Privacy Policy

1. Who we are and scope

NiftyOne is an application operated by Albert Scott, a trade name of Golden Opportunity Gold Buyers LLC ("Albert Scott", "we", "us"), 75 Lawrence Ave, Inwood, NY 11096, United States. This policy explains how we handle information when you visit this website (Part 1) and when a client authorizes NiftyOne to access their Amazon account through Amazon's Selling Partner API (Part 2). It applies from the effective date above.

2. Part 1: Website visitors

Information we collect

This website has no sign in, no forms that store data, and no analytics or advertising trackers. We receive information only when you contact us: your name, email address, phone number and the content of your message, as you choose to provide it. Our hosting provider also keeps standard server logs (such as IP address, browser type and pages requested).

How we use it

We use contact information to respond to you, prepare quotes and provide support. We use server logs for security and to keep the site running. We do not sell this information.

Sharing

We share website information only with service providers that host the site or provide our email and communication systems, and where the law requires. See the Cookie notice for cookie practices. We do not respond to Do Not Track signals differently because the site does not track visitors.

Children

This website and NiftyOne are not directed to children under 13 and we do not knowingly collect information from them.

3. Part 2: Amazon seller data (Selling Partner API)

This part applies to information we access from a client's Amazon account after the client authorizes NiftyOne ("Amazon Information"). It is in addition to Part 1.

3.1 What we collect

Only what the client authorizes on Amazon's consent screen. Our connection invitation covers these categories: orders and order items, finances (settlements, fees, refunds and deposits), inventory, reports, pricing information, and Brand Analytics reports where the client's account has access. We also store the authorization (a refresh token) Amazon issues to us. We do not collect Seller Central usernames, passwords or access keys, and we do not collect payment card data.

3.2 How we use it

We use Amazon Information solely to provide services to the client who authorized it: the client portal and the Amazon management services the client has engaged us for. NiftyOne only reads data through its Selling Partner API authorization: we do not change the client's listings, prices, inventory or funds. Where a client engages us for advertising management, campaign changes are made through a separate Amazon Advertising authorization the client grants to Albert Scott, only as part of the advertising management the client has engaged us for. We do not sell Amazon Information. We do not use it to market to Amazon buyers. We do not combine one client's Amazon Information with another client's, aggregate it for benchmarking or resale, or disclose it to other users of the application. We do not publish insights about Amazon's business.

Profit and forecast figures are calculated from Amazon Information plus cost information the client supplies. We use AI models from third-party providers (see section 3.6) to summarize, classify and analyze catalog, listing, sales and search data. This processing is done only to serve the same client, and we do not send buyer personal information to these providers.

3.3 Storage and protection

Amazon Information is stored in databases that we operate or that our infrastructure providers host for us. Our application servers are hosted by DigitalOcean in Germany, and our primary database is hosted by Supabase in India. Data is encrypted in transit using TLS. The Amazon authorization token is stored encrypted (AES-GCM). Access is limited to personnel who need it for their work, and each client's data is kept associated with that client. We do not store buyer personal information.

3.4 Retention

We do not store buyer names, email addresses, phone numbers or street addresses. Order records keep only the order's city, state or region, postal code and country, which we use for sales reporting. If buyer personal information is ever needed to provide a service, it is deleted no later than 30 days after the order is delivered, unless a law requires us to keep it longer. We keep other Amazon Information only for as long as needed to provide the service to the client. Security logs are kept for at least 12 months.

3.5 Deletion and de-authorization

A client can revoke NiftyOne's access at any time in Seller Central (Apps and Services, then Manage Your Apps) or by emailing us. When access is revoked, the engagement ends, the client asks us to delete data, or Amazon tells us to, we permanently and securely delete the client's Amazon Information within 30 days. Deletion covers live systems and backups, using methods that make the data unrecoverable. Anonymizing data is not deletion, and we do not treat it as such. We confirm completion in writing on request. We may keep information that a law requires us to retain, and only for as long as it requires.

We do not sell Amazon Information or share it with other clients. We use these service providers to run the service: DigitalOcean (application hosting, Germany), Supabase (database hosting, India), Vercel (website and portal hosting, United States), and the AI model providers OpenAI, Anthropic and Google (United States). They may process Amazon Information only on our behalf, under their service terms, and only for the purposes above. We review vendors that handle Amazon Information at least annually. We disclose information to authorities only when the law requires it.

3.7 Security incidents

If a security incident affects Amazon Information, we notify Amazon (at security@amazon.com) within 24 hours of becoming aware of it, and we notify affected clients and regulators as the law requires. Our designated security incident contact is our Technology Lead, reachable at support@albertscott.com or 516.345.8743. Security concerns can be reported the same way.

3.8 Amazon policies

We comply with Amazon's Acceptable Use Policy and Data Protection Policy for applications using the Selling Partner API.

4. Your rights and choices

You may ask us to tell you what personal information we hold about you, to correct it, to delete it, to give you a copy, or to stop using it for a purpose. For Amazon Information, requests should come from the client who authorized NiftyOne; if you are an Amazon buyer and believe we hold your information, contact us and we will help. Email support@albertscott.com. We complete requests within 30 days, or tell you why we cannot.

California residents. You have the right to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context advertising, and we do not discriminate against you for using these rights.

Visitors from the EEA, UK or Switzerland. You may also have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority. Our legal bases are performance of a contract or steps before one, our legitimate interests in running and securing the service, and legal obligations. Personal information is processed in the countries listed in section 3.6.

5. General provisions

International transfers. We and our service providers process information in the United States, Germany and India (see section 3.6). By using the service or contacting us, you understand your information may be processed in those countries.

Changes. If we change this policy we will post the new version here with a new effective date. For material changes affecting Amazon Information, we notify affected clients.

6. Contact

Albert Scott
75 Lawrence Ave, Inwood, NY 11096
Phone: 516.345.8743
Privacy, deletion and security contact: support@albertscott.com

Amazon and all related marks are trademarks of Amazon.com, Inc. or its affiliates.