SellerApp GDPR Commitment and Roadmap

Overview

You connect your Amazon Seller Central and Amazon Ads accounts to SellerApp so we can help you grow. That takes trust, and the General Data Protection Regulation (GDPR) spells out exactly what we owe you in return.

This page explains how Sellmetric Pte Ltd, the company behind SellerApp, handles the personal data of people in the European Economic Area and the United Kingdom. It covers what is already in place and what we are still working on.

Think of it as the plain-English companion to our Privacy Policy. The Privacy Policy is the full legal notice. This page is for procurement teams, privacy reviewers, and anyone who would like a straight answer without reading forty clauses to get it.

SellerApp and the GDPR at a glance

Who we are and the two roles we play

SellerApp is operated by Sellmetric Pte Ltd, 140 Paya Lebar Road, #10-09, AZ @ Paya Lebar, Singapore 409015. Our United States office is at 4819 Bryant Mdws Dr, Spring, TX 77386. We also have a team in India.

Because we are based outside the EU and the UK and offer our services to businesses there, the GDPR applies to us under Article 3(2).

Under the GDPR, a company can be a controller, a processor, or both. We are both, and which one depends on the data.

When we are the controller. We decide why and how the data is used. That covers visitors to sellerapp.com, people who fill in a form or book a demo, account holders and their team members, and billing contacts.

When we are the processor. You decide why and how the data is used, and we act on your instructions. That covers the data that flows in when you connect Amazon Seller Central, Amazon Ads, or another marketplace or advertising account. It also covers client data that agencies manage on our platform. In those cases you are the controller, and our Data Processing Agreement sets the rules we follow.

What we process, why, and on what lawful basis

Every use of personal data needs a lawful basis under Article 6 of the GDPR. Here is ours, activity by activity.

Lead forms are voluntary. If you would rather not fill one in, the rest of the site works the same.

In addition, a few things we do not do.

• We do not sell personal data.
• We do not collect the personal information of your buyers.
• We do not ask for special category data under Article 9, such as health or biometric data, and we ask that you do not send us any.
• Our services are built for businesses and are not directed at children under 16.

Amazon and marketplace account data

To use SellerApp, you connect Amazon Seller Central and the Amazon Ads console. That connection is where most of the data in your account comes from, so here is how we treat it.

• Access runs through official APIs. We reach your data through authorized marketplace and advertising APIs, with the permissions you grant during onboarding.
• You stay in control. You can revoke our access at any time from your Amazon account.
• We use it for your service and nothing else. We do not use marketplace, advertising, or extension data for behavioral advertising or for profiling unrelated to the services you asked for.
• We work with seller data, not buyer data. SellerApp does not collect the personal information of your buyers, such as names, addresses, or contact details. Our analytics run on seller-level data like listings, sales, inventory, and campaign performance.
• Most of it is business data. ASINs, listings, prices, and campaign metrics describe products and performance, not people. That said, data about a sole trader can count as personal data, and we treat it accordingly.
• Amazon’s rules apply too. As a Selling Partner API developer, we are bound by Amazon’s Data Protection Policy and Acceptable Use Policy on top of the GDPR.

The same approach applies to the other platforms you connect, such as Walmart, Instacart, Flipkart, Google Ads, and Meta.

Cookies and the three categories that matter

Not all cookies are equal, and the law treats them differently. We sort ours into three groups, and only the first group runs without your say-so.

In practice, that means the following.

• Where the law requires consent, analytics and profiling cookies are set only after you accept them through our cookie banner.
• You can decline them, and the site works either way.
• You can change your choice at any time through the cookie banner or your browser settings.
• We honor Global Privacy Control signals from your browser where the law requires it.

These rules come from the ePrivacy Directive in the EU and the Privacy and Electronic Communications Regulations in the UK, which work alongside the GDPR.

Where your data lives and who helps us process it

SellerApp runs on Cloud infrastructure. We operate the service from the United States, Singapore, and India, and data is stored and processed through cloud and IT providers located in or operating from those countries. Our teams access personal data only as needed to provide support and services.

International transfers

The United States, Singapore, and India are outside the European Economic Area and the UK. Therefore, when personal data covered by the GDPR is transferred to those countries, Chapter V requires an appropriate safeguard.

We rely on the safeguards the law recognizes. These include the European Commission’s Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum, where they apply. Both are incorporated into our Data Processing Agreement, and you can ask for a copy at legal@sellerapp.com.

How long we keep data and what happens when you leave

We keep personal data only as long as we need it for the purpose it was collected for, as Article 5(1)(e) requires. After that, we delete it or strip out anything that identifies you.

Once data is no longer needed, we delete or anonymize it. Before you close your account, you can ask for a copy of your personal data. Email legal@sellerapp.com and we will provide it in a commonly used, machine-readable format.

How we protect your data

Article 32 asks for security that fits the risk. We would rather tell you what we do than wave a badge around, so here it is.

• Encryption in transit for data moving between you, us, and the marketplaces
• Role-based permissions, so people see only what their job needs
• Access controls that limit who can reach personal data
• Administrative, technical, and physical safeguards against loss, misuse, and unauthorized access
• Amazon’s Data Protection Policy requirements for the data we reach through its APIs

No system is perfectly secure, and anyone who says otherwise is selling something. What we can promise is that we take it seriously and tell you quickly if something goes wrong.

If there is a breach

If a personal data breach happens, here is what we commit to.

• As a controller. We notify the relevant supervisory authority within 72 hours of becoming aware of a breach that puts people at risk, as Article 33 requires. Where the risk to individuals is high, we tell them directly without undue delay under Article 34.
• As a processor. We notify the affected customer without undue delay after becoming aware, as Article 33(2) requires, with the details they need to meet their own obligations.

Your rights and how to use them

If you are in the EEA or the UK, the GDPR gives you these rights over your personal data.

How to make a request

• Email legal@sellerapp.com and tell us which right you would like to use.
• We confirm your identity, so nobody else can get hold of your data.
• We respond within one month. For complex requests the GDPR allows up to two more months, and we will tell you if we need them.

Requests are free of charge. You do not need to give a reason.

However, if we hold your data on behalf of a SellerApp customer, for example because you are a team member or client of a business that uses our platform, that customer is the controller. We will pass your request to them and help them respond.

How to complain

We would like the chance to fix a problem first, so please write to us. You also have the right to complain to your local data protection authority at any time. In the EU, you can find yours through the European Data Protection Board. In the UK, it is the Information Commissioner’s Office.

Data Processing Agreement

If you are subject to the GDPR and we process personal data for you, Article 28 requires a written contract between us. We offer a Data Processing Agreement to any customer who needs one. Email legal@sellerapp.com and we will send it for signature.

The agreement covers the points Article 28(3) lists.

• We process personal data only on your documented instructions
• Everyone with access is bound by confidentiality
• We apply the security measures described on this page
• We use sub-processors only under equivalent terms and tell you about changes
• We help you respond to data subject requests and carry out impact assessments
• We notify you of a personal data breach without undue delay
• We delete or return personal data when the service ends
• We give you the information you need to check our compliance, including audits
• The Standard Contractual Clauses and the UK Addendum are included for international transfers

Our roadmap

The 2018 version of this page said we were getting ready. That was a while ago, so here is where things actually stand. We update this table whenever an item moves.

Frequently asked questions

Contact us about privacy

A real person reads every privacy request. Here is how to reach us.

For the full legal notice, read our Privacy Policy.

Sources

• SellerApp Privacy Policy, last updated June 8, 2026
• UK GDPR Article 27, Fieldfisher
• European representatives, Information Commissioner’s Office
• Key security control guidance for SP-API, Amazon
• European Court of Justice to review challenge to the Data Privacy Framework, WilmerHale