Privacy Policy

We treat your Personal Data and your Amazon Business Data with strict confidentiality. Your business KPIs (orders, sales, settlements, supplier costs, leads) are used exclusively to operate and improve 3P Mercury. We do not sell Business Data. We may use de‑identified aggregates to enhance features and reliability.

1) Key Promises About Your Business Data

Strict Confidentiality: Business Data is used solely to provide and improve the Services.
No Sale of Business Data: We do not sell, rent, or license Business Data.
Aggregated Insights: We may use de‑identified aggregates for product improvement without identifying you.

2) Definitions

Personal Data means information relating to an identified or identifiable natural person (e.g., name, email, IP). Business Data means data about your commerce operations, including Amazon orders, sales, settlements, refunds, purchase orders, supplier details, and leads. Controller is the entity determining purposes and means of processing Personal Data: 3P Mercury, LLC 789 East Bamberger Drive Suite D American Fork, UT, 84003. Processor is any third party processing data on our behalf. Processing covers collection, storage, use, disclosure, deletion. Profiling is automated evaluation of personal aspects. Pseudonymization prevents attribution without separately held information.

3) What We Collect

A. You Provide

Account data (name, email, phone), billing details, settings, support messages, and uploaded files/lists/POs.

B. Automatically

IP, device/browser/OS, referrer, pages viewed, timestamps, session IDs, and error logs; cookie identifiers for authentication, preferences, analytics, and fraud prevention.

C. Integrations (e.g., Amazon SP‑API)

Orders, SKUs, ASINs, prices, fees/commissions, settlements, refunds, inventory, supplier info, lead lists, and profitability metrics. We adhere to Amazon’s Data Protection Policy; we do not intentionally collect Amazon buyer PII beyond what you authorize.

4) Why We Process Data (Purposes)

Provide, maintain, and improve the Services (dashboards, KPIs, analytics, alerts).
Authenticate users; secure accounts; prevent fraud/abuse.
Handle subscriptions, payments, and invoicing.
Provide support, training, and service communications.
Comply with laws and platform rules (e.g., Amazon), and enforce Terms.
With consent, send marketing or product updates (opt‑out anytime).

5) Legal Bases (GDPR/UK GDPR & Similar)

Contractual necessity (Art. 6(1)(b))
Consent (Art. 6(1)(a))
Legal obligation (Art. 6(1)(c))
Legitimate interests (Art. 6(1)(f))

6) Technical Logs & Anti‑Abuse

We log IP address, timestamp, and related technical data at registration/login and for critical actions to prevent misuse, investigate incidents, and maintain service integrity.

7) Cookies & Similar Technologies

We use essential and (with consent) non‑essential cookies to authenticate, remember preferences, analyze usage, and prevent fraud. You can control non‑essential cookies via your browser and our cookie banner. Blocking essential cookies may break core features.

If a Consent Management Platform (CMP) is enabled, it stores your consent choices (hashed key) for up to 12 months to demonstrate compliance.

8) Email Communications & Newsletter Tracking

We may use double opt‑in for subscriptions. Emails can include a standard tracking pixel to measure opens/clicks. You can unsubscribe anytime via the footer link or by contacting us.

9) Community Features (Blog/Comments)

If enabled, we may display your display name and comment content, and log your IP for moderation and anti‑abuse. You may subscribe to comment threads (double opt‑in) and withdraw at any time.

10) Third‑Party Services (Modular)

We use or may use the following providers. Only services active in production process your data. A current sub‑processor list is available upon request.

Category	Provider	Purpose	More Info
Analytics	Google Analytics (GA4)	Site usage measurement; IP anonymization where available	Privacy
Security	Google reCAPTCHA	Bot/spam prevention for forms	Privacy
Advertising	Google Ads / Microsoft Advertising	Conversion measurement & personalization (consent‑based)	Google Settings · MS Opt‑Out
Live Chat	Intercom	Customer support messaging	Privacy
Payments	NMI	Payment processing & anti‑fraud	NMI ·
Video	YouTube/Vimeo	Embedded player	YouTube
Social	Instagram / X (Twitter) / Facebook	Embedded widgets (if used)	Instagram · X

Note: Only the providers you actually enable in production will process your data.

11) Sharing & Disclosure

No sale of Personal or Business Data.
Service providers / sub‑processors under DPAs (hosting, payments, analytics, email, support).
Legal authorities when required to comply with law or protect rights/safety.
Business transfers (merger, acquisition, or asset sale) subject to this Policy.
Integrations explicitly authorized by you; their policies then apply.

12) International Transfers

Your data may be processed outside your jurisdiction (including the U.S.). Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

13) Retention

We retain Personal Data and Business Data while your account is active and as needed to provide the Services. After closure, we delete or anonymize within 365 days or at our discretion unless a longer period is required by law (e.g., tax, accounting, fraud prevention). Aggregated, non‑identifiable data may be retained.

14) Your Rights

Subject to your location, you may have rights to access, rectify, erase, restrict, object, portability, and withdraw consent (where applicable). To exercise rights, contact our Controller contact below and include proof of identity and your request details.

Automated decisions: We do not perform solely automated decisions producing legal or similarly significant effects. If we ever do, we will implement safeguards and enable human review.

15) Your Responsibilities

Keep credentials secure; use strong passwords and MFA.
Ensure your uploads/integrations comply with Amazon’s Data Protection Policy and applicable law.
Avoid uploading unlawful or infringing content.
Use role‑based access for your team to minimize risk.

16) Security

We apply administrative, technical, and physical safeguards (encryption in transit/at rest where applicable, access controls, logging, backups, vulnerability management). No system is 100% secure, and we cannot guarantee absolute security.

17) Data Required by Law or Contract

In some cases, providing certain data is legally or contractually required (e.g., billing/tax). If you do not provide required data, parts of the Services may be unavailable.

18) Children

The Services are not intended for individuals under 18. We do not knowingly collect data from minors.

19) Changes to This Policy

We may update this Policy. We will post changes with a new “Last Updated” date. Material changes may be notified via email or in‑app notice. Continued use constitutes acceptance.

20) Governing Law & Jurisdiction

This Policy is governed by the laws of Utah/USA, without regard to conflicts of law.

21) Contact (and Alternate Contact)

Controller: 3P Mercury LLC
Address: 789 East Bamberger Drive Suite D American Fork, UT, 84003
Email: service@3PMercury.com

If you prefer not to use web forms or email, you may contact us by telephone or postal mail at the address above.