Amazon API Use Policy

1. Purpose of API Access

RedHen Labs connects to the Amazon Advertising API and the Selling Partner API (SP-API) to allow users to:

Amazon Advertising API:

• Retrieve advertising campaign, keyword, and performance metrics
• Retrieve product metadata (images, titles) for campaign management
• Generate dashboards and analytics
• Automate bidding, keyword harvesting, and negative keyword management
• Provide performance insights and optimization suggestions

Selling Partner API (SP-API):

• Retrieve order and sales data via the Reports API for P&L calculations
• Retrieve FBA fee estimates via the Product Fees API for profitability tracking
• Send review request solicitations via the Solicitations API based on user-configured settings

We do not use Amazon API data for advertising to consumers, retargeting, profiling, or third-party marketing.

All data is used only to support the seller who owns that data.

2. User Authorization & Access Control

We obtain access to Amazon data only after the user explicitly authorizes each connection:

Amazon Advertising API:

1. User logs into their Amazon Advertising account
2. Grants authorization through Amazon's OAuth flow
3. Approves the specific advertising permissions required by RedHen Labs

In an account an advertising agency set up for its client, the agency may connect Amazon Ads with its own Amazon Ads login instead, only where Amazon already lets that login manage the seller’s advertising; only that seller’s advertising accounts are kept in their account.

Selling Partner API (SP-API):

1. User initiates SP-API authorization from within RedHen Labs
2. Grants authorization through Amazon's OAuth consent flow
3. Approves the specific SP-API roles and data access permissions

RedHen Labs staff open a customer’s account only to provide support or fix a problem with the service, or, under Managed, to run the account at the customer’s request. Each such access is recorded.

API access for both connections is controlled strictly by Amazon-issued tokens. The user can revoke the Selling Partner API at any time in Amazon Seller Central, and Amazon Ads in their Amazon account’s security settings or by disconnecting it in RedHen Labs. A connection an agency made with its own Amazon Ads login ends when the account owner removes the agency in Settings.

We do not store Amazon login credentials.

3. Data Storage & Retention

RedHen Labs stores a limited subset of Amazon data necessary for analytics, profitability calculations, and automation:

From the Advertising API:

• Campaigns, ad groups, keywords, and targets
• Search term reports
• Performance metrics (impressions, clicks, spend, etc.)
• Product metadata (images, titles)

From the Selling Partner API:

• Order and sales data (order IDs, ASINs, SKUs, quantities, revenue, shipping, promotions)
• FBA fee estimates (referral fees, fulfillment fees)
• Review solicitation history (which orders received review requests)

We do not store buyer names, addresses, email addresses, phone numbers, or payment details.

Retention Period:

• Performance data, order data, and fee data are retained only as long as needed for user reports, P&L calculations, or automation
• Users may request full deletion at any time
• When a user revokes authorization for either API, access immediately stops and the associated tokens are disabled. Stored Amazon data is deleted when you delete your account or request deletion, and in any case is retained no longer than the Amazon Data Protection Policy permits

4. Data Sharing & Third-Party Access

RedHen Labs does not:

• Sell user data
• Use user data to build competitive intelligence
• Combine data between different users
• Share Amazon Advertising or SP-API data with anyone other than the service providers named below, who process it solely to operate this service, and the people an account owner chooses to give access to their account

Service providers who process Amazon data on our behalf:

• Anthropic PBC (United States) — when you use AI features, the advertising and sales figures relevant to your request (for example campaign names, keyword performance, and profit summaries) are sent to Anthropic’s API to generate the analysis or recommendation you asked for. Anthropic processes this data to return a response and does not use it to train its models.
• Supabase (United States) — database hosting, where your Amazon data is stored
• Render (United States) — application hosting

Each provider is bound by contract to use the data only to provide services to us. No provider receives buyer names, addresses, email addresses, phone numbers, or payment details, because we do not store them.

People an account owner gives access to:

An account owner can give others access to their RedHen Labs account, such as our team under Managed, or an advertising agency of their choosing (Agency, Terms of Service section 3.2). They work only inside that owner’s account, and only while the owner’s grant is in place. The owner can remove it at any time, and the removal takes effect immediately. They never see order-level data, or buyers’ names, addresses, email addresses or phone numbers, which we do not store, and every change they make is recorded under their own name in the owner’s History. An agency has agreed to our Agency terms, which bind it to data rules at least as strict as ours, limit its use of the data to its work for that owner, and require it to delete anything it downloads when its access ends. Agencies never see order-level data, and nothing is combined across the accounts an agency works in.

Each customer’s data is kept separate: every request is limited to the account it acts for, and our database cannot be reached directly from a browser.

Only the account owner, and the people they give access to, may view data associated with their account.

5. Security Practices

We follow industry-standard security protocols, including:

• Encrypted storage (at rest and in transit)
• Access control and token scoping
• Regular auditing of security policies
• Account-level data isolation, with no direct database access from browsers
• No exposure of API keys in client-side code
• Secure OAuth authorization through Amazon

We do not store Amazon API secret keys in any publicly accessible environment.

6. Prohibited Uses (Strictly Enforced)

RedHen Labs does not use Amazon API data (from either the Ads API or SP-API) for:

• Creating shopper or buyer profiles
• Retargeting or behavioral advertising
• Cross-customer data aggregation
• Any marketing unrelated to the seller's own account
• Reselling or redistributing Amazon data
• Surveilling competitor accounts
• Deriving insights about Amazon customers or buyers
• Contacting buyers outside of Amazon's official solicitation mechanisms

We use the APIs only to support seller-owned account optimization and profitability tracking.

7. User Control & Revocation

Users may:

• Disconnect RedHen Labs from Amazon Ads API and/or SP-API at any time
• Delete their account and all related data
• Request immediate data deletion

When authorization is revoked for either API:

• API calls for that connection immediately cease
• Tokens are invalidated
• Stored data derived from that API is deleted when you delete your account or request deletion, and is retained no longer than the Amazon Data Protection Policy permits

8. Compliance and Monitoring

RedHen Labs monitors changes to Amazon Advertising API policies and SP-API Acceptable Use Policies, and updates our system to maintain full compliance with both.

We agree to:

• Provide information to Amazon on request
• Undergo API compliance audits if required
• Immediately remove any noncompliant functionality

9. Contact Information

For compliance inquiries, email us at contact@rrw-ads.com or visit our FAQ page.

AS Milling & Woodworks LLC
dba RedHen Labs
89 East Adamsdale Road
Orwigsburg, PA 17961
contact@rrw-ads.com