Privacy Policy
Last Updated: August 6, 2026
1. Introduction
Welcome to VulcanPilot. We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.
2. Information We Collect
We may collect information about you in the following ways:
Personal Data
- Email address (for account creation and authentication)
- Name (optional)
Usage Data
- Campaign data from your Amazon Ads account (via Amazon Ads API)
- Search term reports and negative keyword suggestions
- Competitor keyword gap analysis data
- Application usage statistics
Technical Data
- IP address
- Browser type and version
- Operating system
- Device information
- Usage patterns and analytics
3. How We Use Your Information
We use the collected information for the following purposes:
- To provide, operate, and maintain our application
- To analyze and process your PPC data
- To generate negative keyword suggestions and competitor gap analysis
- To improve our services and user experience
- To communicate with you regarding updates and support
- To ensure the security of our application
4. Data Storage and Security
- Your data is stored securely on our servers
- We implement industry-standard security measures to protect your information
- Campaign data is encrypted during transmission and storage
- We do not share your personal information with third parties except as required for service provision
5. Amazon Ads API Access
To use our application, you provide an Amazon Ads API key through our secure authentication flow. We only access data that your API key permissions allow. We do not have access to your payment information or billing details.
6. Data Retention
- Account data is retained for as long as your account is active
- Campaign data is retained for 90 days after your last activity
- You can request deletion of your data at any time
6.1 Data Retention Policy
| Data Type | Retention Period | Rationale |
|---|---|---|
| Account data (email, name) | Duration of account + 30 days after deletion | Contractual obligation |
| Campaign/keyword data | 90 days after last activity | Service functionality |
| Competitor gap reports | 90 days after last activity | Service functionality |
| Weekly reports | 1 year | User access |
| Analytics data | 26 months | Statistical analysis |
| Cookie data | As specified in Cookie Policy | Service functionality |
| Data deletion requests | 2 years (audit trail) | Legal compliance |
6.1.1 Definition of "Last Activity"
"Last activity" means the most recent date on which you:
- Logged into your VulcanPilot account, OR
- Uploaded campaign data or initiated an analysis, OR
- Opened a weekly intelligence report email
6.1.2 Pre-Deletion Notification
Before we delete your campaign data after the retention period, we will send an email notification to your registered address at least 14 days in advance, giving you an opportunity to extend your retention period by logging in or re-uploading data.
6.1.3 Legal Exceptions
We may retain certain data beyond the standard retention periods where required by law, including:
- Tax and accounting records (7 years)
- Fraud prevention data (as long as necessary)
- Data subject to legal holds or disputes
7. Your Rights
You have the right to:
- Access your personal data
- Request correction of your data
- Request deletion of your data
- Opt-out of marketing communications
- Export your data
7.1 How to Exercise Your Rights
To exercise any of your rights listed above, please:
- Email: Contact us at privacy@vulcanpilot.com, OR
- Online Form: Submit a request through our privacy request form at https://www.vulcanpilot.com/#contact
7.1.1 Identity Verification
To protect your data, we may require additional information to verify your identity before processing your request. This may include:
- Confirmation of the email address associated with your account
- A copy of a government-issued ID (for deletion requests involving significant data)
- Additional questions to confirm you are the account holder
We will only request information necessary for verification and will delete it after the request is processed.
7.1.2 Response Timeline
| Request Type | Response Timeline |
|---|---|
| Access / Correction | Within 30 calendar days |
| Deletion (GDPR) | Within 30 calendar days |
| Deletion (CCPA) | Within 45 calendar days |
| Data Export | Within 30 calendar days |
| Opt-Out / Marketing | Within 15 calendar days |
If we need additional time, we will notify you within the first 15 days (GDPR) or 30 days (CCPA) with an explanation and expected completion date.
7.1.3 Data Export Format
When you request a copy of your data, we will provide it in the following formats:
- Keywords & Negatives: CSV (structured, machine-readable)
- Gap Reports: PDF + CSV
- Account Data: JSON
- Weekly Reports: PDF
7.1.4 No Unreasonable Delay or Expense
We will process your requests free of charge. We may refuse to act on manifestly unfounded or excessive requests (particularly repetitive requests), but we will inform you of our decision and your right to lodge a complaint with a supervisory authority.
8. Third-Party Services
Our application uses the following third-party services:
- Amazon Ads API (for campaign data)
- DeepSeek (for keyword analysis — production)
- OpenAI (for keyword analysis — fallback)
- Vercel (for hosting)
8.3 AI and LLM Service Providers
VulcanPilot uses artificial intelligence and large language model (LLM) services to power our negative keyword detection and competitor gap analysis features. When you use our application, certain data is processed by our AI providers.
8.3.1 AI Providers
| Provider | Service | Purpose |
|---|---|---|
| DeepSeek | LLM inference | Negative keyword analysis, semantic filtering, gap report generation |
| OpenAI | LLM fallback | Fallback processing when DeepSeek is unavailable |
8.3.2 Data Processed by AI Providers
We share only the following categories of data with AI providers:
- Anonymized keyword data: Keywords, CPC, CTR, conversion data — anonymized (no seller name, no account ID)
- Anonymized competitor ASIN data: Competitor product identifiers and ranking data — anonymized
- Search term themes: Brief descriptions of your product category and search themes — anonymized
We do NOT share the following with AI providers:
- Your Amazon account credentials or login details
- Your email address or personally identifiable information
- Your full campaign data with seller identifiers
- Your payment or billing information
8.3.3 AI Provider Data Use Policies
OpenAI: OpenAI's commercial API service explicitly commits that customer API inputs and outputs are not used to train their general models. Your data processed through OpenAI is used solely for generating your individual analysis results. See OpenAI's Privacy Policy for details.
DeepSeek: DeepSeek processes your anonymized data in accordance with their data processing agreement and applicable privacy policy. DeepSeek's standard service terms apply to all API processing. Your data is used to generate your individual analysis results. For details on DeepSeek's data practices, refer to their privacy policy at https://www.deepseek.com.
Initial Phase Commitment: During our initial launch phase, we do not collect or transmit any data that could be used for model training purposes. All data processed by AI providers is strictly limited to generating your analysis results.
8.3.4 Data Processing Agreements
Both OpenAI and DeepSeek are bound by data processing agreements that govern their use of your data. You may request a copy of these agreements by contacting our DPO at dpo@vulcanpilot.com.
9. Children's Privacy
Our application is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
10. Changes to This Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.
11. Contact Us
If you have questions about this Privacy Policy, please contact us at:
- Email: privacy@vulcanpilot.com
12. GDPR Compliance (EU/EEA Users)
If you are located in the European Economic Area (EEA), the European Union (EU), or the United Kingdom (UK), the following GDPR provisions apply to your use of VulcanPilot.
12.1 Legal Basis for Processing
We process your personal data under the following legal bases:
- Legitimate Interest: Processing your account data, campaign data, and analytics to provide our core service (negative keyword detection, competitor gap analysis) and improve our product. Our legitimate interest is balanced against your rights as the processing is limited to data you voluntarily provide for service delivery.
- Consent: Where required by applicable law (e.g., cookies, marketing communications), we process based on your explicit consent, which you may withdraw at any time.
- Legal Obligation: Where required by law (e.g., tax, anti-money laundering), we process data to comply with our legal obligations.
12.2 Data Protection Officer (DPO)
Our designated Data Protection Officer can be reached at:
- Email: dpo@vulcanpilot.com
- Address: [To be provided — pending company incorporation]
If you have any data protection concerns, you may contact our DPO directly.
12.3 Right to Lodge a Complaint
If you believe your data has been processed in violation of the GDPR, you have the right to lodge a complaint with the supervisory authority in your country of residence:
- EU: The data protection authority of your member state (e.g., CNIL in France, BfDI in Germany, DPC in Ireland)
- UK: The Information Commissioner's Office (ICO) at https://ico.org.uk/global/contact-us/
- EEA: Refer to https://edpb.europa.eu/about-edpb/about-edpb/members_en
12.4 Data Transfers Outside the EEA/UK
Your data may be transferred to and processed in countries outside the EEA/UK, including but not limited to the United States. These countries may not have data protection laws as comprehensive as those in the EEA/UK.
Where we transfer your data outside the EEA/UK, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs): Where we engage subprocessors outside the EEA/UK, we use the EU Commission's Standard Contractual Clauses as the legal basis for transfer.
- AI/LLM Subprocessors: When we use AI services, your data is processed under their respective data processing agreements. See Section 8.3 for details on each provider's data practices.
- UK International Data Transfer Agreement (IDTA): For UK data transfers, we use the UK IDTA where required.
You have the right to request a copy of the safeguards we rely on by contacting our DPO.
12.5 Right to Object (GDPR Article 21)
You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data based on legitimate interest (Article 6(1)(e) or (f)). We will no longer process your personal data unless we demonstrate legitimate grounds for the processing which override your interests and rights, or unless the processing is for the establishment, exercise or defence of legal claims.
You also have the absolute right to object to processing your personal data for direct marketing purposes, including profiling related to direct marketing. You may exercise this right at any time by contacting privacy@vulcanpilot.com or by clicking the unsubscribe link in any marketing email.
12.6 Data Deletion Requests (GDPR Article 17)
You have the right to request deletion of your personal data at any time. To submit a deletion request:
- Submit via Email: Send a deletion request to privacy@vulcanpilot.com with the subject line "GDPR Deletion Request".
- Identity Verification: We may request additional information to verify your identity before processing your request (e.g., confirming the email address associated with your account).
- Response Timeline: We will respond to your request within 30 calendar days of receipt.
- Data Export: If you request deletion, you may also request a copy of your data (right to erasure + data portability). We will provide this in a structured, commonly used, machine-readable format (CSV) within the same 30-day period.
- Exceptions: We may retain certain data where required by law (e.g., tax records, fraud prevention), but will inform you of any such retention.
12.7 Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority without undue delay and no later than 72 hours after becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to rights and freedoms, we will also notify the affected data subjects without undue delay (GDPR Article 34).
13. CCPA Compliance (California Residents)
If you are a resident of the State of California, the following California Consumer Privacy Act (CCPA) provisions apply to your use of VulcanPilot.
13.1 Do Not Sell My Personal Information
VulcanPilot does not sell your personal information as defined by the CCPA. You may exercise your right to opt-out of the sale of your personal information by contacting us at privacy@vulcanpilot.com or by submitting a request through our online privacy request form at https://www.vulcanpilot.com/#contact.
13.2 Categories of Personal Information Collected (Past 12 Months)
| Category | Examples | Collected For |
|---|---|---|
| Identifiers | Name, email address, Amazon Seller account ID | Account creation, authentication, service delivery |
| Commercial Information | Amazon Ads campaign data, keyword spend data, competitor ASINs | Core service functionality (negative keyword analysis, competitor gap analysis) |
| Internet/Network Activity | Browser type, IP address, device info, usage patterns, cookies | Analytics, security, service improvement |
| Geolocation Data | Approximate location (country-level) | Service localization, compliance |
| Inferences | User preferences, behavior patterns, product recommendations | Personalization, service improvement |
We do not sell sensitive personal information as defined by the CCPA.
13.3 California Consumer Rights
Under the CCPA, California residents have the right to:
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
- Right to Delete: Request deletion of personal information we have collected from you (subject to certain exceptions).
- Right to Opt-Out: Opt-out of the sale of personal information (we do not sell; see Section 13.1).
- Right to Correct: Request correction of inaccurate personal information.
- Right to Limit Use of Sensitive PII: Request limitation on the use of sensitive personal information (we do not collect sensitive PII beyond what is necessary for service delivery).
13.4 How to Exercise Your Rights
To exercise any of the above rights, please:
- Email: Contact us at privacy@vulcanpilot.com with the subject line "California Privacy Request", OR
- Online Form: Submit a request through our privacy request form at https://www.vulcanpilot.com/#contact
- Response Timeline: We will respond to your request within 45 calendar days of receipt. If we need additional time, we will inform you within the first 30 days with an explanation.
- Identity Verification: We may request additional information to verify your identity before processing your request.
- No Discrimination: We will not discriminate against you for exercising your CCPA rights.
14. Cookie Policy
VulcanPilot uses cookies and similar tracking technologies to provide and improve our service.
14.1 What Are Cookies?
Cookies are small text files stored on your device when you visit our website. They help us remember your preferences, understand how you use our service, and improve your experience.
14.2 Cookies We Use
| Category | Purpose | Provider | Duration |
|---|---|---|---|
| Strictly Necessary | Essential for site functionality (authentication, session management) | VulcanPilot | Session |
| Analytics | Understand how visitors use our site (Google Analytics, Vercel Analytics) | Google/Vercel | Up to 2 years |
| Marketing | Track the effectiveness of our marketing campaigns | — | N/A (not currently used) |
14.3 How to Manage Cookies
You can control cookies through your browser settings:
- Google Chrome: Settings → Privacy and security → Cookies
- Safari: Preferences → Privacy → Cookies
- Firefox: Options → Privacy & Security → Cookies
- Microsoft Edge: Settings → Cookies and site permissions
Please note that disabling strictly necessary cookies may prevent you from using certain features of our service.
14.4 Do Not Track
Our site does not currently respond to browser "Do Not Track" signals. We encourage you to use your browser's cookie controls to manage your preferences.
14.5 Third-Party Cookies
Some cookies are placed by third-party services that appear on our pages. We do not control these cookies. Refer to each third party's privacy policy for more information.
15. Company Information
VulcanPilot is operated by:
- Company Name: [To be provided — pending company incorporation]
- Registered Address: [To be provided]
- Contact Email: privacy@vulcanpilot.com
- Privacy Email: privacy@vulcanpilot.com
- DPO Email: dpo@vulcanpilot.com
- Privacy Request Form: https://www.vulcanpilot.com/#contact