Privacy policy

This policy explains what data NEXUSCONSULTINGONE LLC ("Nexusconsultingone", "we") processes through this website, our consulting services and Nexus Seller Platform (the "Platform"), why, and what rights you have.

1. Who we are

NEXUSCONSULTINGONE LLC, 2105 Vista Oeste St, Ste E-1414, Albuquerque, NM 87120, United States. Contact for any privacy matter: oscar@nexusconsultingone.com.

2. Data we process

• Contact data you send us: name, e-mail address and the content of your message.
• Platform user accounts: name and e-mail address of the people a seller invites, used to sign in with Google, plus the brands and role (viewer or editor) each one has.
• Amazon seller data that a seller authorises us to access through the Selling Partner API and the Amazon Ads API: catalogue and listings, prices and offers, inventory and inbound shipments, order reports without buyer information, fees and reimbursements, returns, Subscribe & Save, sales and traffic, Brand Analytics, and advertising campaigns and reports.
• Authorisation tokens issued by Amazon when the seller connects their account.
• Records of consent and changes: when a seller accepted this policy, and every change made in their Amazon account through the Platform (who, when, before and after).

We do not request, receive or store personal information about Amazon buyers (names, addresses, phone numbers, e-mails or payment data). We do not request any restricted Selling Partner API role.

3. Why we use it

• To provide the Platform and the services the seller has contracted: analytics, advertising management, pricing, inventory planning and listing management for the seller's own account.
• To answer your enquiries and prepare service proposals.
• To keep the Platform secure, prevent misuse and comply with legal obligations.

Amazon data is used only to provide the service to the seller it belongs to. We do not sell it, we do not share it with other clients, we do not use it for our own brands or to build products for third parties, and we do not use it to train AI models.

4. Legal basis

Performance of the contract with the seller; the seller's consent when they authorise the connection with Amazon and accept this policy; our legitimate interest in keeping the Platform secure; and compliance with legal obligations.

5. Connection with Amazon and how to revoke it

Access is granted through Amazon's official authorisation (OAuth). We never ask for or store Amazon passwords. The authorisation is limited to the permissions the seller approves on Amazon's consent page. The seller can revoke it at any time from Seller Central (Apps and Services → Manage Your Apps) or from Amazon Ads, without notifying us; we can also do it on request.

6. Retention and deletion

• Authorisation tokens are deleted immediately when the seller disconnects or revokes access.
• The seller's Amazon data is kept while the service is active and deleted within 30 days of the end of the service or of a deletion request, unless we must keep it to meet a legal obligation.
• Backups containing that data expire within the following 30 days.
• Contact data is kept while there is a relationship or interest in keeping it.

7. Security

• Encryption in transit (HTTPS, TLS 1.2 or higher) for all communication with Amazon and with the Platform.
• Amazon tokens encrypted at rest with AES-256-GCM, with the key stored separately from the database. Credentials are never written to logs, source code or repositories.
• Data stored on encrypted volumes in the European Union, with encrypted backups.
• Each seller's data isolated from every other seller's; every access is checked against the user's permissions.
• Access for named users only, on a least-privilege basis, with multi-factor authentication on administrator accounts.
• A documented incident response plan, reviewed every six months. Any security incident involving Amazon information is reported to Amazon within 24 hours of detection, and to the affected sellers.

8. Service providers

We do not sell or transfer data to third parties. We use these providers, under confidentiality and data-protection terms, only to run the service:

• Fly.io — application hosting (European Union).
• Tigris Data — encrypted backup storage.
• Google — user sign-in and, only when the seller requests it, AI image generation for their listings.
• Netlify — hosting of this website.

9. Your rights

You can request access to, correction or deletion of your data, restriction of or objection to its processing, and its portability, by writing to oscar@nexusconsultingone.com. We answer within 30 days. If you live in the European Union you can also complain to your data-protection authority.

10. Cookies

This website uses no analytics, advertising or tracking cookies. The Platform uses only a session cookie, strictly necessary to keep users signed in.

11. Changes

If we change this policy we will publish the new version on this page with its date, and ask sellers connected to the Platform to accept it again when the change is material.