About Zone and this policy
Zonster LLC, a Wyoming limited liability company (“Zonster,” “we,” “us” or “our”) operates Zone (“Zone by Zonster”), an Amazon seller analytics and advertising management tool. Zone is now an internal tool used to run Zonster’s own Amazon businesses; it no longer accepts new sign-ups. Zone’s features now run inside Zonster’s private operations platform, and this policy continues to apply to all data Zone has accessed.
This policy explains how we collect, use, store and protect information obtained through Amazon’s Selling Partner API (SP-API) and Amazon Ads API, and the choices available to anyone who connected an account to Zone.
Information we collect
Account information
For people who registered for Zone, we hold their name, email address and password. Passwords are stored only as a secure hash, never in plain text.
Amazon API data
With the account owner’s explicit authorization, Zone accesses the following data from Amazon’s APIs:
- Advertising data: campaigns, ad groups, keywords, targets, bids, budgets, search terms and performance metrics
- Order data: order IDs, order status, revenue and units sold
- Inventory data: ASIN-level stock levels and inventory health
- Product catalog data: ASINs, titles, categories and listing content
- Financial data: fees, refunds and settlements
- Sales and traffic reports
This data is accessed solely to provide Zone’s analytics and management features.
Usage data
We keep standard server and security logs, including IP addresses, browser type, pages visited and timestamps, for security and performance monitoring.
OAuth credentials
We store the OAuth refresh tokens Amazon issues to maintain an authorized connection. These tokens are encrypted at rest with AES-256 encryption and are never shared with third parties.
How we use information
We use the information we collect only to:
- provide and operate Zone’s features;
- display Amazon advertising and sales analytics;
- carry out bid adjustments and campaign changes that the account owner authorizes;
- generate performance reports and insights;
- authenticate users and maintain account security;
- respond to support requests; and
- comply with legal obligations.
We do not use Amazon data to train machine-learning models, we do not sell it, and we do not use it for any purpose beyond operating the features the account owner requested.
Amazon API data use and compliance
Our use of the SP-API and Amazon Ads API is governed by Amazon’s developer agreements, Acceptable Use Policy and Data Protection Policy. Specifically:
- We request only the minimum API permissions needed to provide the service.
- We do not request Amazon’s restricted roles for buyer personally identifiable information.
- We do not share, sell or transfer Amazon data to any third party, except service providers that host it for us.
- We do not use Amazon data for any purpose other than providing Zone’s features to the account owner.
- We would report any security incident involving Amazon data to Amazon within 24 hours of detecting it, as the Data Protection Policy requires.
- We keep Amazon data only while the connection is active or as required by law (see Data retention).
Data storage and security
- Data is stored in a secured PostgreSQL database hosted by Supabase in the United States.
- OAuth tokens and other credentials are encrypted at rest with AES-256 and kept in an encrypted vault.
- All data in transit is encrypted with TLS 1.2 or higher.
- Access to production systems is restricted to authorized personnel, protected by multi-factor authentication and a zero-trust access gateway.
- We keep audit logs of API access, credential changes and every change made to an advertising account.
- Rate limits protect every endpoint against abuse.
Data retention
We keep account data and Amazon API data for as long as the Amazon connection is active. When an account owner revokes access or asks us to delete their data, we delete or anonymize their personal data and Amazon data within 30 days, except where applicable law requires us to keep specific records. Deleted data may remain in encrypted backups until those backups expire on their regular schedule.
Your rights and data deletion
You can:
- Access the data we hold about you;
- Correct inaccurate data;
- Delete your account and all associated data;
- Revoke Zone’s access to your Amazon account at any time: in Seller Central under Apps and Services → Manage Your Apps, and for advertising, by removing Zone’s authorization in your Amazon Ads account; and
- Export your data in a machine-readable format.
To make any of these requests, email info@zonster.com from the address associated with your account. We confirm each request and complete deletions within 30 days.
Agency access
Zone previously offered an agency mode that let an authorized agency manage a seller’s account. New agency invitations are no longer accepted. For any agency relationship that existed:
- Consent: agency access required the account holder’s explicit consent, recorded with its date, time and IP address.
- Credentials: Amazon credentials were never shared with agencies; agency actions ran through Zone using the stored, encrypted tokens.
- Audit logging: every agency action was logged with the agency user, the action, the resource affected and the time, and those logs are kept for compliance and dispute resolution.
- Revocation: account holders can end any remaining agency access immediately by emailing info@zonster.com.
Children's privacy
Zone is not directed at anyone under 18, and we do not knowingly collect personal information from minors. If you believe we have collected such information, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. We will post changes on this page and update the “Last updated” date, and we will notify affected account holders by email of any material change.
Contact us
For questions about this policy or our data practices, contact:
Zonster LLC
Email: info@zonster.com
Website: zonster.com