Privacy Policy

1. Overview

This privacy policy explains how Ad Analyzer (“we”, “us”, “the service”) collects, processes, and protects your data. Ad Analyzer is a web-based analytics tool for Amazon Advertising performance data. We are committed to protecting your privacy and being transparent about our data practices.

2. Data Controller (Art. 4(7) GDPR)

3. Personal Data We Collect

Depending on how you use Ad Analyzer, we may collect the following personal data:

a) Account registration

• Email address (required)
• Name (optional)
• Password (stored as a hash, never in plain text)
• Preferred language
• Referral code (optional)

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) — this data is necessary to create and manage your account.

b) Guest access

If you choose “Continue as Guest”, a temporary anonymous session is created. No personal data (name, email) is collected, but a session cookie is set in your browser (see Section 9).

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) — you explicitly request access to the service.

c) Payment data

If you purchase a subscription, payment processing is handled entirely by Stripe. We store your Stripe customer ID and subscription ID to manage your subscription status. We do not store credit card numbers, bank account details, or other payment credentials.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

4. Browser-Based File Processing

When you upload an Amazon Advertising bulk file, the data is parsed and analyzed locally on your device using JavaScript. Your advertising file data is not transmitted to our servers and is discarded when you close the browser tab.

This applies to files you upload yourself. If you additionally connect your Amazon Advertising account via the API, reporting data is retrieved by our servers and stored on your behalf. See Section 6.

5. AI Analysis Feature (Optional)

Ad Analyzer offers an optional AI-powered analysis feature. When you explicitly activate this feature, aggregated campaign performance metrics (spend, sales, impressions, clicks, ACoS, etc.) are sent to our server and forwarded to the Anthropic API (Claude) for analysis.

This data is processed in real time and is not stored permanently by us or by Anthropic beyond the duration of the request. No personal identifiers are included in the API request.

If you do not use the AI analysis feature, no campaign data is sent to any external service.

Legal basis: Consent (Art. 6(1)(a) GDPR) — you actively choose to trigger the analysis.

6. Amazon Advertising API Connection (Optional)

If you choose to connect your Amazon Advertising account, authorization runs through Login with Amazon (OAuth 2.0). You authenticate directly with Amazon. We never see, receive, or store your Amazon username or password. Amazon issues us an access token and a refresh token restricted to the scopes advertising::campaign_management and profile, which is the minimum required to read your reporting data and to apply the campaign changes you explicitly confirm.

While a connection is active, we store:

• The access and refresh token issued by Amazon, encrypted at rest (see Section 7)
• Your Amazon advertising profile IDs, account labels, and marketplace region
• The status of the connection and the date it was last verified
• An audit log of connection events (authorization, token refresh, disconnect)
• Campaign performance metrics and search term reports retrieved on your behalf, stored server-side so that historical comparisons remain available across sessions

We access your Amazon Advertising account only within the scopes you authorized and only to perform the operations you request in the service. Campaign changes are submitted to Amazon exclusively after you have reviewed and confirmed them.

You can disconnect at any time from your settings page. Disconnecting deletes the stored tokens immediately and ends our access to your Amazon account. Deleting your account removes all connection data.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR). The connection is optional and is established only at your explicit request.

7. Secured Credential Storage

Access credentials for third-party services are the most sensitive data we hold. We protect them with the following measures:

• Encryption at rest. Amazon Advertising access and refresh tokens are encrypted with AES-256-GCM authenticated encryption before they are written to the database. Every record uses its own randomly generated initialization vector, and the authentication tag is stored with the record so that any tampering is detected on read.
• Record binding. Each ciphertext is cryptographically bound to the specific database row and column it belongs to. A token cannot be copied into another account record without invalidating it.
• Key management. Encryption keys are held exclusively in server-side environment variables. They are never committed to source control and are never exposed to the browser. Keys carry a version identifier, which allows us to rotate them without data loss and without requiring you to reconnect.
• No plaintext exposure. A decrypted token exists only in the memory of the server function that uses it. Plaintext credentials are never returned in an API response, never written to log files, and never included in error messages.
• Database access control. Read access to the token columns is revoked for every client-facing database role. Even an authenticated user querying their own record cannot retrieve them. Row Level Security restricts every record to its owner, and all write access is limited to a privileged server-side role that is never available to the browser.
• Account passwords. Passwords for Ad Analyzer accounts are stored only as salted hashes by our authentication provider. They are never stored in plain text and are not visible to us.
• No client-side credential storage. No access tokens, refresh tokens, or API keys are stored in your browser, in local storage, or in cookies.
• Transport security. All data transfers between your browser, our servers, and third-party APIs are encrypted in transit using TLS.
• Audit logging. Connection events are recorded in an audit log. IP addresses in this log are stored only as salted cryptographic hashes, never in plain text, and are deleted after 24 months.
• Revocation. Disconnecting an account or deleting your Ad Analyzer account erases the stored credentials.

We handle Amazon Advertising data in accordance with the Amazon Ads Data Protection Policy and the Amazon Ads Acceptable Use Policy.

8. Hosting & Server Logs

This website is hosted on Vercel. When you visit the site, Vercel's servers automatically collect standard server log information, including:

• Your IP address
• Date and time of access
• Browser type and version (user agent)
• Referring URL

This data is collected for operational purposes and is subject to Vercel's Privacy Policy.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — ensuring the security and availability of the website.

9. Cookies

We use the following cookies:

These cookies are strictly necessary for the authentication service you explicitly request when logging in or continuing as a guest. They do not track you across websites and are not used for analytics or advertising.

We also use sessionStorage (not a cookie) to remember your theme preference (light/dark mode). This data stays in your browser tab and is cleared when you close it.

Legal basis: TTDSG § 25(2) Nr. 2 — strictly necessary for the service explicitly requested by the user. No consent required.

10. Web Analytics

We use Vercel Analytics and Vercel Speed Insights to understand general usage patterns and website performance. These tools:

• Do not set cookies
• Do not use browser fingerprinting
• Do not track users across websites
• Collect anonymized page view data (URL, referrer, country, device type, browser)
• Process IP addresses server-side for geolocation but do not store them

For details, see Vercel Analytics Privacy.

Legal basis: Consent (Art. 6(1)(a) GDPR). Analytics are only loaded after you explicitly accept them via our cookie banner. You can withdraw your consent at any time by clearing your browser's local storage or using your browser's privacy settings.

11. Third-Party Services & Data Processors

We use the following third-party services to operate Ad Analyzer:

12. Data Transfers Outside the EU

Some of our service providers are based in the United States (Vercel, Supabase, Stripe, Anthropic, Amazon). Data transfers to the USA are covered by the EU-U.S. Data Privacy Framework (adequacy decision by the European Commission, July 2023) and/or Standard Contractual Clauses (SCCs) where applicable.

13. Data Retention

• Account data: Retained for as long as your account exists. You can delete your account at any time from your settings page.
• Guest session data: Temporary and discarded when the session ends.
• Payment data: Retained by Stripe according to their retention policy and legal requirements. We retain Stripe customer and subscription IDs for as long as the subscription relationship exists.
• Amazon Advertising credentials: Stored encrypted for as long as the connection is active. Deleted immediately when you disconnect or delete your account.
• Amazon Advertising connection audit log: Deleted after 24 months.
• Server logs: Managed by Vercel according to their retention policy.
• Uploaded file data: Never stored — processed in your browser only and discarded when you close the tab.

14. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access (Art. 15) — request information about data we hold about you
• Right to rectification (Art. 16) — request correction of inaccurate data
• Right to erasure (Art. 17) — request deletion of your data
• Right to restrict processing (Art. 18) — request limitation of data processing
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — object to the processing of your data

You can exercise your right to data portability and erasure directly from your settings page (export data / delete account). For all other requests, please contact us using the details below.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

15. Contact

For any privacy-related questions or to exercise your rights under GDPR, please contact:

16. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal reasons. Any changes will be posted on this page. We encourage you to review this page periodically for the latest information.

Last updated: August 2026