Zone by Zonster

Privacy Policy

Effective Date: March 1, 2026 · Last Updated: April 19, 2026

Zonster LLC ("we," "us," or "our") is a Wyoming limited liability company and the operator of Zone ("Zone by Zonster"), an Amazon seller analytics and advertising management platform accessible at zone.zonster.com. This Privacy Policy explains how we collect, use, store, and protect information when you use Zone, including data obtained through Amazon's Selling Partner API (SP-API) and Amazon Advertising API.

1. Information We Collect

1.1 Account Information

When you register, we collect your name, email address, and password (stored as a secure hash). We do not store plaintext passwords.

1.2 Amazon API Data

With your explicit authorization, we access the following data from Amazon's APIs on your behalf:

Advertising campaign data (campaigns, ad groups, keywords, targets, bids, performance metrics)
Order data (order IDs, order status, revenue, units sold)
Inventory data (ASIN-level stock levels and inventory health)
Product catalog data (ASINs, titles, categories)
Financial data (fees, refunds, settlements)
Sales and traffic reports

This data is accessed solely to provide you with the analytics and management features of Zone.

1.3 Usage Data

We collect standard server logs including IP addresses, browser type, pages visited, and timestamps for security and performance monitoring purposes.

1.4 OAuth Credentials

We store OAuth refresh tokens issued by Amazon to maintain your authorized connection. These tokens are encrypted at rest using AES-256-GCM encryption and are never shared with third parties.

2. How We Use Your Information

We use the information we collect exclusively to:

Provide, operate, and improve the Zone platform
Display your Amazon advertising and sales analytics
Execute bid adjustments and campaign changes you authorize
Generate performance reports and insights
Authenticate your identity and maintain account security
Respond to support requests
Comply with legal obligations

We do not use your Amazon data to train machine learning models, sell to third parties, or for any purpose beyond operating the features you have explicitly requested.

3. Amazon API Data Usage & Compliance

Our use of Amazon's SP-API and Advertising API is governed by Amazon's Developer Agreement and API usage policies. Specifically:

We only request the minimum API permissions necessary to provide our service
We do not share, sell, or transfer Amazon-sourced data to any third party
We do not use Amazon data for purposes other than providing the Zone service to you
We comply with all applicable Amazon data protection requirements
We retain Amazon API data only as long as your account is active or as required by law

4. Data Storage & Security

We take data security seriously and implement the following measures:

All data is stored in a secured PostgreSQL database hosted on Supabase
OAuth tokens and sensitive credentials are encrypted at rest using AES-256-GCM
All data in transit is encrypted using TLS 1.2 or higher
Access to production systems is restricted to authorized personnel only
We maintain audit logs of all API access and credential changes
Rate limiting is applied to all API endpoints to prevent abuse

5. Data Retention

We retain your account data and Amazon API data for as long as your Zone account is active. When you delete your account, we will delete or anonymize your personal data and Amazon-sourced data within 30 days, except where retention is required by applicable law.

6. Data Sharing & Third Parties

We do not sell, trade, or rent your personal information or Amazon data to third parties. We may share information only in the following limited circumstances:

Service providers: We use Supabase for database hosting and Vercel for application hosting. These providers process data solely on our behalf under data processing agreements.
Legal requirements: We may disclose information if required by law, court order, or governmental authority.
Business transfers: In the event of a merger or acquisition, your data may be transferred to the successor entity under the same privacy protections.

7. Your Rights & Data Deletion

You have the following rights regarding your data:

Access: You may request a copy of the data we hold about you
Correction: You may request correction of inaccurate data
Deletion: You may request deletion of your account and all associated data
Revocation: You may revoke Zone's access to your Amazon account at any time through your Amazon Seller Central account settings
Portability: You may request an export of your data in a machine-readable format

To exercise any of these rights, contact us at info@zonster.com.

8. Cookies

We use essential session cookies to maintain your authenticated session. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. You may disable cookies in your browser settings, but this will prevent you from logging in to the platform.

9. Agency Data Sharing

Zone offers an agency mode that allows authorized agencies to access and manage Amazon seller accounts on behalf of their clients. This section explains how data is handled in agency relationships.

9.1 Consent & Authorization

Agency access requires explicit consent from the account holder. When a client accepts an agency invitation, we record the date, time, and IP address of the consent for compliance purposes. No agency access is granted without this explicit consent.

9.2 Data Shared with Agencies

When you grant agency access, the agency can view your Amazon sales data, advertising metrics, inventory data, financial summaries, keyword rankings, and other analytics available through your Zone account. The agency can also manage your advertising campaigns (create, modify, pause, and adjust bids) on your behalf.

9.3 Credential Security

Your Amazon API credentials are never shared with your agency. When an agency performs actions on your behalf, they use your stored OAuth tokens through our platform — the agency never has direct access to your Amazon credentials.

9.4 Audit Logging

All actions performed by an agency on your account are logged in a dedicated audit trail that records the agency user, the action taken, the resource affected, and the timestamp. This log is maintained for compliance and dispute resolution purposes.

9.5 Revoking Access

You can revoke agency access at any time from your Account Settings. Revocation takes effect immediately — the agency will no longer be able to view your data or perform any actions on your account.

10. Children's Privacy

Zone by Zonster is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the platform. Your continued use of Zone after changes become effective constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Zonster LLC

Email: info@zonster.com

Website: zonster.com