Privacy Policy

Who we are

agentcentral is operated by Subsecond Data, LLC (“we”, “us”, “our”). Our product gives AI agents programmatic access to Amazon seller data via MCP servers.

What we collect

• Account and agreement records — email address, account identifiers, authentication state, and privacy and versioned Terms acceptance records. Legal acceptance evidence stores HMACs rather than raw signup IP or user-agent text.
• Technical and security data — IP address, browser or device information, request and response metadata, timestamps, authentication events, rate-limit state, and security, fraud-prevention, and incident logs needed to run and protect the Service.
• Support communications — messages, diagnostic details, and attachments you send when requesting help or reporting a problem.
• Amazon OAuth tokens — access and refresh tokens issued by Amazon through its official OAuth flow, encrypted at rest. Used only to sync your seller data and, where enabled, submit Amazon API changes requested through the Service. We never store your Amazon password.
• Amazon seller data — advertising metrics, inventory levels, sales data, and related information synced from your Amazon account. Stored in account-isolated cloud storage.
• Service usage and audit data — API and MCP requests, tool names, status codes, timing, key or connection identifiers, sync history, and write-action audit records. These operational records are separate from optional website analytics.
• Optional website analytics — with your analytics choice, aggregate page views and feature usage through Vercel Analytics. Vercel Analytics does not set analytics cookies.
• Billing, email, and referral records — plan and subscription state, invoices and billing events, order measurements used for tiering, email delivery and suppression events, referral claims, eligibility outcomes, and account credits. Stripe handles card data; we do not store it.
• Marketing attribution data — with your marketing choice, ad click identifiers, UTM parameters, landing page, referral source, signup and activation events, and limited account identifiers used for advertising measurement, referral attribution, and customer-list suppression.

How we use your data

• To sync and serve your Amazon seller data to your AI agent.
• To authenticate your account and manage your subscription.
• To operate, secure, and debug the Service, including account-specific sync or API issues.
• To answer support requests and send account, security, service, and billing communications.
• To send product or promotional email where permitted, subject to the global promotional-email opt-out described below.
• To measure the effectiveness of our advertising, understand which campaigns lead to signups, account activation, or paid subscriptions, and avoid showing acquisition ads to existing accounts.

We do not sell your data. We do not use your Amazon data to train models. Your data is yours.

Product analytics and product improvement use usage data and operational metadata, not your Amazon business data. We inspect account-specific Amazon data only when needed to provide support, debug your account, operate the Service for you, or comply with law.

Promotional email choices

Cookie and website-tracking choices do not control email. Every promotional email includes an unsubscribe link, and using it applies one account-wide suppression preference to future promotional campaigns. Account, security, service, and billing messages may still be sent because they are needed to operate your account or subscription.

Amazon account access

We use Amazon’s official OAuth authorization flow when you connect Amazon Ads or Seller Central. Amazon provides tokens scoped to the permissions you approve; we do not ask for, see, or store your Amazon password.

OAuth tokens are encrypted before storage using managed encryption and are used only by agentcentral’s backend services to sync your data and perform Amazon API writes requested through the Service. We do not expose raw Amazon OAuth tokens through MCP tools, customer dashboards, or AI agent responses.

You can revoke agentcentral’s Amazon access from Amazon or request account deletion from agentcentral. Revoking access stops future syncs and Amazon API writes until you reconnect.

Data isolation

Each account’s Amazon data is isolated at the infrastructure level. Your advertising, inventory, and sales data is never mixed with other accounts’ data.

Subprocessors

We will notify you by email before adding new subprocessors.

Service providers

Separate from the subprocessors above, which handle data we process on your behalf, we use the following providers for our own operations such as billing, account records, communications, and consented marketing measurement. Advertising providers may act as independent controllers under their terms:

Legal basis for processing (GDPR)

We process your personal data under the following legal bases:

• Contract performance — processing your Amazon data is necessary to deliver the service you signed up for.
• Legitimate interest — product improvement, security monitoring, and fraud prevention.
• Consent — optional website analytics, advertising measurement, referral attribution, and customer-list suppression. You may withdraw this consent at any time through Privacy settings.

Promotional email is managed separately through the unsubscribe link in each promotional message. Depending on the message and jurisdiction, we rely on consent or legitimate interests and always apply the account-wide opt-out to future campaigns.

International data transfers

agentcentral is operated from the United States. If you are located in the European Economic Area (EEA), UK, or Switzerland, your data is transferred to the US for processing. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard these transfers.

Data retention

We retain your Amazon data while your account remains active. Canceling a paid subscription does not by itself request account deletion. You can start account deletion from the dashboard; the live tenant dataset, credentials, keys, and mutable account state are then removed through the deletion process. Limited residual copies may remain temporarily in providers' standard backup or recovery systems.

First-party marketing attribution is kept for up to 90 days unless you withdraw consent sooner. Privacy-minimized consent and legal-acceptance evidence may be retained to document your choices and agreements. Stripe invoice or tax records, pseudonymized referral-benefit records, and limited support, operator, security, or fraud-prevention records may be retained where needed for contract, legal, tax, accounting, security, or dispute purposes. Advertising providers retain data under their own published policies and applicable agreements.

Security

OAuth tokens are encrypted at rest. All data in transit uses TLS. Account data is access-controlled per account. Production access follows least-privilege controls.

Your rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your account and associated data, subject to limited lawful retention
• Restrict or object to certain processing
• Data portability (receive your data in a structured format)
• Lodge a complaint with your local data protection authority (EEA/UK residents)

Contact us at support@agentcentral.to to exercise any of these rights.

California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides additional rights:

• Categories collected — identifiers (such as email, IP address, and account or device identifiers), commercial and transaction information (including Amazon seller, billing, and referral records), internet or network activity (website, API, MCP, and security logs), and support communications.
• No sale of personal information — we do not sell personal information. When you opt into marketing measurement, we disclose limited attribution and conversion data to the providers listed above.
• Right to opt out — use Privacy settings or a Global Privacy Control signal to stop optional advertising disclosures handled by the website. Promotional email uses the separate account-wide unsubscribe link in each promotional message.
• Right to know and delete — you may request disclosure of the data we hold or request deletion.
• Non-discrimination — we will not discriminate against you for exercising your CCPA rights.

Data Processing Agreement

Our Data Processing Agreement forms part of our Terms of Service and applies whenever we process personal data on your behalf. Questions: support@agentcentral.to.

Changes

We may update this policy from time to time. Material changes will be communicated via email at least 30 days before they take effect, except where changes are required by law or to address a security incident.