Privacy Policy

Last updated: August 29, 2026

This Privacy Policy describes how Adwynx ("we", "us", or "our") collects, uses, and protects information when you use our Chrome extension and related backend service.

1. What we collect

We collect only what is necessary to provide the service:

• Account information — your email address and a hashed (bcrypt) password when you register.
• Amazon Ads campaign data — campaign names, bids, daily spend, ACoS, impressions, clicks, impression share, and related advertising metrics that the extension reads from your advertising.amazon.com session. This data is captured only while you are actively using the extension on that page.
• Usage data — token counts to track your monthly quota and enforce plan limits. We also store per-request telemetry (which page type was analyzed, token counts, response latency, and number of recommended actions). No message content is stored in this telemetry.
• Conversation context — messages you send to the AI assistant are held in a short-term session cache (Redis, hosted on Render) and expire automatically after 2 hours. They are not written to our permanent database.
• Action history — a record of bid changes, budget updates, and other actions you approve through the extension, along with outcome metrics collected 14 days later to measure effectiveness.

2. What we do not collect

• Your Amazon login credentials or passwords — the extension reads only what is already visible on the advertising page you are viewing
• Any data from Seller Central, your Amazon seller account, or any page outside of advertising.amazon.com
• Browsing history outside of advertising.amazon.com
• Payment card details (handled entirely by Stripe — see Section 5)

3. Amazon account access

Adwynx is a browser extension that reads data from advertising.amazon.com pages you are already viewing. It does not:

• Log in to Amazon on your behalf
• Access your Amazon Seller Central account
• Make purchases or perform any action without your explicit approval
• Read or store your Amazon username or password

All bid changes, budget updates, and campaign actions require your approval before executing. Adwynx proposes — you decide.

Note on Amazon's terms of service: Adwynx uses browser-based data interception rather than Amazon's official Advertising API. While we believe this falls within normal browser extension behaviour, you should be aware of this distinction. We are actively pursuing official Amazon Ads API access, which will remove this ambiguity.

4. How we use your data

• To provide the service — campaign data is sent to our AI model to generate recommendations and answer your questions.
• To authenticate you — your email and hashed password are used for login and to associate your data with your account.
• To enforce plan limits — token usage counts are tracked to apply monthly quotas.
• To measure AI quality — we track whether recommendations were approved and measure outcome metrics (e.g. ACoS change after a bid update) to improve the service. This analysis is performed on your own data to improve your experience; it is not shared across users.
• We do not sell your data — your Amazon Ads data is never sold, shared for marketing purposes, or used to train shared AI models.

5. AI processing (Anthropic)

Your campaign data and chat messages are sent to Anthropic (anthropic.com) to generate AI responses. Specifically, we send: campaign names, daily spend, ACoS, bids, impression share, and the messages you type in the chat interface.

We do not send to Anthropic: your Amazon login credentials, payment details, Seller Central data, or any data from outside advertising.amazon.com.

Anthropic does not train AI models on data submitted via their API. Their API terms of service explicitly prohibit this. Your campaign strategy is not used to train any shared model.

Your data is isolated — no other Adwynx user can see your campaigns, bids, or chat history, and Adwynx employees do not have routine access to your campaign data.

6. Payments (Stripe)

Subscription payments are processed by Stripe (stripe.com). We do not store or have access to your payment card details. Stripe's Privacy Policy governs payment data. We share your email address and subscription status with Stripe to manage billing.

7. Other service providers

We do not sell or share your personal data with third parties for marketing purposes. The following providers process data on our behalf:

• Render (render.com) — cloud hosting for our backend server, PostgreSQL database, and Redis session cache. All stored campaign data resides on Render's infrastructure.
• Resend (resend.com) — transactional email delivery. We share your email address and the content of system emails (account verification, password reset, deletion confirmation) with Resend to deliver these messages.
• Sentry (sentry.io) — error monitoring. Error reports may include your user ID in the error context. No campaign data or message content is sent to Sentry.
• Anthropic — see Section 5 above.
• Stripe — see Section 6 above.

8. Data retention

• Active accounts — your account and all campaign data are retained while your account is active.
• Account deletion — you can permanently delete your account at any time from the Settings page in the extension. Deletion is immediate and irreversible: all campaign data, action history, settings, and your account record are removed from our database, and your Stripe subscription is cancelled at the same time.
• Subscription cancellation without account deletion — if you cancel your subscription but do not delete your account, your data is retained for 90 days to allow reactivation. After 90 days, your account and all associated data are automatically and permanently deleted. You can trigger immediate deletion at any time using the Delete Account button in Settings.
• Usage telemetry and logs — per-request telemetry (token counts, latency) and scraping health events are automatically deleted after 90 days.
• Action history — records of approved actions and their outcomes are retained for 12 months, then automatically deleted.
• Chat session data — expires automatically after 2 hours from the Redis session cache and is never written to the permanent database.

9. Security

We use industry-standard measures: HTTPS for all data in transit, bcrypt password hashing, JWT-based authentication with short expiry, and rate limiting on authentication endpoints. All database queries are scoped to the authenticated user — no query can return another user's data. No system is perfectly secure, but we take reasonable precautions to protect your data.

In the event of a security breach affecting personal data, we will notify affected users by email within 72 hours of confirming the breach, describing what happened and what steps to take. If EU residents are affected, we will also notify the relevant data protection authority as required by GDPR.

10. Your rights

You have the right to access, correct, export, or delete your personal data at any time:

• Delete your account — use the "Delete Account" button in the extension's Settings page for immediate, self-serve deletion.
• Other requests — for data access, correction, or export requests, contact us at team@adwynx.ai. We will respond within 30 days.

11. Children

This service is not directed at children under 13. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email. Continued use of the service after changes constitutes acceptance.

13. Contact

For privacy questions, data requests, or security concerns, email us at team@adwynx.ai.