Legal
Privacy Policy
This Privacy Policy explains what information OFTOPUS collects, why we collect it, how we protect it, and the choices you have. It applies to our website at oftopus.com, our Profit & Waste report (including the free summary), our client portal, and our paid management services (together, the "Services").
1. Who we are
The Services are operated by ATAMIN International Trading Corporation, a United States corporation doing business as OFTOPUS ("OFTOPUS", "we", "us", "our"). We are the business responsible for the personal information described in this policy.
Mailing address: ATAMIN International Trading Corporation
7545 Irvine Center Dr, Ste 200
Irvine, CA 92618-4357, United States
Privacy contact: account@oftopus.com
Our Services are for businesses that sell on Amazon. We are not affiliated with or endorsed by Amazon.
2. Information we collect
Information you give us
- Account and contact information: your name, work email address, your role (brand owner, employee or agency) and your time zone. If you sign in with Google, we receive your name and email address from Google. If you subscribe, we also collect your brand or company name.
- Business information: information about your business, products and category that you choose to give us, including but not limited to your Amazon storefront address, sales range, number of products, price range, product costs, restock lead times, minimum order quantities, seasonality, supply chain, manufacturing and shipping details, goals and limits, and any other details you share.
- Communications: messages you send us through the portal, email, Slack or support tools, and your approvals or declines of proposed actions.
- Billing information (paid clients only): billing contact and payment status. Card details are entered directly with our payment processor; we do not store full card numbers.
Information collected automatically for security and fraud prevention
- Device and network signals: IP address, network provider (ASN), approximate country, browser and device type, and timestamps.
- Bot protection: we use Cloudflare Turnstile on sign-up, sign-in and Amazon connection steps to tell people from automated scripts. Turnstile processes browser and device signals to produce a pass/fail result.
- First-party device cookie: a random identifier stored in a cookie on our own domain, used to recognize repeat sign-ups from the same browser and to limit the free summary to once every 90 days per business.
We use these signals only for security, abuse prevention and keeping the Services running. We do not use them to track you across other websites.
Amazon Selling Partner and Amazon Advertising data you authorize
When you click "Connect Amazon", you sign in on Amazon's own pages and grant us access through Amazon's Selling Partner API and Amazon Ads API. We never see or store your Amazon password. With your authorization we receive:
- Identifiers Amazon returns for your account, such as your selling partner ID and advertising profile IDs, and the authorization tokens needed to call Amazon's APIs on your behalf.
- Business data for your account: sales and traffic, fees and reimbursements, inventory levels, product and listing identifiers (ASIN/SKU), and advertising campaigns, targets, search terms, spend, clicks and attributed orders.
We do not request access to buyer personal information. We only request Amazon API roles that do not include personally identifiable information (PII) of Amazon customers, such as buyer names, shipping addresses, emails or phone numbers. If Amazon data we receive ever contains buyer PII, we do not use it and delete it.
3. How we use information
- To provide the Services: show your free summary, build your Profit & Waste report, calculate profit per product, identify ad spend that did not lead to orders, estimate inventory cover, prepare recommended actions, and, for paid clients, carry out only the actions you approve in the portal, or that fall within the limits you set on the Managed plan, and confirm the results.
- To communicate with you: account emails, report-ready notices, approval requests, alerts you asked for, billing notices and support replies.
- Security and abuse prevention: block automated sign-ups, detect fraud, and limit the free summary to once every 90 days per business.
- Billing: invoice and collect fees from paid clients.
- Legal: comply with law, enforce our Terms of Service, and protect our rights and users.
We do not sell personal information. We do not use Amazon data for advertising to you or anyone else, and we do not use your Amazon data for any purpose other than providing the Services to you.
How our engine improves
OFTOPUS runs on one shared engine. Data you authorize through Amazon is used only to serve your own account. It is never used to train or improve the engine for other clients. The shared engine is developed from our own business data and public information. Your results are used only to tune the settings for your own account.
Acquisition inquiries (optional)
We never use data received through your Amazon authorization to evaluate your brand for purchase. If you turn on "Open to acquisition inquiries" in your settings, we may contact you about a potential buyer, which may be OFTOPUS, ATAMIN International Trading Corporation or a company we work with; we will always tell you who the interested party is first. Any assessment uses only the business information you choose to share with us separately for that purpose, and we never share it with a third party without your separate written approval for that specific party. It is off by default and not required for any plan. If you turn it off, we stop and delete any assessment within 30 days.
4. Amazon data
We handle data received from Amazon's APIs ("Amazon Information") in line with Amazon's Data Protection Policy and Acceptable Use Policy for Selling Partner API and Amazon Ads API developers. In particular:
- Purpose limitation: Amazon Information is used only to provide the Services you authorized, for your own account.
- No selling or unrelated sharing: we do not sell, rent or share Amazon Information with third parties for any purpose unrelated to providing the Services to you, and we do not combine it with other sellers' data to benefit anyone else.
- Separation: each client's data is tagged and kept separate, and access is restricted to that client's account.
- Minimal online footprint: detailed Amazon data is processed by our engine on Google Cloud and stored in our database (Supabase, United States region), both with restricted access. Our public website holds no Amazon data.
- No model training for others: Amazon Information is never used to train or improve models or rules for any other client. We use only AI providers whose terms do not allow them to train their models on the data we send.
- Your control: you can revoke our access at any time in Seller Central and in your Amazon Ads account, or by disconnecting in the portal.
5. How we protect information
- Encryption in transit: all connections to our website and to Amazon's APIs use HTTPS/TLS.
- Encryption at rest: Amazon Information, authorization tokens and backups are encrypted at rest using industry-standard encryption. Authorization tokens are encrypted separately with keys that are not stored with the data.
- Access limited to need: only people who need access to provide the Services can reach client data, using individual accounts with multi-factor authentication. Access is logged and reviewed.
- Monitoring: we keep logs of access to Amazon Information and of every action taken on a client's Amazon account.
- Incident notification: if we discover a security incident involving Amazon Information or your personal information, we will notify Amazon as required by Amazon's policies (within 24 hours of detection), notify affected users without undue delay, and notify authorities where the law requires.
No method of storage or transmission is completely secure, but we work to protect your information and review our safeguards regularly.
6. Retention and deletion
| Information | How long we keep it |
|---|---|
| Amazon Information and authorization tokens | While your account is connected. When you disconnect, cancel, or revoke access, we stop collecting immediately and delete Amazon Information within 30 days, unless a longer period is required by law. |
| Free summary and report (if you do not become a client) | If you do not buy the report, access is revoked and the underlying Amazon Information deleted after 7 days. If you buy the report, access is kept for 30 days after it is ready so you can review it, then revoked and the underlying Amazon Information deleted. |
| Account and contact information | While your account is open, then deleted within 90 days of closure, except records we must keep for legal, tax or accounting reasons. |
| IP addresses and device signals | 90 days, after which we keep only non-identifying network information (such as the network provider). |
| Billing records | As long as required by tax and accounting law. |
| Security and access logs | 12 months, then deleted. |
| Acquisition inquiry information (only if you opt in) | Until you turn the setting off, then deleted within 30 days. |
When we delete Amazon Information we delete it from active systems and from backups as they rotate, and we can confirm deletion to you on request.
7. How we share information
We share information only:
- With Amazon, when we call Amazon's APIs to read your data or to carry out an action you approved or that falls within the limits you set.
- With service providers that process information for us under contract, only as needed to run the Services (see below).
- With people you authorize, such as teammates you add to your portal or private Slack channel.
- For legal reasons, when required by law, legal process, or to protect the rights, property or safety of our users, the public or us.
- In a business transfer, such as a merger or sale of assets, subject to this policy and to Amazon's policies; we will notify you before your information becomes subject to a different policy.
8. Service providers
We use a small number of service providers. Each may only use information to provide its service to us.
| Purpose | Provider |
|---|---|
| Domain, DNS, website hosting, network security, bot protection (Turnstile) and log storage | Cloudflare, Inc. |
| Business email | Google Workspace (Google LLC) |
| Sign-in with Google (if you choose it) | Google LLC |
| Website fonts | Google Fonts (Google LLC) — receives your IP address when the page loads fonts |
| Payments (paid clients only) | Stripe, Inc. — or bank wire |
| Sign-in and client database (United States region) | Supabase, Inc. |
| Data processing engine (United States region) | Google Cloud (Google LLC) |
| Email sending (account and report notices) | Resend, Inc. |
| Client messaging (if you choose Slack) | Slack Technologies, LLC |
| AI analysis and support assistant | Anthropic, PBC (Claude API) |
| Analytics | None at this time |
9. Cookies and similar technologies
- Strictly necessary cookies: to keep you signed in and to secure forms and the Amazon connection step.
- Security cookie: the first-party device identifier described above, and cookies set by Cloudflare Turnstile and Cloudflare's security services.
- Campaign source: if you arrive from one of our links, we may store which link or campaign brought you (UTM parameters) in a first-party cookie and attach it to your account when you sign up.
We do not use third-party advertising cookies and we do not allow ad networks to track you on our site. If we add analytics, we will update this section and ask for consent where required. You can block or delete cookies in your browser; strictly necessary and security cookies are needed for sign-up and sign-in to work.
Global Privacy Control / Do Not Track: we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of. We treat a Global Privacy Control signal as a valid opt-out request where the law requires.
10. Your choices and rights
- Disconnect Amazon: in the portal, or by revoking our app in Seller Central and in Amazon Ads.
- Access, correct or delete: email account@oftopus.com. You can also correct most account details in the portal.
- Close your account: in the portal or by emailing us. We then delete your information as described in Retention and deletion.
- Marketing messages: we send only service messages unless you opt in; you can opt out of any marketing message using the link or instruction in it.
11. US state privacy rights
Residents of California and certain other US states (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others with similar laws) may have the right to:
- know what personal information we collect, use and disclose, and get a copy of it;
- correct inaccurate personal information;
- delete personal information, subject to legal exceptions;
- opt out of the sale or sharing of personal information, targeted advertising and certain profiling — we do not do any of these;
- limit the use of sensitive personal information — we do not use sensitive personal information for purposes that require this right;
- not be discriminated against for exercising these rights; and
- appeal our decision on a request, where state law provides that right.
California notice at collection. In the last 12 months we have collected these categories of personal information: identifiers (name, email, IP address, device identifier); commercial and business information (brand, store, product costs, billing status); internet or network activity (security logs); and professional information (role, company). Sources: you, your browser, and Amazon (with your authorization). Purposes: those listed in How we use information. We disclose these categories only to the service providers listed above for business purposes. We have not sold or shared personal information.
How to make a request: email account@oftopus.com, or write to us at the mailing address in section 1. We will verify your request by confirming control of the email address on your account, and respond within 45 days (we may extend once by 45 days if needed and will tell you). You may use an authorized agent; we may ask for proof of the agent's authority and verify your identity directly. To appeal a decision, reply to our response with "Appeal" in the subject line.
12. Children
The Services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
13. International users
We are based in the United States, and our Services cover the Amazon US marketplace. If you use the Services from outside the United States, your information will be transferred to and processed in the United States and in other countries where our service providers operate, which may have different data protection laws than your country. We apply the protections in this policy wherever your information is processed. We do not currently offer the Services to businesses located in the European Union or the United Kingdom.
14. Changes to this policy
We may update this policy. If we make material changes, we will notify account holders by email or in the portal before the change takes effect, and update the date at the top of this page.
15. Contact us
ATAMIN International Trading Corporation, d/b/a OFTOPUS
Email: account@oftopus.com
Mail: 7545 Irvine Center Dr, Ste 200, Irvine, CA 92618-4357, United States