Privacy Policy

Introduction

This Privacy Policy applies to WZLOT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ T/A Constellation Engineering ("we", "us", "our") and governs the collection, use, and protection of personal data in relation to our website, our services and our app Constellation Seller Copilot.

We are committed to protecting your privacy and handling personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), Polish data protection law, and applicable rules on electronic communications and cookies. This Privacy Policy should be read together with our Terms of Business.

1. Information We Collect

1.1 Information You Provide to Us

We collect and process personal data when you contact us, use our website, or engage our services, including contact information, business details, billing information, marketplace account information where authorised, API credentials or access tokens where required for delivery, technical documentation, system architecture, repository or cloud access details, sales data, performance metrics, advertising data, inventory data, product information, operational workflows, brand assets, support requests, meeting notes, and project records.

1.2 Information We Collect Automatically

When you visit our website, we may collect IP address, browser type and version, operating system, device information, pages visited, time spent, referring website addresses, and approximate location derived from technical data. We may use cookies and similar technologies to operate the website, understand usage, and improve the user experience.

1.3 Information from Third Parties

We may receive data from third-party services you authorise us to access, including Amazon Seller Central, Amazon Vendor Central, Amazon Ads, the Amazon Selling Partner API (SP-API), TikTok Shop, Shopify, advertising platforms, analytics providers, CRM tools, project management systems, communication tools, cloud hosting providers, databases, payment processors, accounting systems, and security providers.

2. Legal Basis for Processing

• Contract performance: to respond to enquiries, prepare proposals, perform service agreements, provide Constellation Seller Copilot, deliver software, provide support, and manage client relationships.
• Legitimate interests: to improve services and website functionality, maintain security and audit trails, prevent fraud or unauthorised access, develop our business, communicate with existing clients, and manage project delivery.
• Consent: for non-essential cookies, marketing communications where consent is required, and use of testimonials, case studies, or recordings where consent is required.
• Legal obligation: for tax, accounting, corporate record-keeping, responding to lawful authority requests, and compliance with applicable laws.

3. How We Use Your Information

We use personal data to provide Amazon marketplace services; review and optimise listings; support A+ Content, Brand Store and launch work; analyse and support Amazon Ads and PPC workflows; monitor Seller Central operations, catalog issues and account health; provide Constellation Seller Copilot; design, build, test, deploy, and maintain software systems; build SP-API integrations, dashboards, reporting systems, and automation workflows; provide technical support, monitoring, troubleshooting, and documentation; manage cloud infrastructure, APIs, databases, and data pipelines where agreed; provide analytics, forecasting, and technical consultancy; process invoices and payments; manage client relationships; communicate about service updates, security matters, and support issues; maintain internal records; and send marketing communications where permitted.

4. Data Sharing and Disclosure

We may share personal data with cloud hosting providers such as AWS or similar infrastructure providers, email and communication platforms, CRM and project management systems, payment processors, accountants, professional advisers, analytics and monitoring providers, logging and security providers, contractors or technical specialists, Amazon services, TikTok Shop, Shopify, and other platforms you authorise us to work with.

We require third parties to respect the security of personal data and process it in accordance with applicable law and contractual safeguards where required. We do not sell personal data or Amazon Selling Partner data.

5. International Data Transfers

We primarily process data within the European Economic Area. Where personal data is transferred outside the EEA, we use appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, data processing agreements, or other lawful transfer mechanisms.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, contractual, and legitimate business purposes. Active client data is retained for the duration of the business relationship and normally up to 6 years afterwards where needed for claims, audit, or contractual records. Prospective client data is normally retained up to 3 years from last contact unless you request deletion earlier. Financial and tax records are retained for the period required by applicable tax and accounting law. Marketing data is retained until you unsubscribe, withdraw consent, or object where applicable. Access credentials are retained only for as long as required to provide the services, unless a longer period is agreed or legally required.

For Amazon-related work, Amazon personally identifiable information (PII) and customer-level exports are avoided unless required for the agreed service. Where Amazon PII is required, it is deleted or de-identified within 30 days after the delivery purpose ends unless legal or contractual retention is required. Non-PII operational records, workflow notes and reporting history may be retained for up to 18 months unless a shorter client retention period is agreed. Retention for Constellation Seller Copilot is described in section 10.

7. Your Data Protection Rights

Under GDPR, you may have the right of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is based on consent. To exercise any of these rights, contact us at info@constellationengineering.io.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or with another competent data protection authority.

8. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit our website. We may use strictly necessary cookies, performance or analytics cookies, functionality cookies, and targeting or marketing cookies. You can control and delete cookies through your browser settings. Where required by law, we will request consent before using non-essential cookies.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data, including SSL/TLS encryption in transit, encryption of credentials and access tokens at rest, secure authentication with multi-factor authentication for staff, least-privilege access controls, security updates, monitoring and logging, confidentiality obligations, secure handling of client credentials and technical secrets, and incident response procedures.

10. Amazon Selling Partner Data and Constellation Seller Copilot

Where a selling partner authorises us to access Seller Central, Amazon Ads, the SP-API, Vendor Central, or related Amazon systems, we use that access only to provide the agreed services, such as listing optimisation, Amazon Ads and PPC support, catalog and account health support, Seller Central operational workflows, integrations, reporting, monitoring, automation, troubleshooting, and support. We do not sell Amazon Selling Partner data, use it for unrelated marketing, or share it with unauthorised third parties.

10.1 What Seller Copilot accesses

When you authorise Constellation Seller Copilot in Seller Central, the app accesses only the SP-API areas needed for its features: seller performance and account health, listings and catalog, pricing, orders and sales metrics without buyer personal data, FBA and AWD inventory, finances and fees, and, for brand owners, Brand Analytics. The app does not request Amazon's restricted roles and does not access buyer names, addresses, phone numbers or emails.

10.2 How it is used

Amazon data is used only to show you information about your own account, to send you account health alerts, and to make changes to your listings, prices or shipments that you have explicitly confirmed. Brand Analytics data is used only for the brand owner who authorised the app. We do not combine data across sellers, use it to build products for other sellers, or use it to train AI models.

10.3 Your AI assistant

Seller Copilot works with an AI assistant that you choose and connect, such as Claude or ChatGPT. When you ask a question, the assistant receives the Amazon data needed to answer it under your own account with that provider, and its handling of that data is governed by your agreement with that provider. We recommend disabling model training in your assistant's settings.

10.4 Storage and protection

Seller Copilot data is stored on Amazon Web Services in the European Union. Access tokens are encrypted at rest, all connections use TLS, each user connects with a personal key, and every request to Amazon is logged with the user and time, without storing request contents in the log. Staff access is limited to the people who support your account and uses individual accounts with multi-factor authentication.

10.5 Retention and deletion

We keep Seller Copilot data only as long as needed to provide the service to you. Request logs are kept for 90 days. When you revoke the app in Seller Central or ask us to disconnect your account, we stop all access and delete your Amazon data and tokens within 30 days, unless a longer period is required by law.

10.6 Security incidents

Suspected security incidents are triaged immediately, contained, documented, and reported to affected clients and to Amazon at security@amazon.com within 24 hours of detection, as required by Amazon's Data Protection Policy.

Clients may request access review, correction, deletion, offboarding, or privacy support by contacting info@constellationengineering.io.

11. Contact Us

We aim to respond to privacy enquiries within 5 business days and to formal data subject requests within the period required by applicable law.