Privacy Policy

RippleEffect SARL 16 Rue Cuvier, Lyon, 69006, France SIREN: 983096462 (RCS Lyon)

For any questions about this policy or your data, contact us at legal@rippleeffect.agency.

This policy covers the data our application accesses through the Amazon Ads API when you connect your Amazon Advertising account to RippleEffect. It does not cover Amazon's own handling of your data (governed by Amazon's privacy policies) or any other RippleEffect service you engage separately.

We access your Amazon Advertising account using Login with Amazon (OAuth 2.0). When you authorize our application, Amazon issues us a secure access token tied to your account.

• We never see or store your Amazon username or password.
• Authorization is granted by you and can be revoked by you at any time (see section 10).
• Access is limited to the advertising permissions (scopes) you approve.

Through the Amazon Ads API, we may access and process advertising data from your account, including:

• Campaigns, ad groups, keywords, product targets, and ads;
• Bids, budgets, and campaign settings;
• Performance and reporting metrics (impressions, clicks, spend, sales, conversions, and related figures);
• Account-level settings and profile information;
• Billing and financial data exposed by the API, where applicable.

This data is primarily commercial and performance data about your advertising account. We only access what we need to provide advertising management services to you.

We process your advertising data to deliver the pay-per-click management services set out in our agreement with you: analysing performance, adjusting bids, budgets, keywords, and campaign structure, detecting anomalies, and reporting.

Under the EU GDPR and UK GDPR, our lawful bases are:

• Performance of a contract — to provide the services you have engaged us for; and
• Legitimate interests — to operate, secure, audit, and improve our advertising management systems, balanced against your rights.

We use your advertising data to:

• Manage and optimise your Amazon advertising campaigns;
• Generate performance reports and recommendations;
• Maintain an audit log of changes made to your account;
• Diagnose issues and improve the reliability of our management systems.

We do not sell your data, and we do not use it for advertising or profiling unrelated to managing your account.

Our advertising management systems use automated tools and artificial intelligence to analyse performance data and propose or apply changes to campaigns. Proposed changes are subject to human review and approval in line with our agreement with you. No decision producing legal or similarly significant effects on an individual is made solely by automated means.

To deliver our services we use trusted third-party providers ("sub-processors") that may process your advertising data on our behalf. These currently include:

• Amazon — the source of the advertising data;
• Anthropic (Claude) — AI processing of advertising data;
• Seller Labs — advertising data retrieval and reporting;
• Notion — change logging and record-keeping;
• Google (Drive / Sheets) — data storage and reporting;
• Vercel — hosting of our systems and this policy.

We provide an up-to-date list of sub-processors on request.

We require our sub-processors to protect your data and to process it only as needed to provide their services to us.

• Access tokens and other credentials are stored in a secure secret manager, encrypted, and never committed to shared or version-controlled files.
• Data is protected using encryption in transit and at rest and access controls limiting who can view it.
• We retain your advertising data only as long as needed to provide our services and to meet legal, audit, or record-keeping obligations, after which it is deleted or anonymised.
• On termination of our engagement, we revoke our access tokens and delete or return your data in line with our agreement.

You can withdraw our application's access to your Amazon Advertising account at any time through your Amazon account settings (Login with Amazon connected applications), or by contacting us at legal@rippleeffect.agency. Revoking access stops all further processing through the API.

Some of our sub-processors — including AI and hosting providers — may process data outside the European Economic Area and the UK (for example, in the United States). Where this happens, we rely on appropriate safeguards — such as the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement — to protect your data.

Under the EU GDPR and UK GDPR you have rights to access, correct, delete, restrict, or object to the processing of personal data we hold about you, and to data portability. To exercise these rights, contact legal@rippleeffect.agency.

You also have the right to complain to a supervisory authority. As RippleEffect is established in France, our lead authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr. Clients and individuals in the UK may also contact the Information Commissioner's Office (ICO) — ico.org.uk.

We may update this policy from time to time. The current version is always available at this URL, with the effective date shown at the top.

RippleEffect SARL 16 Rue Cuvier, Lyon, 69006, France legal@rippleeffect.agency