1. Information we collect
Account and security
We collect account information such as your email address, authentication and MFA status, and security session data needed to operate a secure login.
Listing audit content
When you run a listing audit, we process the listing text, specifications, images, customer-review excerpts, competitor content, and other material you choose to provide for that audit.
Product images you upload, including any embedded image metadata, are sent to our configured AI provider only to perform the requested audit. Listnara does not store the original image bytes in its database or audit history. We may retain non-reversible technical descriptors—media type, byte count, and SHA-256 digest—and the resulting written observations as part of the audit record.
Search Term CSV analysis (when enabled)
When the Search Term CSV feature is enabled for your account, you may upload an Amazon Ads Sponsored Products Search Term Report that you exported yourself. The raw CSV is written to a restricted temporary staging area during processing, then deleted. Listnara does not retain the raw file bytes as report data after processing completes or fails.
We persist report metadata, deterministic aggregates, rule-based insights, warnings, and limitations derived from your file. This analysis is not generated by an LLM and CSV contents are not sent to external AI providers. Data is isolated per account; deleting a report removes stored analysis for that report. Account deletion removes Search Term CSV data through the same database and deletion-ledger controls that apply to other tenant-owned records.
Each successful analysis counts toward your monthly Search Term CSV quota for your plan. Deleting a report does not refund quota already consumed for that period. We do not promise a fixed retention period for stored aggregates beyond your control to delete them or close your account.
Amazon seller data (optional)
Production Amazon connectivity is currently disabled, and Listnara does not currently process production Amazon Information. If you connect an Amazon selling account after connectivity is enabled, we may process selling partner identifiers, marketplace participation, listing identifiers (such as seller SKU and ASIN), listing content fields, and bounded catalog summary attributes retrieved through read-oriented Selling Partner API operations described on our Amazon Integration page.
Before production Amazon connectivity is enabled, operational backup retention and deletion controls for Amazon-derived data will be activated and verified.
Operational data
We collect operational information such as audit status, token usage, timestamps, error records, IP-derived security signals, and limited product events including registration, audit completion, allowance usage, and Amazon connection status. Analytics events are designed not to include listing body text.
2. How we use information
- Provide, secure, troubleshoot, and improve Listnara.
- Generate listing-audit reports you request.
- Maintain your account, audit history, and monthly usage allowance.
- Import Amazon listing data you authorize, solely to support listing analysis and reduce manual entry, when Amazon connectivity is enabled.
- Prevent abuse and respond to support or legal requests.
- Measure aggregate product adoption without storing listing content in analytics events.
3. AI processing
Content you manually submit for a listing audit may be sent to a configured AI service provider to generate the requested report. Amazon-derived data is not currently sent to OpenAI, OpenRouter, or other AI providers. We will update our technical controls, privacy disclosures, and Amazon disclosures before changing this behavior.
We do not use your listing content to train our own models. Do not submit confidential information, buyer personal information, payment data, credentials, or material you are not authorized to process.
4. Amazon seller data
Listnara is an independent service and is not endorsed by or affiliated with Amazon. We do not request Amazon account passwords, buyer personal information, or payment card data through SP-API.
Approved SP-API roles
Our Amazon Developer application is registered for these roles only: Product Listing and Selling Partner Insights. Read-oriented API families used in the application include Sellers API, Listings Items API, Catalog Items API. Role names and API names are not identical; we describe both for transparency.
Sources
When Amazon connectivity is enabled, Amazon seller data comes only from your explicit OAuth authorization and subsequent import actions you initiate.
Storage
OAuth refresh tokens are stored encrypted in our PostgreSQL database while a connection remains active. Imported listing and catalog snapshots are stored in application tables associated with your user account. Audit inputs and completed audit reports are stored as part of your account history.
Security
We use encryption in transit (HTTPS), encrypted refresh-token storage, access controls, MFA for accounts, tenant isolation in database queries, and log redaction for OAuth and credential patterns.
Disconnect and deletion
When you disconnect an Amazon account in Listnara, we immediately stop subsequent SP-API calls for that connection, delete the stored refresh token, finalize in-flight sync work, and remove imported Amazon account records—including marketplace participation, listings, catalog snapshots, and Amazon-linked audit snapshots—from active application databases. You should also revoke Listnara in Amazon Seller Central under Apps and Services → Manage Your Apps.
You may request account deletion by emailing [email protected] from your account email. After we verify a valid account-deletion request, user-owned records are removed from active application systems within 30 days.
5. Retention
This section distinguishes active application systems (the live database used by the product) from encrypted operational backups (private backup copies used only for disaster recovery). Backups are not used for normal business queries.
- Active accounts: account, audit, and any imported Amazon data are retained while your account remains active and you continue using the service.
- After Amazon disconnect (active systems): refresh tokens are deleted immediately; imported Amazon account, listing, catalog, and linked audit snapshot data are removed from active application databases as part of the disconnect operation.
- After verified account deletion (active systems): after we verify a valid account-deletion request, user-owned records are removed from active application systems within 30 days.
- Encrypted operational backups: before production Amazon connectivity is enabled, backup retention and deletion controls for Amazon-derived data will be activated and verified. When enabled, encrypted operational backups that may contain Amazon-derived data will be retained for no longer than 35 days. Deleted data may remain in those backups until the applicable rotation period ends. Operational backups are used only for disaster recovery and not for normal business queries. If disaster recovery restores from backup, disconnect and deletion actions must be re-applied where required.
- Long-term archives: long-term full-database archives containing Amazon-derived data are not maintained. Any future long-term archive must exclude Amazon credentials, Amazon-imported records, and Amazon-linked audit content.
- Legal and security exceptions: we may retain minimal records longer when required by law, fraud prevention, or active disputes. Those records do not include refresh tokens or unnecessary full listing content.
6. Your choices
You may request access, correction, export, or deletion of your personal information, subject to identity verification and applicable retention obligations. Contact [email protected].
7. International processing and children
Your information may be processed in countries other than your own. Listnara is intended for business users who are at least 18 years old and is not directed to children.
8. Changes and contact
We may update this policy as the product and legal requirements evolve. Material changes will be posted at https://listnara.com/privacy with a revised effective date. Questions may be sent to [email protected].