Privacy policy

This policy explains what information Kovalchick Analytics collects, why, where it is held, how long it is kept, and what you can ask me to do with it. Kovalchick Analytics is the trading name of Mathew Kovalchick, a sole proprietor based in Venice, California, contactable at kovalchickanalytics@gmail.com. He is the data controller and the only person who operates the service.

1. Who this policy covers

It covers three groups of people, and what I hold differs for each.

• Visitors to this website. Anyone reading these pages.
• Prospective clients. Anyone who contacts me or requests a free account audit.
• Clients. Sellers who have engaged the service and granted access to their Amazon advertising or selling accounts.

2. What this website collects

This website does not set advertising cookies, does not run third party trackers, and does not build a profile of you. There is no contact form, so nothing is transmitted from these pages. Email links open your own mail client.

My hosting provider, Cloudflare Pages, keeps standard server access logs which may include your IP address, browser user agent, the page requested and a timestamp. These exist for security and availability and are retained for 30 days. No analytics product is installed on this site.

3. What I collect when you contact me

• Your name, email address, business name, and anything else you choose to put in your message.
• If you request an audit: the Amazon advertising reports you send me, or the reports I pull under read only access you grant. These describe campaigns, keywords, search terms, spend and sales.
• If you proceed: your product cost of goods, selling prices and fulfilment costs.

I use this to do the work you asked for and to reply to you. I do not add you to a marketing list without you asking, and there is no newsletter to be added to.

4. Amazon data, and how I get it

For clients, I access Amazon data through Amazon's own official APIs under an authorisation you grant and can revoke. There are two.

Amazon Ads API

You authorise access to your advertising account through Amazon's standard Login with Amazon consent screen, or you add me as a user with viewer or editor permissions in your advertising console. With that authorisation I read campaigns, ad groups, keywords, product targets, negative keywords, search term reports, placement performance and campaign performance metrics. On the Execute, Growth and Continuous tiers I also write changes to bids, budgets, negative keywords, campaign status and keyword state. On the Advisory tier write access is disabled and enforced in code.

Amazon Selling Partner API

Where you additionally authorise it, I access your selling account through the Amazon Selling Partner API to read the data needed to calculate true profitability and to avoid advertising products that cannot be bought. The roles I request and the reason for each one are listed on the data security page. This authorisation is separate from the advertising one, is granted by you in Seller Central, and can be revoked there at any time.

Personally identifiable information

The service is designed not to need customer personally identifiable information. I do not request the Direct to Consumer Shipping role, I do not pull buyer names, addresses, phone numbers or email addresses, and I do not process orders. Where Amazon returns any field that constitutes personally identifiable information within a response, it is not persisted, and in no case is any such data retained beyond 30 days.

5. What I never do with your data

• I do not sell it, rent it, or trade it. Not aggregated, not anonymised, not ever.
• I do not pool one client's account data with another client's for any purpose, including benchmarking. Every stored row is tagged with the client it belongs to, and an automated check runs on every cycle and fails loudly if a row appears under the wrong client.
• I do not use your account data to inform my own Amazon brand's advertising, and my own brand does not compete in your category unless I have told you otherwise in writing before you signed anything.
• I do not send your data to any large language model, machine learning service or third party analytics provider.

6. Where your data is held

Client Amazon data is held in a single tenant database on hardware I own and control, located in Los Angeles, California, not on shared multi tenant cloud infrastructure. Encrypted backups are held at Google Drive and an encrypted external drive. Credentials and refresh tokens are stored encrypted and are never written into configuration files, source code or logs.

All data is held in the United States. If you are outside the United States, be aware that engaging the service means your business data is processed there.

7. Who else can see it

There are no employees, no contractors and no subcontractors. I am the only person with access. The third parties involved at all are these, and none of them receives your Amazon performance data except as noted:

• Amazon.com, Inc. and its affiliates. The source of the data and the destination of any changes.
• Google. Carries the reports I send you, which contain your account data, to the addresses you nominate.
• Cloudflare Pages. Serves this website only. No client data touches it.
• Google Drive. Holds encrypted backups it cannot read.

I will disclose data if compelled by valid legal process. If that happens I will tell you unless I am legally prohibited from doing so.

8. How long I keep it

9. Your rights and how to use them

Whatever jurisdiction you are in, you can ask me to do all of the following, and I will do them without charging you or making it difficult.

• Know what I hold. Ask and I will tell you, specifically.
• Get a copy. I will export your data in a machine readable format.
• Correct it. Particularly your cost and price figures, which drive every decision the system makes.
• Delete it. I will acknowledge a deletion request within 72 hours and complete it within 90 days, except where law requires me to keep a record.
• Withdraw access. You can revoke my Amazon authorisation yourself, in Amazon's own interface, without notifying me first. Nothing in my service can prevent that or delay it.
• Complain. Write to me first. If that does not resolve it, California residents can contact the California Privacy Protection Agency, and residents of the European Economic Area or the United Kingdom can contact their own supervisory authority.

Send any of these to kovalchickanalytics@gmail.com with "Privacy request" in the subject line.

10. California residents

Under the California Consumer Privacy Act as amended, I do not sell personal information and I do not share it for cross context behavioural advertising. I have not done so in the preceding twelve months. I do not use or disclose sensitive personal information for any purpose other than providing the service you engaged. You will not be discriminated against for exercising any right under that Act.

11. Children

This is a business to business service. I do not knowingly collect information from anyone under 18. If you believe I have, write to me and I will delete it.

12. Security

Encryption, access control, key rotation, logging and incident response are described in detail on the data security page. No system is perfectly secure, and I will not claim otherwise. If there is a breach affecting your data I will notify you within 24 hours of becoming aware of it, along with Amazon where Amazon data is involved.

13. Changes to this policy

If I change it materially I will email current clients and update the date at the top of this page. I will not quietly broaden what I do with your data.

14. Amazon

Kovalchick Analytics is an independent service. It is not affiliated with, endorsed by or sponsored by Amazon.com, Inc. Data obtained through Amazon's APIs is handled in accordance with the Amazon Acceptable Use Policy, the Amazon Data Protection Policy and the applicable API licence agreements, which I have accepted and which govern my use of that data regardless of anything in this policy.