AMOS Privacy & Data Retention Policy

The short version

AMOS uses your Amazon and Meta data only to run your account inside AMOS, never sells it, and deletes it on a fixed schedule or when you ask. This page is the full policy; the summary below is what most readers need.

• What we collect: your account details, the Amazon and Meta business data you connect (sales, traffic, ads, listings, catalog), files you upload, and basic usage logs.
• What we don't collect: Amazon shopper names, addresses, phone numbers, or emails. AMOS does not request Amazon's restricted (buyer PII) data roles, and strips buyer PII from any file you upload before saving it.
• Why we use it: to show your dashboards, scorecards, alerts and recommendations, and to deliver services you order.
• What we never do: sell your data, use it for advertising to anyone else, share one client's data with another, or use Amazon or Meta data to train AI models.
• How long we keep it: see the retention schedule in Section 8. Connected-platform data is deleted within 30 days of disconnecting or closing your account.
• How to delete it: email info@nwcommercegroup.com with the subject "Delete my data", or use Settings › Privacy in the app. We confirm within 5 business days and finish within 30 days.
• If something goes wrong: we notify Amazon within 24 hours, Meta without undue delay, and you as required by law.

How to read this policy. Sections 1–5 apply to all data. Section 6 covers Amazon data only, Section 7 covers Meta data only. Sections 8–9 are the retention and deletion rules. Sections 10–11 are security and incident response.

1. Who we are and what this covers

AMOS is a software platform operated by NWCG, doing business as AMOS ("AMOS", "we", "us"), based in Bellevue, Washington, USA. Contact: info@nwcommercegroup.com.

This policy covers all information AMOS collects or processes through:

• the AMOS web app and marketing site (amos-co.com);
• connections you authorize to Amazon (Selling Partner API and Amazon Ads API) and Meta (Facebook and Instagram APIs);
• files, CSV reports and messages you upload or send in AMOS;
• services you order through AMOS that our team delivers.

It does not cover Amazon's or Meta's own handling of your data. Their policies govern that.

Definitions

2. Information we collect

We collect only what AMOS needs to run your account. Each category below names where it comes from and why.

What we do not collect

• Amazon buyer PII. AMOS does not request Amazon's restricted data roles (such as Direct-to-Consumer Shipping or Tax Invoicing). If a future feature needs them, we will update this policy first and apply the 30-day PII rule in Section 6.
• Full payment card numbers. Our payment processor handles them; we never see or store them.
• Personal Facebook or Instagram profile data beyond what Facebook Login returns (name, email, ID) if you choose that sign-in.
• Sensitive personal data such as health, biometric, or government ID information.

Personal information (PII)

AMOS holds as little personal information as possible: business contact details for you and your team, and nothing that identifies Amazon shoppers or your social media audience.

How we handle PII:

1. Minimize. We collect only the fields in the table above.
2. Strip on import. When you upload a CSV or report, AMOS detects buyer PII columns (name, address, phone, email) and removes them before anything is saved. The original file is deleted within 30 days.
3. Encrypt. PII is encrypted in transit and at rest (Section 10).
4. Restrict. Only your own team and the NWCG staff assigned to your account can see your contacts' details.
5. Keep it out of AI. We do not send names, email addresses or phone numbers to AI providers; AI requests use business and product data only.
6. Never sell or share for advertising. PII is never sold, rented, or used for cross-context advertising.
7. Delete on schedule. PII is deleted per Section 8, or sooner on request (Section 9).

California notice at collection

This table lists the categories of personal information defined by the California Consumer Privacy Act (as amended by the CPRA) and whether AMOS collects them. Sources are in the table at the top of this section; retention periods are in Section 8.

In the past 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly do so for anyone under 16.

Cookies

AMOS uses strictly necessary cookies to keep you signed in and secure. We use no advertising cookies and no third-party analytics cookies; we measure usage with first-party server logs only. You can block cookies in your browser; AMOS will not work without the necessary ones.

3. How we use information

We use your data to run your AMOS account and deliver what you ask for. Nothing else.

We use it to:

1. Show your dashboards, scorecards, benchmarks, alerts and the Action Queue.
2. Generate recommendations and drafts (listing copy, ad ideas, playbook steps) for your account.
3. Deliver services you order, by our team or our tools.
4. Communicate with you about your account, orders, billing and security.
5. Secure AMOS: detect abuse, investigate incidents, keep audit logs.
6. Improve AMOS using aggregated data or usage diagnostics that cannot identify you.
7. Meet legal, tax and accounting obligations.

We never:

• sell, rent or license your data, or any Amazon Information or Meta Platform Data;
• use your data to advertise to you on other sites, or to target anyone else;
• share one member's data with another member;
• use Amazon Information or Meta Platform Data to train, fine-tune or improve AI models (ours or a vendor's);
• use Amazon Information to compete with Amazon, contact Amazon customers, or build profiles of shoppers;
• use Meta Platform Data for surveillance, eligibility decisions (credit, housing, employment, insurance), or to build profiles of individuals;
• move connected-platform data outside AMOS except to the subprocessors listed in Section 4.

Legal basis (for users in the EU, UK and similar jurisdictions): performance of our contract with you; our legitimate interest in securing and improving AMOS; your consent for optional features and platform connections; and legal obligation. You can withdraw consent at any time by disconnecting a platform or contacting us.

4. Who we share information with

We share data only with the people and vendors needed to run AMOS, each bound by a written agreement at least as strict as this policy.

The table above is our complete current subprocessor list. We update it here at least 15 days before a new subprocessor receives connected-platform data.

We may also disclose data if required by law, subpoena or court order (we will notify you unless legally barred); to protect someone's safety or AMOS's security; or to a successor in a merger or acquisition, which must honor this policy.

Amazon and Meta data have extra limits. We never pass Amazon Information or Meta Platform Data to any party not listed above, and never to data brokers, ad networks or analytics resellers.

5. AI features and automated processing

AMOS uses AI to draft recommendations, listing copy, ad concepts and playbook guidance. A human on your team or ours reviews AI output before it changes anything in your Amazon or Meta accounts.

• Our AI providers process requests under terms that prohibit training on your data and delete inputs and outputs within 30 days, unless a request is flagged under the provider's usage policy or the law requires longer.
• We send the minimum needed for each request. Where a request is based on Amazon or Meta data, we send derived metrics and your own listing content, not raw API exports, and never names, email addresses or phone numbers.
• AMOS makes no automated decisions that have legal or similarly significant effects on any person.

6. Amazon data: our specific commitments

AMOS handles Amazon Information under Amazon's Data Protection Policy (DPP) and Acceptable Use Policy (AUP). Where this policy and Amazon's differ, the stricter rule applies.

How the connection works. You authorize AMOS through Amazon's own consent screen (Login with Amazon). We receive a refresh token, encrypted at rest, and call Amazon's APIs over TLS 1.2 or higher. You can revoke access anytime in Seller Central › Apps and Services › Manage Your Apps, or in AMOS Settings › Connections.

What we commit to:

1. Scope. We request only the API roles AMOS needs. We do not request restricted roles that return buyer PII.
2. Purpose. Amazon Information is used only to provide AMOS features to the seller who authorized it.
3. No PII retention. If Amazon PII ever reaches AMOS (for example, inside a report you upload), we delete it within 30 days of order delivery, including from backups.
4. Amazon deletion requests. We permanently delete Amazon Information within 30 days of a deletion notice from Amazon, unless law requires us to keep it.
5. Encryption. Amazon Information and credentials are encrypted at rest (AES-256) and in transit (TLS 1.2+). API keys and tokens are never stored or shown in plain text.
6. Access. Only staff with a need-to-know role can access Amazon Information. Access requires MFA, is reviewed quarterly, and is removed within 24 hours of a role change or departure.
7. Logging. We log access to Amazon Information and keep those logs for at least 90 days, protected from alteration.
8. Vulnerabilities. High-risk vulnerabilities are fixed within 30 days of discovery.
9. Key rotation. Amazon API credentials are rotated at least once a year.
10. Incidents. We report any security incident involving Amazon Information to security@amazon.com within 24 hours of detection (see Section 11).
11. No outside storage. Amazon Information stays in AMOS's production systems; it is not copied to personal devices, spreadsheets outside AMOS, or removable media.
12. Audit. We cooperate with Amazon's security assessments and keep evidence of these controls.

7. Meta data: our specific commitments

AMOS handles Meta Platform Data under Meta's Platform Terms and Developer Policies. Where this policy and Meta's differ, the stricter rule applies.

How the connection works. You connect through Meta's own login and permission screen. AMOS asks only for the permissions listed below, and you can remove AMOS anytime in Facebook Settings › Business Integrations (or Apps and Websites), or in AMOS Settings › Connections.

Edit this table to match exactly the permissions you submit for App Review. Meta rejects apps whose policy does not explain each permission requested.

What we commit to:

1. No posting or ad changes on your behalf. AMOS is read-only on Meta unless this policy is updated and you grant new permissions.
2. No sale or transfer of Meta Platform Data, including to data brokers or ad networks.
3. No profiling or surveillance of individuals, and no use for eligibility decisions.
4. No AI training on Meta Platform Data.
5. Deletion on request. We delete Meta Platform Data when you ask, when you delete your AMOS account, when you remove AMOS from Facebook, or when Meta tells us to, unless law requires us to keep it or it is aggregated so it can't identify anyone.
6. Data deletion callback. AMOS provides Meta a deletion callback (https://amos-co.com/api/meta/data-deletion) and a status page (https://amos-co.com/data-deletion/status) where you can check progress with a confirmation code (Section 9).
7. Data Use Checkup. We complete Meta's annual Data Use Checkup and any Data Protection Assessment Meta requests.
8. Security and incidents. Meta Platform Data gets the same encryption and access controls as Amazon data (Section 10). We notify Meta of any incident affecting Meta Platform Data without undue delay (Section 11).

8. How long we keep data

We keep each type of data only as long as the purpose below needs it, then delete it. "Account closure" means the date your membership ends or you ask us to close your account.

Legal holds. If a law, court order or active dispute requires us to keep specific data, we keep only that data, only for as long as required, and delete it when the hold ends.

Backups. Backups are encrypted, kept on a rolling cycle of no more than 30 days, and expire automatically. Deleted data is never restored from backup into the live service.

9. How to delete your data

You can delete your data at any time; we confirm within 5 business days and finish within 30 days.

Ways to request deletion

What happens after you ask

1. Verify. We confirm the request comes from the account owner or an authorized contact. We will not ask for more information than needed to verify.
2. Acknowledge. Within 5 business days you get an email with a reference number.
3. Revoke. We immediately revoke and destroy any Amazon or Meta access tokens.
4. Delete. Within 30 days we delete the data from live systems and subprocessors.
5. Expire backups. Remaining backup copies expire within 30 days after that and are never restored.
6. Confirm. We email you when deletion is complete, listing anything kept by law (such as invoices) and why.

Meta deletion callback

When you remove AMOS from your Facebook account and ask for your data to be deleted, Meta sends AMOS a signed request. AMOS then:

1. verifies Meta's signature;
2. starts deleting all Meta Platform Data tied to your Facebook user ID;
3. returns a status URL and confirmation code to Meta, which Meta shows to you;
4. completes deletion within 30 days; the status page at https://amos-co.com/data-deletion/status shows "Received", "In progress" or "Complete".

Amazon deletion notices

If Amazon instructs us to delete Amazon Information (for example, after you deauthorize AMOS or close your seller account), we delete it within 30 days of the notice, including backups, and keep a record that we did.

10. How we protect data

Every member's data is encrypted, isolated from other members, and reachable only by people who need it.

No system is perfectly secure. If you believe your account has been compromised, email info@nwcommercegroup.com right away.

11. If there is a security incident

We tell Amazon within 24 hours, Meta without undue delay, and affected members as fast as the law requires and usually sooner.

Incident lead: Shawn, Founder and Managing Partner, info@nwcommercegroup.com. A named backup is recorded in our internal Incident Response Plan.

Our response steps:

1. Detect and log — record time of detection and what is known.
2. Contain — revoke exposed tokens and keys, lock affected accounts, block the source.
3. Notify — per the table above.
4. Investigate — find the cause, what data was affected, and whose.
5. Fix — close the vulnerability and confirm it is closed.
6. Review — written post-incident report within 14 days; update controls and this policy if needed.

We test this plan at least once a year with a tabletop exercise.

12. Your rights

Every user can access, correct, export or delete their data, wherever they live. We respond within 30 days (45 where a state law allows, with notice).

We will not treat you differently for using these rights. An authorized agent may make a request for you with your signed permission.

13. Children

AMOS is a business tool for adults. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it.

14. International users

AMOS stores data in the United States (US East region). If you use AMOS from outside the US, your data is transferred to the US under safeguards such as the EU Standard Contractual Clauses where required.

15. Changes to this policy

We will post any change here with a new "Last updated" date. For material changes — new data types, new uses, or new permissions on Amazon or Meta — we email members at least 30 days before the change takes effect.

16. Contact us

NWCG d/b/a AMOS · 2040 128th Ave, Bellevue, WA · info@nwcommercegroup.com · Privacy lead: Shawn, Founder and Managing Partner

Last updated: October 6, 2026