Profit Owl

Privacy Policy & Data Retention

How we store, handle, and retain your data. · Effective Date: June 6, 2026

Profit Owl is committed to transparency in how we collect, store, and handle data. This document describes our data storage infrastructure, retention schedules, and deletion practices as they apply to Amazon sellers who connect their accounts to the Profit Owl platform.

Important: Profit Owl does not collect or store any customer Personally Identifiable Information (PII). We do not access buyer names, shipping addresses, email addresses, or any other customer data. All data processed by Profit Owl is seller-facing operational and financial data retrieved from your Amazon Seller account via the Amazon Selling Partner API (SP-API) with your explicit authorization.

1. Infrastructure & Cloud Environment

All Profit Owl data is stored and processed exclusively within Amazon Web Services (AWS). We do not use third-party cloud providers or transfer data outside the AWS ecosystem.

1.1 Hosting & Processing

All application infrastructure is hosted on AWS
All production data is stored in AWS data centers located in the United States. Data is not transferred outside the United States except where required by law
AI-powered insights (Nova) are generated using Amazon Bedrock — all AI inference occurs within AWS
No seller data is transmitted to external AI providers or third-party services

1.2 Encryption

All data is encrypted in transit using TLS 1.2 or higher
All data is encrypted at rest using AES-256 encryption
Encryption keys are managed via AWS Key Management Service (KMS)

1.3 Logging & Monitoring

System access, authentication events, and administrative actions are logged and monitored for security purposes
Logs are retained for a minimum of 90 days and reviewed as part of ongoing security operations

2. What Data We Store

Profit Owl retrieves and stores only the seller operational data necessary to deliver the service. The following categories of data are collected via SP-API with your explicit OAuth authorization:

2.1 Orders & Shipment Data

Order IDs, order status, and fulfillment channel
Carrier scan confirmations and shipment tracking status
Shipment dates and estimated delivery windows
No buyer names, addresses, or contact information is accessed or stored

2.2 Returns Data

Return request IDs, return status, and return reason codes
Return label creation timestamps and carrier scan events
Refund amounts and refund status
No buyer-identifying information is included

2.3 Financial & Fee Data

Amazon fees, FBA charges, referral fees, and storage fees
Refund totals, return shipping costs, and commission adjustments
Profit leakage metrics derived from Amazon fee reports
Optional seller-provided inputs: COGS, 3PL fees, labor, repackaging, disposal costs

2.4 Account Health Data

Listing status, policy violation flags, and pricing deactivation notices
Intellectual property complaint records
Account suspension or restriction notices

2.5 Seller-Provided Configuration Data

Optional cost inputs entered by the seller to improve profit leakage accuracy
Alert preferences and notification settings
Subscription tier and billing information (payment processing handled by a PCI-compliant third-party processor; Profit Owl does not store full payment card numbers)

3. Data Retention Schedule

Profit Owl retains data only as long as necessary to deliver the service and for the periods described below.

3.1 Active Account Retention

While your account is active and connected, we retain the following data:

Orders, returns, and shipment data: 12 months rolling
Financial and profit leakage data: 12 months rolling
Account health events and alert history: 12 months rolling
Actions log (completed, snoozed, dismissed items): 12 months rolling
Seller-provided cost inputs and configuration settings: Retained for the life of the active subscription

The 12-month rolling window supports the weekly, monthly, and yearly toggle views in the Profit Leakage dashboard and Nova's trend analysis. Data older than 12 months is automatically purged on a rolling basis regardless of account status.

3.2 Post-Disconnection Retention & Grace Period

Grace Period: When you disconnect or cancel your Profit Owl account, your data is retained for 14 days. This grace period allows you to reconnect and resume the service without loss of history. You will receive a notification from Nova when your account is disconnected, including the date on which your data will be permanently deleted if you do not reconnect.

The following schedule applies after account disconnection:

Days 1–14: All data retained; account can be reconnected with full history intact
Day 14: Permanent deletion of all stored data associated with your account is initiated
Deleted data is removed from production systems immediately. Encrypted backup systems are purged according to our backup retention schedule, with a maximum residual retention of 30 days post-deletion

3.3 Seller-Requested Deletion

You may request immediate deletion of all your data at any time by contacting support@profitowl.app or using the account deletion option in your dashboard settings. Deletion requests are processed within 72 hours. Immediate deletion waives the 14-day grace period. Deleted data is removed from production systems within 72 hours and from encrypted backup systems within 30 days.

4. Data Security Controls

Profit Owl implements the following security controls to protect your data in accordance with the Amazon SP-API Data Protection Policy (DPP) and Acceptable Use Policy (AUP):

4.1 Access Controls

Role-based access control (RBAC) enforced across all internal systems
Account lockout enforced after 10 unsuccessful login attempts
Multi-factor authentication (MFA) required for all internal administrative access
Password history retention enforced for the last 10 passwords
SP-API access tokens and API keys rotated on a defined schedule

4.2 Network & Application Security

All data transmitted over encrypted HTTPS/TLS connections
Anti-virus and malware protection enabled; software disablement is blocked
Regular vulnerability scanning and penetration testing
AWS VPC network isolation for all production systems

4.3 SP-API Authorization

Seller data is accessed only via Amazon OAuth authorization granted explicitly by the seller
SP-API tokens are stored securely and never logged or exposed
Authorization can be revoked by the seller at any time via Amazon Seller Central

5. Security Incident Notification

Profit Owl maintains documented procedures for detecting, responding to, and mitigating security incidents. In the event of a confirmed data security incident affecting seller data, affected sellers will be notified without unreasonable delay and in accordance with applicable law. Notifications will include a description of the incident, the data affected, and the steps being taken to address it.

A full Incident Response Plan is maintained internally and reviewed on a regular basis. The plan covers incident detection, containment, eradication, recovery, and post-incident review.

6. AI Processing & Amazon Bedrock

Profit Owl uses Amazon Bedrock to power Nova, our AI assistant. All AI inference occurs within AWS. Your data is not transmitted to external AI providers.

Amazon Nova models (via Bedrock) power standard-tier insights and alerts
Claude models (via Bedrock) power enhanced insights on Pro and Premium tiers
Prompts and responses generated by Nova are not used to train third-party AI models
AI processing occurs within the same AWS environment as all other Profit Owl data

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and through a Nova alert in your dashboard at least 14 days before the changes take effect. Continued use of Profit Owl after the effective date constitutes acceptance of the updated policy.

8. Contact

For questions about this policy or to submit a data deletion request:

Email: support@profitowl.app
Website: https://profitowl.app/privacy.html