Privacy policy

Data controller

Controller: Chuboo Group di Dmytro Makotseba, Viale Piero Pozzoli 34, 19037, Italy.

Phone: +39 351 684 6911. Email (data protection and deletion requests): chuboofamily@gmail.com.

Amazon Selling Partner API data

With your authorization in Amazon Seller Central (Manage Your Apps), Ayutor accesses data through the Amazon Selling Partner API (SP-API) using Login with Amazon (LWA) tokens. Access is limited to what is needed to provide the service.

Categories we access: orders and order items (including ASINs, quantities, prices, fees, and fulfilment channel); inventory and FBA stock levels; catalog and listing information (titles, identifiers, offer status); pricing and fee data used for margin and FBA fee calculations; and business reports needed for profitability analytics and restock planning.

We do not request buyer personally identifiable information (PII) beyond what Amazon includes in order data for fulfilment and accounting. We do not store buyer PII unless it is strictly required to provide the service, and we delete such data within 30 days of order delivery when it is received.

Ayutor uses SP-API data only on your instructions to provide profitability analytics, sourcing support, margin and FBA fee calculations, and restock insights. We do not modify your Amazon catalog, prices, or inventory through SP-API unless a feature you explicitly use requires it and is disclosed in the product.

Other data we process

Account data: name, email address, authentication credentials, and subscription status.

Extension data: Amazon product pages you open and values you enter in the Ayutor Calculator panel.

CRM email (optional): if you connect Gmail, messages are read only to create tasks; we do not send email on your behalf without your action.

Payment data: subscription payments are processed by Stripe on behalf of Chuboo Group di Dmytro Makotseba. Card data is stored by Stripe, not by Ayutor.

Website: the public site does not use advertising or analytics cookies (see our Cookies page).

Purposes and legal bases (GDPR)

Contract (Art. 6(1)(b) GDPR): providing Ayutor, calculations, profit and loss views, cart and sourcing tools, and customer support.

Legitimate interest (Art. 6(1)(f) GDPR): securing the service, preventing abuse, and improving reliability, balanced against your rights.

Legal obligation (Art. 6(1)(c) GDPR): tax, accounting, and regulatory requirements where applicable.

Consent (Art. 6(1)(a) GDPR): where required for optional integrations such as Gmail; you may withdraw consent by disconnecting the integration.

Where data is stored and security

Production systems and databases for the Ayutor application run on EU servers hosted by Hetzner Online GmbH in Germany.

Data in transit is protected with TLS 1.2 or higher. Data at rest is encrypted. Access to production systems is restricted to authorized personnel with role-based access.

Amazon LWA refresh tokens and other credentials are stored encrypted and are access-restricted.

Retention

Account data: retained while your Ayutor account is active and for the period required by law after closure (typically accounting records up to 10 years where Italian law applies).

SP-API data: deleted within 30 days after you close your Ayutor account or revoke Ayutor’s authorization in Seller Central, whichever comes first.

Buyer PII, if ever received: deleted within 30 days of order delivery.

Backups: rotated so that deleted production data is removed from backups within 90 days.

Deletion requests and revoking Amazon access

You may request deletion of your personal data by emailing chuboofamily@gmail.com. We fulfil verified requests within 30 days, subject to legal retention obligations.

You can revoke Ayutor’s access to your Amazon account at any time in Amazon Seller Central under Settings → User Permissions → Manage Your Apps. Revocation stops new SP-API calls; deletion timelines above then apply.

Your GDPR rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent where processing is based on consent.

To exercise these rights, contact us at the email above. You may lodge a complaint with the supervisory authority in your EU member state (in Italy: Garante per la protezione dei dati personali).

No sale or sharing of your data

We do not sell your personal data or Amazon business data. We do not share it with third parties for their own marketing purposes.

We disclose data only to sub-processors that help us run the service, under contracts that require appropriate safeguards, and when required by law.

Sub-processors

Hetzner Online GmbH (Germany): EU hosting and infrastructure.

Stripe, Inc.: payment processing for subscriptions.

Google LLC: optional Gmail API access when you connect email in CRM (read-only).

We may update this list; material changes will be reflected in this policy.

Security incidents

We maintain measures designed to protect data against unauthorized access, loss, or misuse.

If we become aware of a security incident affecting Amazon information obtained through SP-API, we will notify Amazon within 24 hours at the contact channel Amazon provides for developers, and we will notify affected users and regulators where required by law.