Privacy Policy

This Privacy Policy describes how Sellco.ai (“Sellco,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects information when you visit https://sellco.ai, use https://app.sellco.ai, connect the Sellco MCP server at https://mcp.sellco.ai/amazon, or otherwise use our software and related services (together, the “Services”).

Sellco.ai is an analytics and automation platform for Amazon sellers, vendors, advertisers, brands, and agencies. It is operated by Algorithm Trix Private Limited (algorithmtrix.com), an Indian private limited company (CIN U62099DC2026PTC471133), registered in New Delhi.

If you have questions about this policy or want to make a privacy request, email [email protected].

This policy covers information processed through:

• the public website at sellco.ai, including contact, tools, and content pages;
• the Sellco application at app.sellco.ai;
• the Sellco backend at backend.sellco.ai;
• Amazon account connections authorized by you;
• the Sellco remote MCP server used by ChatGPT and other MCP clients;
• billing, support, and related operational systems used to provide the Services.

It does not control how Amazon, OpenAI/ChatGPT, Razorpay, or other independent platforms use information under their own policies. Those providers process information according to their terms when you use their services.

We collect information that you provide, information created when you use the Services, and information retrieved from Amazon and other providers after you authorize a connection. We do not collect a category unless it is needed for the corresponding feature.

Payment cards. Sellco does not collect or store full card numbers or CVV. Card payments are processed by Razorpay. Sellco receives payment/subscription identifiers, amount, currency, status, and related invoice records.

Passwords and secrets. Sellco account passwords are collected only through the Sellco registration/login screens. Amazon passwords, Amazon OTPs, Amazon API keys, OAuth client secrets, access tokens, refresh tokens, AWS credentials, and database credentials are not requested in ChatGPT prompts. Amazon authorization uses Amazon’s own consent screens.

Some features require you to connect Amazon accounts that you control. You do this inside the Sellco app, not by typing Amazon passwords into ChatGPT.

How Amazon authorization works

After you sign in to Sellco, the app can send you to Amazon to grant access:

• Amazon Ads: Login with Amazon using scope advertising::campaign_management. Amazon returns an authorization code to https://app.sellco.ai/auth_flow. Sellco sends that code to /amazon/auth to complete the connection.
• Seller Central / SP-API: Amazon Seller Central consent for Sellco’s SP-API application. Amazon returns spapi_oauth_code, state=seller, and selling_partner_id. Sellco sends these to /amazon/sp/auth.
• Vendor Central: the same SP-API application consent flow with state=vendor.

Sellco stores the resulting server-side authorization tokens to call Amazon APIs on your behalf. Those tokens are not displayed in the dashboard and are not intended to be returned through MCP.

Amazon Data we process after authorization

Depending on which connections you enable, Sellco processes Amazon business data needed to operate dashboards, reports, automation, and authenticated MCP tools. That includes advertising campaign structure and performance, seller sales/inventory/listing metrics, vendor operational metrics, marketplace and profile identifiers, and derived KPIs such as ACOS, ROAS, CTR, CPC, and AOV.

Amazon customer / buyer personal information. Sellco is built around seller, vendor, and advertiser business metrics. We do not ask you to upload Amazon buyer names, emails, phone numbers, or shipping addresses. We do not use Amazon Data to market to Amazon shoppers. If a restricted Amazon API returns buyer information because of roles granted during Amazon authorization, we process it only to provide the Services you requested and apply the Amazon Data restrictions in Section 9.

Amazon Marketing Cloud, where enabled, is used for aggregated audience and measurement analysis. Sellco does not claim that AMC outputs identify individual Amazon customers.

DSP campaign buying is described on the public website as coming soon. The MCP server does expose one DSP read tool, dsp_audience_search, which searches DSP audiences by name, category, subcategory, or audience ID for accounts that have that data.

Sellco publishes a remote Model Context Protocol server at https://mcp.sellco.ai/amazon. You may voluntarily connect that server to ChatGPT or another MCP-compatible client.

Intended ChatGPT connection flow

1. You create and sign in to a Sellco account at app.sellco.ai.
2. You connect the Amazon Ads, Seller, and/or Vendor accounts you want Sellco to use, using Amazon’s authorization screens.
3. You connect ChatGPT (or another MCP client) to Sellco and complete Sellco’s OAuth authorization. The MCP server advertises OAuth 2.0/2.1 with authorization-code + PKCE, refresh tokens, and scope sellco. Dynamic client registration is supported at https://mcp.sellco.ai/oauth/register.
4. ChatGPT may invoke a Sellco MCP tool in response to your request.
5. Sellco receives only the parameters needed to run that authorized tool.
6. Sellco retrieves data belonging to the authenticated Sellco account and its authorized Amazon connections. Tenant authorization is applied to MCP requests so one customer’s Amazon information is not exposed to another customer.
7. Sellco returns the information needed to satisfy the request. That output is transmitted to ChatGPT/OpenAI as part of the interaction you requested.

OpenAI is a recipient of information that you explicitly ask to be retrieved through ChatGPT. This policy does not claim that OpenAI is an Amazon-approved data processor. Amazon Data leaves Sellco and is sent to OpenAI because you connected ChatGPT and asked it to call Sellco tools.

MCP inputs

Tool inputs are the parameters required to run the requested report or action. Typical inputs include date ranges, marketplace or region, account/profile identifiers already associated with your Sellco user, campaign or ASIN filters, metric selections, and pagination/limit values. MCP initialize/tool-list calls to the public server require a bearer access token; unauthenticated clients receive HTTP 401.

MCP outputs

Outputs are the Sellco/Amazon business records needed to answer the request. Depending on the tool family, that may include:

• account, seller/vendor, marketplace, and advertising profile identifiers;
• campaign, ad group, keyword, target, placement, and search-term records;
• impressions, clicks, spend, sales, orders, ROAS, ACOS, CTR, CPC, AOV, and related KPIs;
• ASIN/SKU performance, inventory and revenue snapshots, dayparting heatmaps;
• timestamps and result windows;
• in-app AI conversation metadata if you use those tools.

Sellco does not intentionally send authentication secrets to ChatGPT, including passwords, OTPs, API secrets, OAuth client secrets, access tokens, refresh tokens, AWS credentials, database credentials, or encryption keys.

Do not paste credentials into ChatGPT

You should not type Amazon passwords, Amazon OTPs, Amazon API keys, or other authentication secrets into ChatGPT. Amazon account linking is performed in the Sellco app through Amazon OAuth.

The MCP server still registers Sellco-account tools named sellco_login, sellco_admin_login, sellco_verify_otp, sellco_resend_otp, and sellco_set_token. Those tools accept Sellco email/password, a Sellco email OTP, or a Sellco JWT — not Amazon credentials. They exist so some MCP clients can authenticate in chat. ChatGPT connections should use the OAuth consent flow described above rather than sending passwords, OTPs, or JWTs in prompts. After OAuth, ChatGPT calls data tools with the bearer token; it does not need the password tools.

Current public MCP tools

The production MCP server registers the tools below. Read-only advertising tables are exposed; campaign mutation endpoints (mark negative, update bid, update state) are not wrapped. Tool outputs are the JSON returned by the corresponding Sellco backend endpoint for the authenticated account. Access tokens are stripped from sellco_verify_otp responses and stored only in the MCP session.

Personal/user data that can appear in MCP outputs includes Sellco profile fields from sellco_get_profile, account and brand names, advertising profile IDs, selling partner IDs, and message content from Sellco AI conversations. Amazon buyer names, emails, and shipping addresses are not requested as MCP inputs. Authentication secrets are not intended to be returned; however, sellco_login / sellco_admin_login accept Sellco passwords as inputs, sellco_verify_otp accepts email OTPs, and sellco_set_token accepts a JWT. ChatGPT users should prefer OAuth so those credential tools are not used.

We use information only for the purposes below.

We do not use Amazon Data for independent data-brokerage or to sell advertising to unrelated third parties.

Sellco uses several distinct AI/automation paths:

• Sellco analytics and automation. Rules, dayparting, bid/budget workflows, and calculated KPIs run on Amazon Data you authorized. These are product features, not a public AI model.
• In-app Sellco AI. The app can send conversation content and analysis requests to /ai/conversations and /ai/analyze so you can ask questions about your connected data.
• Website tools. Public listing, keyword, compliance, review-response, and PPC-advisor tools may send the text you paste (title, bullets, review text, bids, ACOS, and similar inputs) to OpenAI’s API (currently gpt-4o-mini) to generate suggestions.
• ChatGPT MCP. When you connect ChatGPT, OpenAI receives the tool inputs and outputs for the interaction you requested.

Sellco does not use customer Amazon Data to train a public general-purpose AI model of our own. When you use ChatGPT or a website tool that calls OpenAI, OpenAI processes that interaction under OpenAI’s terms. We do not grant OpenAI a separate right to train on your Amazon Data except to the extent that happens because you asked ChatGPT or an OpenAI-backed tool to process it.

AI output can be incomplete or wrong. It is informational and is not a guarantee of sales, ranking, or advertising performance.

We share information with the categories of recipients below, and only for the stated reasons. We do not sell Amazon Data. We do not rent Amazon Data. We do not publish customers’ private Amazon Data. We do not disclose Amazon Data to unauthorized third parties.

Service providers are used to operate the Services, not to buy or resell your Amazon Data.

Sellco treats Amazon Data as confidential business data belonging to the authorizing Amazon account owner. In practice:

• Access is limited to Amazon APIs and roles you authorize.
• We retrieve Amazon Data to provide the Services you use, not for unrelated commercial exploitation.
• MCP and API requests are scoped to the authenticated Sellco tenant.
• Employees and service providers receive access only as needed to operate, secure, or support the Services.
• Amazon authorization tokens are stored server-side for API use and are not intended to be returned through MCP or ChatGPT.
• You may revoke Amazon access in Amazon’s consoles and by asking us to disconnect the integration.
• We do not sell, rent, or publicly post private Amazon Data.

These statements describe Sellco’s product and observed implementation. They are not a copy of Amazon’s legal terms. Your Amazon use remains subject to Amazon’s agreements.

We keep information only while it is needed for the purposes in this policy, then delete or de-identify it, unless a longer period is required for security, billing, tax, dispute, or legal reasons.

Disconnecting an integration stops future access. It does not always delete information we are legally or operationally required to keep, such as invoices or security records.

We use administrative and technical controls appropriate to a multi-tenant SaaS product. No system is perfectly secure, and we do not guarantee that information cannot be accessed, disclosed, altered, or destroyed.

Controls currently used in production include:

• HTTPS/TLS for sellco.ai, app.sellco.ai, backend.sellco.ai, and mcp.sellco.ai;
• Amazon authorization through Amazon’s OAuth/consent screens rather than collecting Amazon passwords;
• Sellco login with password plus email OTP;
• MCP resource protection with bearer tokens and OAuth PKCE;
• account/tenant scoping so MCP and dashboard requests run as the signed-in customer;
• role-based controls in the app (for example, only an owner can purchase or upgrade a subscription);
• server-side storage of Amazon authorization codes/tokens after callback;
• Cloudflare in front of the app and MCP endpoints.

Access tokens issued after login are stored in the browser’s localStorage to keep you signed in. Protect the device you use to access Sellco.

You can:

• Access and correct profile fields (name, phone, bio, billing country before first purchase) in Profile. Email cannot be changed in-product; contact us to correct it.
• Update billing details (legal name, address, PIN code, GSTIN) in the billing section of the app.
• Change password from the profile password page, or use forgot-password.
• Manage Amazon connections by completing or skipping Ads, Seller, and Vendor steps in onboarding, and by revoking Sellco in Amazon Ads, Seller Central, or Vendor Central.
• Disconnect ChatGPT / MCP in ChatGPT plugin/app settings and by revoking the Sellco OAuth grant. That stops future tool calls.
• Opt out of marketing emails using the unsubscribe link in those emails, or by emailing us. Service/billing messages may still be sent.
• Request access, correction, or deletion by emailing [email protected].

The public website currently loads analytics and advertising pixels without a separate cookie banner. You can block or delete cookies in your browser, use browser tracking-prevention settings, and use industry opt-outs for advertising cookies where available.

Amazon

Revoke Sellco in the Amazon console you used to connect (Login with Amazon / Amazon Ads, Seller Central app authorization, or Vendor Central app authorization). Then email [email protected] and ask us to disconnect the Amazon account inside Sellco. Revocation stops future Amazon API access. Historical reports already generated may remain until account deletion or an explicit deletion request, subject to Section 10.

ChatGPT / MCP

Remove or disconnect the Sellco MCP server/plugin in ChatGPT (or your other MCP client) and revoke the OAuth authorization. Sellco will no longer accept new MCP tool calls for that grant. OpenAI may still retain chat history under OpenAI’s policy. Disconnecting MCP does not delete your Sellco account or Amazon connections.

To delete your Sellco account, email [email protected] from the registered email address and request deletion. We may need to verify that you are authorized to make the request.

When we complete deletion we:

• disable login and MCP access for that account;
• invalidate Sellco sessions and MCP OAuth grants we control;
• delete or invalidate Amazon authorization tokens we hold;
• delete or de-identify Amazon analytics stored for the account, typically within 30 days, except billing, tax, and security records we must keep;
• stop future marketing messages to that account email.

We cannot delete copies that remain in Amazon’s systems, in ChatGPT/OpenAI history, or in backups until those backups expire.

sellco.ai and app.sellco.ai currently use:

You can refuse or delete non-essential cookies in your browser. If you disable necessary storage, sign-in and some app features will not work.

Sellco is operated from India by Algorithm Trix Private Limited and used by customers in multiple countries, including the United States, United Kingdom, European Economic Area, and other Amazon marketplaces we support. Information may be processed in India and in other countries where our infrastructure or service providers operate, including the United States (for example OpenAI, Google, Meta, Microsoft, Cloudflare, and Amazon APIs).

Those countries may have different data-protection laws than your home country. We transfer information to provide the Services you requested and to use the providers listed in this policy.

Depending on where you reside, you may have rights to access, correct, delete, or obtain a copy of personal information, to withdraw consent, to object to or restrict certain processing, to appeal a denial, or to lodge a complaint with a regulator. These rights are not identical in every country.

• EEA/UK: you may have rights under GDPR / UK GDPR, including access, rectification, erasure, restriction, objection, and portability, subject to legal exceptions.
• United States: depending on your state, you may have rights to know, access, delete, correct, or opt out of certain sales/sharing of personal information. Sellco does not sell personal information or Amazon Data.
• India: depending on applicable law, including the Digital Personal Data Protection framework, you may have rights to access, correct, erase, and withdraw consent, subject to legal exceptions.

To exercise a right, email [email protected]. We will respond according to the law that applies to your request. We may ask for information needed to verify your identity and authority.

This policy describes our practices. It does not claim that Sellco is certified under GDPR, SOC 2, ISO 27001, CCPA, or DPDP.

Sellco is a business SaaS product for Amazon sellers, vendors, and advertisers. It is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it. If you believe a child has provided personal information, email [email protected].

The Services link to or run on third-party platforms, including Amazon, ChatGPT/OpenAI, Razorpay, Cloudflare, Google, Meta, Microsoft, and WhatsApp. Those services have their own privacy policies. This policy applies only to information Sellco controls.

Public website tools may fetch publicly available Amazon product-page content (such as title, bullets, image, rating, and BSR) when you enter an ASIN. That is public listing information, not a connection to your Seller Central account.

We may update this policy as the product, integrations, or laws change. We will post the updated policy at https://sellco.ai/privacy-policy and change the “Last updated” date. If a change is material, we will provide additional notice when required, such as in-product or by email. Continued use after the effective date means you accept the updated policy.

For privacy requests, deletion requests, questions, suspected misuse of Amazon Data, or security vulnerability reports, contact:

Marketing inquiries may also be sent to [email protected].