depending on your location, we process your data based on:

• Your consent
• Performance of a contract (providing the App)
• Legitimate business interests
• Legal obligations

You may withdraw your consent at any time where consent is the legal basis for processing. We comply with applicable privacy laws and regulations including GDPR and other data protection frameworks.

6. Data Storage & Security

We implement robust technical and organizational measures to protect your information from unauthorized access, loss, or misuse:

• All data is encrypted in transit (TLS) and at rest
• We store only secure OAuth tokens — never your passwords or raw credentials
• Each workspace is fully isolated — your data is never shared or mixed with other users
• Access to production systems is restricted and monitored
• Security logs are retained for at least 12 months for incident response purposes
• We maintain documented incident response and data breach procedures

Your data may be stored and processed on secure servers operated by us or trusted third-party service providers who are contractually bound to protect your data.

7. Data Sharing

We may share your information with:

• Service providers who help us operate the App (e.g., hosting, analytics) — all bound by data protection agreements
• Third-party services you explicitly choose to connect (e.g., Google Drive, Slack, Notion) — only to perform tasks you request
• Legal authorities if required by law

We perform due diligence on all third-party providers' data security practices before sharing any data. All third parties are contractually required to protect your data and use it only for authorized purposes.

8. Data Retention & Deletion

• Amazon Customer PII: Retained for no longer than 30 days after order delivery, solely for order fulfillment, tax compliance, and legal requirements
• Amazon Non-PII Data: Deleted within 18 months unless longer retention is required by applicable law
• General Account Data: Retained for as long as your account is active or as needed to provide services. Deleted upon account closure or your request
• Security Logs: Retained for at least 12 months for incident response
• On Amazon's Request: All Amazon data permanently and securely deleted within 30 days of notice; all live instances removed within 90 days

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct or update your data
• Request deletion of your data
• Object to or restrict processing
• Request data portability
• Withdraw consent at any time
• Stop sharing or processing of your information

We maintain technical and organizational processes to assist you with data subject access requests. You can exercise these rights by contacting us at info@getdragonbot.com.

10. Children's Privacy

The App is not intended for children under the age of 13 (or the minimum age required by applicable law). We do not knowingly collect personal data from children.

11. Employee Data Handling

All employees who process PII are bound by contractual confidentiality obligations regarding the handling of personal information.

12. Changes to This Policy

We may update this Privacy & Data Protection Policy from time to time. Any changes will be effective when posted in the App. We will notify you of material changes. Continued use of the App constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions or requests regarding this Policy, your data, or your privacy rights, please contact us at: info@getdragonbot.com

We respond to all inquiries within 24 hours, Sunday through Friday.