This policy explains what information SourceTrove (“we,” “us”) collects, how we use and protect it, and how we handle information accessed through the Amazon Selling Partner API (SP-API). It applies to our website and member application.
Summary: We only access the information needed to check your Amazon listing eligibility. We do not collect any Personally Identifiable Information (PII) about Amazon buyers, we do not sell or share your data with other organizations, and we encrypt your Amazon authorization token at rest. You can disconnect and delete your data at any time.
1. Information we collect
Account information
Your email address and a securely hashed password (we never store your password in plain text).
Subscription and billing status. Payments are processed by our payment provider (Stripe); we do not store your full card number.
Amazon Selling Partner API information
If you choose to connect your Amazon Seller account, we collect and store:
Your Amazon Seller ID and marketplace.
An SP-API authorization (refresh) token, which you grant us through Amazon’s Login with Amazon authorization flow. This token is encrypted at rest and is used only to make API calls on your behalf.
Listing eligibility results (per ASIN: eligible, needs approval, or restricted, and the reason) returned by the Amazon Listings Restrictions API.
We do not collect Amazon buyer PII. Our application uses only the Product Listing role and the Listings Restrictions API (getListingsRestrictions). We do not request, access, receive, store, or process any personal information about Amazon buyers (names, addresses, contact details, or order information).
2. How we use information
To authenticate you and provide access to your subscription.
To call the Amazon Listings Restrictions API on your behalf and show you whether your account can list a given product.
To operate, secure, and improve the service.
We use Amazon information solely to provide the eligibility feature to you, the authorizing seller. We do not use it for advertising, and we do not combine one seller’s data with another’s.
3. Information sharing
We do not sell, rent, or share your individual account data or Amazon information with other customers, partner companies, or outside organizations. We share information only with service providers that operate the product on our behalf (for example, our cloud hosting provider and our payment processor), strictly to run the service, and only as needed.
4. Data retention & deletion
You can disconnect your Amazon account at any time from within the application. When you disconnect, we delete the stored SP-API authorization token.
You may request deletion of your account and associated data by contacting us at the address below. Upon a verified request, we delete your personal data except where we must retain limited records to meet legal or accounting obligations.
We retain data only as long as needed to provide the service or as required by law.
5. How we protect information
Amazon SP-API tokens are encrypted at rest using AES-256-GCM.
All traffic is served over HTTPS/TLS. Session cookies are HTTP-only and marked Secure over HTTPS.
Access to production data is limited to authorized personnel on a need-to-know basis.
Passwords are stored using a strong one-way hashing algorithm.
6. Security incident response
We maintain a risk assessment process and an incident response plan covering monitoring, detection, and response for potential threats and security incidents. In the event of a security incident involving Amazon Information, we will notify Amazon at security@amazon.com and take steps to investigate, contain, and remediate the incident. Our plan covers response to unauthorized access, database compromise, and data leaks. We will notify affected users as required by applicable law.
7. Your choices
Connecting an Amazon account is optional; the eligibility feature simply won’t be available until you do.
You can disconnect your Amazon account or cancel your subscription at any time.
You can contact us to access or delete your personal data.
8. Not affiliated with Amazon
SourceTrove is an independent service and is not affiliated with, endorsed by, or sponsored by Amazon.com, Inc. or its affiliates. “Amazon” and related marks are trademarks of Amazon.com, Inc. or its affiliates.
9. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.