Privacy Policy

Last updated: October 31, 2026

This Privacy Policy describes how AS Milling & Woodworks LLC, dba RedHen Labs ("Company," "we," "our," or "us") collects, uses, stores, and protects your information when you use RedHen Labs ("Service").

By using the Service, you agree to this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

When you create an account or use the Service, we may collect:

  • Name
  • Email address
  • Billing information (processed securely by Stripe β€” we do not store credit card numbers)
  • Company information
  • Settings, preferences, and automation configurations
  • If an agency invites you, the name and email address it gives us so we can send you its invitation

1.2 Amazon Advertising Data

When you authorize RedHen Labs through the Amazon Ads API, we collect advertising-related data including:

  • Campaigns, ad groups, keywords, and targeting
  • Performance metrics (impressions, clicks, CPC, spend, ACoS, ROAS, sales, orders, etc.)
  • Search term and targeting reports
  • Bid and budget information
  • Product metadata (images, titles) from the Ads API

1.3 Amazon Selling Partner API (SP-API) Data

When you authorize RedHen Labs through the Amazon Selling Partner API, we collect seller account data including:

  • Order and sales data (order IDs, ASINs, SKUs, quantities, revenue, shipping, promotions)
  • FBA fee estimates (referral fees, fulfillment fees) via the Product Fees API
  • Product catalog information (titles, images) via the Catalog Items API
  • Review solicitation history (which orders received review requests) via the Solicitations API

We do not collect or access:

  • Your Amazon Seller Central login credentials
  • Buyer names, addresses, email addresses, phone numbers, or payment details
  • Financial settlement or disbursement data
  • Tax documents or banking information

1.4 Automatically Collected Information

We may automatically collect:

  • IP address
  • Device type and operating system
  • Browser type
  • Usage logs and error logs
  • Interaction data for debugging and performance improvement

This is standard and used for improving stability and security.

2. How We Use Your Information

We use collected information to:

  • Provide the RedHen Labs Service
  • Display dashboards, P&L calculations, and analytics
  • Run syncs with the Amazon Ads API and the Amazon Selling Partner API (SP-API)
  • Calculate per-product profitability using order data, COGS, and FBA fee estimates
  • Send review request solicitations on your behalf via the SP-API Solicitations API
  • Apply advertising automations you explicitly configure (bids, keywords, negatives)
  • Improve accuracy and insights
  • Communicate updates, alerts, and support messages
  • Process payments (via Stripe)
  • Maintain security and prevent fraud

We never sell your Amazon seller data, advertising data, or order information.

Customer Support Access

RedHen Labs is operated by a single person β€” its owner. No employees, contractors, freelancers, or outsourced support agents have access to your data, and none process it on our behalf. Support access is limited to the owner and is used on a read-only basis to:

  • Respond to support requests
  • Diagnose and troubleshoot reported issues
  • Verify correct functionality of the Service

We do not make changes to your account or your Amazon account on your behalf unless you ask us to: under Managed, our team works in your account at your request, and every change is in your History. Otherwise, if something needs changing, we tell you how to change it. The live service has no administrative interface at all β€” the admin tools used in development are not present in the production application.

This access is logged.

3. How We Share Your Information

We only share data with:

3.1 Amazon (Ads API and SP-API)

When required to sync advertising data, retrieve order and fee data, send review solicitations, or apply campaign changes you initiate.

3.2 Stripe

For secure payment processing.

We do not store or see your full credit card numbers.

3.3 Supabase

For secure encrypted storage of:

  • API tokens (Ads API and SP-API)
  • User configuration and automation settings
  • Advertising data and campaign metrics
  • Order, sales, and FBA fee data
  • Product catalog information
  • Review solicitation history
  • Application logs

3.4 Anthropic (AI Features)

When you use an AI feature β€” the AI assistant, AI recommendations, or AI-generated analysis β€” the Amazon data relevant to that request is sent to Anthropic PBC (United States) to produce the response. Depending on what you ask, that can include:

  • Campaign, ad group, keyword, and search-term names and their performance metrics
  • Spend, sales, ACoS, and profit figures, including per-product profit summaries
  • Order, refund, and fee totals used in those calculations
  • The messages you type into the assistant

Anthropic processes this data to return a response to your request and does not use it to train its models. No buyer names, addresses, email addresses, phone numbers or payment details are included, because we do not store them. If you never use an AI feature, no Amazon data is sent to Anthropic.

3.5 Legal or Compliance Requirements

We may disclose data if required to comply with:

  • Applicable law
  • Subpoenas
  • Court orders
  • Regulatory requests

3.6 Analytics and Advertising Partners (Public Website Only)

On our public marketing website β€” the pages anyone can view without logging in β€” we use third-party analytics, advertising, and session-replay services that may receive information about your visit (such as pages viewed, clicks, and device/IP data). They include Google (Analytics and Ads), Meta (Facebook) Pixel, Quora, Reddit, X (formerly Twitter), OpenAI, and Microsoft Clarity. Section 7 and our Cookie Policy list each one, what it does, and how to opt out.

In addition, when you begin checkout, start a trial, or make a purchase, our server sends conversion events to Meta through the Meta Conversions API, and to Google, to measure our advertising. These events can include a hashed (obscured) version of your email address, a hashed identifier for your RedHen Labs account, your IP address, your browser's user agent, and Meta or Google click identifiers, used only to match the conversion to an ad. This happens server-to-server and is not stopped by browser settings or the GPC signal; to opt out of this server-side sharing, email us at contact@rrw-ads.com (see Section 6).

Because these services use your information for advertising, sharing it with them may be considered a β€œsale” or β€œsharing” of personal information under California and other state laws. See β€œYour Privacy Rights” in Section 6 for how to opt out.

We never sell or rent your Amazon seller data, advertising data, or order information, and we never share that Amazon data with advertisers. The advertising sharing described above is limited to standard web and conversion identifiers (such as a hashed email and IP address) β€” not your Amazon account, order, or campaign data.

3.7 Infrastructure & Operational Providers

We rely on a small set of vendors that process data to operate the Service, each bound to use it only to provide services to us:

  • Render β€” application hosting and infrastructure (processes app traffic, including IP addresses)
  • Sentry β€” error and performance monitoring (may process IP addresses and diagnostic data)
  • Resend β€” sending transactional and marketing email (processes your name and email address)
  • Amazon Web Services (AWS) β€” receives your Amazon advertising performance data directly from Amazon Ads, and your seller notifications directly from Amazon’s Selling Partner API (hourly sales, page views and stock per product, FBA inventory changes, account-health status, Amazon fee promotions, notices that a report is ready or a transaction has posted, and order status changes, which arrive with the buyer’s postal code that we remove as we read each message and never store), and holds them, encrypted, for up to 14 days while we copy them into our database (United States)

A current list of our service providers is available on request at contact@rrw-ads.com.

3.8 People You Give Access to Your Account

You can give others access to your RedHen Labs account: our team when you sign up for Managed, or an advertising agency you choose (see Agency Accounts, section 3.2 of our Terms of Service). They see your data and make changes only inside your account, and only while your access grant is in place. Every change they make is recorded under their name in your change history. An agency has agreed to our Agency terms, which allow it to use your data only for its work for you and require it to delete anything it downloads from your account when its access ends. It never sees order-level data, or buyers' names, addresses, email addresses or phone numbers (we don't hold those), and it cannot change your billing or remove the Amazon connections you made. If an agency connects your Amazon Ads with its own Amazon Ads login, that connection uses the agency's login and ends when its access ends. You can remove anyone's access at any time in Settings, and it ends immediately.

If you sign up as an agency, we keep your team's names, work email addresses and sign-in records (including two-factor sign-in) to run your Agency account. The name of the team member who made each change appears in that client's change history, which the client can see.

4. Data Retention

We retain:

  • Advertising data, order data, and FBA fee data as long as your account is active
  • Automation and solicitation logs for internal traceability
  • API tokens (Ads API and SP-API) only while access is active
  • Billing records as legally required

When you delete your account, we delete your personal and Amazon-derived data through our account-deletion process, and disconnecting an Amazon API immediately stops new collection and disables the associated tokens. We keep billing and tax records for the period required by law (generally up to seven years) and limited security and anti-abuse logs for a reasonable period. Amazon-derived data is retained no longer than permitted by the Amazon Data Protection Policy.

5. Data Security

We use industry-standard security measures, including:

  • Encrypted HTTPS connections
  • Encrypted token storage
  • Role-based access control
  • Each account’s data kept separate, with no direct database access from a browser
  • Background monitoring and server protections

While we take every reasonable step to protect your data, no online service can guarantee absolute security.

International Data Transfers

RedHen Labs is operated from the United States, and our providers (including Supabase, Render, Stripe, and Amazon Web Services) store and process data on infrastructure located in the United States. If you access the Service from Canada, Mexico, Brazil, the European Economic Area, or elsewhere, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards for these transfers.

Data Breach Notification

If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities without undue delay and within the timelines required by applicable law.

6. Your Rights

Depending on your jurisdiction, you may have rights to:

  • Access your data
  • Request correction
  • Request deletion
  • Export your data
  • Withdraw Amazon API access
  • Close your RedHen Labs account

To exercise any of these rights, email us at contact@rrw-ads.com or use our FAQ page. We respond within the time required by applicable law (for example, within 45 days for California requests, and shorter periods where other laws apply). We may need to verify your identity before acting on a request.

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of the β€œsale” or β€œsharing” of personal information for cross-context behavioral advertising. We do not sell your information for money, and we never share your Amazon seller, advertising, or order data for advertising.

To opt out of the advertising-related β€œsale”/β€œsharing” described in Section 3.6, use the β€œDo Not Sell or Share My Personal Information” link in our website footer, or turn on the Global Privacy Control (GPC) signal in your browser β€” we treat GPC as a valid opt-out request and automatically stop the advertising and session-replay trackers on our site, and turn off Google advertising signals, for that browser. To also stop the server-side conversion sharing described in Section 3.6, email us at contact@rrw-ads.com. You may also use the opt-out links and browser controls in Section 7 and our Cookie Policy. We will not discriminate against you for exercising these rights.

Rights in Other Regions

Brazil (LGPD): you have rights of access, correction, deletion, portability, and information about how your data is processed, and you may object to processing. You can contact us or Brazil’s data protection authority (ANPD).

Canada (PIPEDA): you may access and correct your personal information and withdraw consent. Every marketing email we send includes an unsubscribe link.

Mexico (LFPDPPP): you have ARCO rights β€” access, rectification, cancellation, and objection. Request them at contact@rrw-ads.com.

EEA / UK (GDPR): where GDPR applies, you have rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with your supervisory authority.

Disconnecting Amazon API access will immediately disable RedHen Labs functionality.

7. Cookies and Tracking

Inside the logged-in RedHen Labs application, we use only the cookies needed to run the Service:

  • Authentication and session cookies (to keep you securely logged in)
  • Functional cookies that remember your settings and preferences

On our public marketing website (pages you can view without logging in), we also use third-party analytics, advertising, and session-replay technologies. None of them is loaded inside the logged-in application, with one exception: when you connect your Amazon account, Reddit receives a single signal that a connection happened, with no account details. They are also never loaded on a page whose address contains your email address or a sign-in link, and your Amazon account, advertising, and order data are never sent to these services.

  • Analytics β€” Google Analytics 4 & Google Tag Manager: measure how visitors find and use our marketing pages. Opt out with Google’s browser add-on at tools.google.com/dlpage/gaoptout.
  • Advertising β€” Google Ads, Meta (Facebook) Pixel, Quora, Reddit, X (formerly Twitter) & OpenAI: measure our ad performance and help us reach people who have visited our site (including retargeting). Manage Meta ad settings at facebook.com/adpreferences. Reddit and X describe your choices in their privacy policies at reddit.com/policies/privacy-policy and x.com/en/privacy.
  • Session replay β€” Microsoft Clarity: records session interactions (clicks, scrolling, mouse movement, and page content) and builds heatmaps so we can improve our pages. It may capture your IP address and masks text and form inputs by default. It runs only on our public marketing pages β€” never inside the logged-in application, and never on account pages such as sign-up, sign-in, and password reset β€” so it never records your Amazon account, advertising, order, or financial data. Microsoft collects this data as an independent controller, not on our behalf, and may also use it for its own purposes, including advertising. Clarity is governed by the Microsoft Privacy Statement at privacy.microsoft.com.

You can also block or delete cookies in your browser settings, though some features may not work without them. For the full category-by-category breakdown and opt-out options, see our Cookie Policy.

8. Children's Privacy

RedHen Labs is not intended for children under 18.

We do not knowingly collect information from children.

9. Changes to This Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you before they take effect (for example, by email or an in-app notice). Continued use of the Service after an update constitutes acceptance.

10. Contact Us

For questions, privacy requests, or data concerns, email us at contact@rrw-ads.com or visit our FAQ page.

Address:

AS Milling & Woodworks LLC
dba RedHen Labs
89 East Adamsdale Road
Orwigsburg, PA 17961
contact@rrw-ads.com