Legal

Privacy Policy

Effective date: October 23, 2026

1. Who we are

Selltics is operated by Individual Entrepreneur Myroshnichenko Dmytro, registered at 17 Tekstylna St., Bldg. 41, Kherson, Kherson District, Kherson Region, Ukraine ("Selltics", "we", "us"). For the purposes of the GDPR and similar laws, Individual Entrepreneur Myroshnichenko Dmytro is the data controller for the personal data described in this policy. For any privacy question or request, contact us at support@selltics.net.

2. Scope

This policy covers this website, the Selltics dashboards, the Selltics support site, and the Selltics AI Telegram bot (together, the "Service"). The Service is built for business use by sellers, vendors, and agencies — it is not intended for personal or household purposes.

Amazon and Telegram are independent platforms: they process your data under their own terms and privacy policies, before and independently of anything Selltics does. Where the Service links to external sites or documentation, those sites have their own privacy practices, which we do not control.

3. Data we collect

We collect data in three ways: what you give us directly (signing in, messaging the bot, writing to support), what you authorize us to fetch through APIs (Amazon advertising data), and what is generated automatically when you use the Service (logs, billing records).

Account data

You sign in with an email address and a password, or with your Google account. For your account we keep:

your name and email address;
your password, only as an argon2id hash — never the password itself. A password set before we moved to argon2id was stored as a bcrypt hash; it is replaced by an argon2id hash the next time you sign in with it;
if you sign in with Google: the identifier Google assigns to your Google account, and the email address and name Google shares, together with whether Google has verified that address — we only accept an address Google reports as verified;
the statement you confirm when you sign up — that you are at least 18 and use Selltics for business;
if you turn on two-factor authentication: the secret your authenticator app shares with us, encrypted, and your recovery codes, only as keyed hashes;
a record of each signed-in session — when it started and was last used, how it was signed in, and the IP address and browser (user agent) it came from — and, if you choose "trust this device", a record of that browser with the same details;
a consent record: the versions of the Terms and of this Privacy Policy you accepted, when, how (password sign-up or Google), and the IP address and user agent of that request;
security audit events about your account — sign-ins and failed sign-ins, lockouts, password changes and resets, and changes to two-factor authentication — with the IP address and user agent they came from;
an email delivery log for the account and security messages we send you: which message, when, and whether it was delivered, with the recipient only in masked form (for example j***@example.com) and as a one-way hash — never the message body.

Amazon advertising data

With your authorization, we collect advertising data from the Amazon Ads API and Amazon Marketing Stream: campaign structures, ad groups, ads, targets, portfolios, and performance metrics (impressions, clicks, spend, attributed sales, and related measures). This is performance data about your advertising — it contains no buyer names, addresses, or other buyer personal details.

Amazon Marketing Stream delivers the performance records of a whole advertiser account, the Amazon Ads account that a profile belongs to. While at least one profile of an advertiser account is activated in your organization, we archive the performance records of every profile of that account, including the profiles you have not activated. The records of a profile you have not activated are stored in the archive only: they are not loaded into your workspace, not shown in the Service, and not used by any feature. How long they are kept is set out in Section 8.

Telegram data

When you use the Selltics AI bot, we store your Telegram chat ID and username and the messages you exchange with the bot, so the bot can hold a conversation and you can review past answers.

Billing data

We keep your prepaid balance and an itemized transaction ledger of what each feature consumed, and a payment record for every top-up: the amount and currency, our order reference and the provider's payment id, the status, and the timestamps. Your billing address and any VAT or tax id are collected at checkout by Paddle, the merchant of record, and are not stored by Selltics.

Card payments are processed by Paddle (Paddle.com Market Ltd, UK / Paddle.com Inc, US), the merchant of record and payment processor listed in our Data Processing Addendum. Paddle is the seller of every top-up: it hosts the card form, calculates and remits any applicable VAT or sales tax, and issues the invoice and receipt. You enter your card on Paddle's own hosted checkout, and your browser returns to your dashboard afterwards. Your card details never reach Selltics: we do not receive your card number, we do not receive your CVV, and no card is stored for later use. There is no card on file to charge: every charge, including the monthly Company plan fee, is drawn from the prepaid balance you topped up yourself, never from a stored payment method.

Paddle confirms the outcome of the payment to us with a server webhook. It carries our order reference, Paddle's transaction and customer ids, the amount and currency, the status and the timestamps, and the last four digits of the card in Paddle's masked form — never the full number, never the CVV. We keep that confirmation exactly as Paddle sent it for 90 days. After that the body is erased and only the record that the event was received remains.

Support communications

If you contact us with a question or an issue — by email, or through the form on our support site at Selltics Support — we keep the correspondence and any material you share with it, so we can resolve the issue and improve support; the form itself collects only what you type into it: the email address you give us, so we can reply, and the message. It has no name field and no free-text subject — the subject is built from the fixed list of topics on the page — and the application records no IP address, no user agent, and no referrer about a submission, though the web front end in front of it keeps a standard access record of the request and the address it came from, as any web server does.

On the normal path the submission is not stored at all — it is handed to our support mailbox while the request is still open, and afterwards exists only as mail in that mailbox — and if that hand-off fails, the message is held on the server as a single file until delivery succeeds, and for no longer than 30 days. There is no auto-reply, no ticket system, and no ticket number, and correspondence in the mailbox is not deleted on a schedule.

Technical data

Standard operational logs (timestamps, request metadata, error traces) needed to run and secure the Service.

The sign-in, sign-up and password-reset forms run a Cloudflare Turnstile challenge in your browser. Turnstile evaluates signals from your browser and its connection to tell people from automated abuse; we receive only its verdict, and confirm it with Cloudflare together with the IP address the request came from.

4. How we use data

To provide the Service: analytics, answers, charts, and tables built from your advertising data.
To run the automations and scheduled jobs you configure.
To meter usage against your allowances and charge your prepaid balance for what you use.
To communicate with you about the Service: answers to your requests, notices about changes, billing, and security.
To provide support and investigate issues you report.
To secure the Service and prevent abuse.

We do not sell your data, we do not rent it, and we do not use it for advertising to you or anyone else.

5. Legal bases

Where the GDPR or UK GDPR applies, we process personal data on these bases:

Performance of a contract — operating your account, producing analytics, running your automations, and billing.
Legitimate interests — securing the platform, preventing abuse, and improving the Service, balanced against your rights.
Performance of a contract and legitimate interests — securing your account: two-factor authentication, session records, sign-in lockouts, and security audit events.
Legitimate interests — keeping the consent record as evidence that you accepted the Terms and this policy, and to establish or defend legal claims.
Consent — marketing communications and optional integrations you switch on; you can withdraw consent at any time.
Legal obligation — keeping billing records for accounting and tax law.

6. AI processing

Selltics AI answers your questions by querying your own data and passing the relevant excerpts to a large language model. Your data is never used to train AI models — ours or anyone else's. Your workspace is isolated: your data is never mixed with, compared against, or shown to any other seller.

We share data only with the subprocessors required to operate the Service — infrastructure providers, the merchant of record that sells and processes card top-ups (Paddle), the configurable large language model providers behind Selltics AI, and the messaging platform the bot runs on. Cloudflare, besides carrying all platform traffic and running the Turnstile challenge, delivers the account and security emails we send you (Cloudflare Email Service) and forwards mail sent to our support address (Cloudflare Email Routing). The complete, current list, with what each one does, is published in the Data Processing Addendum.

Each subprocessor is bound by contractual confidentiality and data-protection obligations. Beyond that, we disclose data only if the law requires it (a valid legal request from a competent authority), or as part of a merger, acquisition, or sale of assets — in which case this policy continues to apply to your data and we will notify you before your data becomes subject to a different one. We never sell or rent your data to third parties.

8. Retention and deletion

Amazon Ads history — the advertising metrics and catalog history collected from the Amazon Ads API and Amazon Marketing Stream, and the raw stream archive that holds the records as received. The original archive is partitioned per advertiser and marketplace; the performance archive is partitioned per advertiser account and profile. The history of every profile you have activated is kept indefinitely, so that you can compare a period with the same period in earlier years. Disconnecting the Amazon Ads account stops its collection, and deleting a profile stops collection for that profile; neither deletes this history; deleting the last activated profile of an advertiser account stops collection for the whole account. It is deleted only on your written request to support@selltics.net, naming the profiles concerned: within 30 days of the request we delete it from our live databases and from your partitions of the raw archive. Archive records that cannot be attributed to an advertiser and marketplace, and records whose delivery to the archive failed, are kept for at most 21 days. A copy in the weekly backup of the metrics database is removed by the rotation that follows a successful weekly backup once it is more than 28 days old, at most 35 days after it was taken while the weekly backups succeed.
Never-activated profiles — the archived performance records of the profiles of an advertiser account that your organization never activated (Section 3). They are deleted 7 days after the last activated profile of the advertiser account is deleted, unless a profile of that account is activated again within those 7 days. A written request for a profile that removes the last activated profile of its advertiser account also deletes, within the same 30 days, the archived records of the account's never-activated profiles; the history of the account's other activated profiles is kept until a written request names them.
Amazon Selling Partner data — this differs from the Amazon Ads history above. Order data is read from Amazon through the Selling Partner API on each request and is not kept as a history, and disconnecting a Selling Partner account deletes its authorization token immediately.
Telegram conversation history — kept so you can review past answers; deleted on account deletion.
Billing ledger records and payment records — retained as long as required for accounting and tax law. The invoice and receipt for each top-up are issued by Paddle, the merchant of record.
Raw payment-provider callbacks — the confirmation body Paddle sends for a payment is kept for 90 days and then erased. The payment record itself stays as an accounting record.
Support correspondence — a submission is held on the server only until it reaches our support mailbox, and for at most 30 days if delivery keeps failing. Correspondence in the mailbox itself is not deleted on a schedule.
Operational logs — rotated on a short schedule measured in weeks, not years.
Unconfirmed sign-ups — an account whose email address is not confirmed within 7 days of sign-up is deleted, together with its consent record.
Session and trusted-device records — kept while they are in use, and deleted 30 days after the session or the trusted device expires or is revoked.
Email delivery log — kept for 30 days, then deleted.
Security audit events — kept for 365 days, then deleted.
Two-factor authentication data — the encrypted authenticator secret and the recovery codes are deleted when you turn two-factor authentication off, or when support resets it for you. Trusted devices are revoked at the same moment (deleted outright on a support reset), and a revoked record follows the 30-day rule above.
Consent records — kept for 3 years after the account is deleted (the general limitation period under the Civil Code of Ukraine, art. 257), as evidence that the Terms and this policy were accepted. After that period we remove a consent record on request; it is not deleted automatically.

You can request full account deletion at any time via support@selltics.net; a request that names your Amazon Ads history is carried out within 30 days, as set out above.

9. Security

Access to Amazon is via OAuth only — revocable by you at any time in your Amazon account; we never hold your password.
The Service supports two-factor authentication with an authenticator app (time-based one-time codes).
When you choose a password, we check it against known breached passwords without sending it anywhere: only the first 5 characters of its SHA-1 hash go to the Pwned Passwords range API, never the password and never the full hash.
Data is encrypted in transit (TLS 1.2+).
The platform runs in a private cluster behind an encrypted tunnel — nothing is exposed directly to the Internet.
The full set of technical measures — authentication protections, patch timelines, incident response — is published in the Information Security Policy.

If a security incident affects your personal data, we will notify you without undue delay and within any legally required timeframe, along with what happened and what we are doing about it.

10. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, to restrict or object to its processing, and to withdraw consent. To exercise any of these rights, email support@selltics.net. We may need to verify that a request really comes from you (or from an agent you authorized) before acting on it, and we respond within the timeframe the applicable law sets. Exercising your rights never changes the price or quality of the Service you receive.

11. Regional disclosures

EEA and United Kingdom

Individual Entrepreneur Myroshnichenko Dmytro is the controller of your personal data. You may lodge a complaint with your local supervisory authority (or the authority in Ukraine), though we would appreciate the chance to resolve your concern directly first.

California

Under the CCPA/CPRA you have the right to know what personal information we collect (the categories are listed in Section 3), to access it, to correct it, to delete it, and to not be discriminated against for exercising those rights. Selltics does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of. Requests can be submitted — directly or through an authorized agent — at support@selltics.net.

12. International transfers

Our infrastructure providers may process data outside Ukraine. Where they do, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision covering the destination country.

13. Marketing communications

Messages that are part of the Service — bot replies, usage notices, billing and security notifications — are transactional and sent as long as you use the Service. By email, these are the account and security messages:

confirmation of your email address;
a notice that someone tried to register with your address;
a password reset link — or, for an account that signs in only with Google, a notice that it has no password to reset;
a notice that your password was changed;
a notice that sign-in was paused after repeated failed attempts (account locked);
a notice that Google sign-in was linked;
notices that two-factor authentication was turned on, turned off, moved to a new authenticator, or reset by support;
notices that a recovery code was used and that your recovery codes were regenerated.

They carry no unsubscribe link, because they are not marketing: they tell you about your own account and its security. Marketing messages (product news, feature announcements) are sent only with your consent, and every one includes a way to unsubscribe. Opting out of marketing never affects the Service itself.

14. Cookies and tracking

This marketing site sets no analytics or advertising cookies and embeds no third-party trackers. Fonts are self-hosted and served from our own domain — no request goes to Google Fonts.

The sign-in pages run the Cloudflare Turnstile challenge described in Section 3. Signing in to the Service uses only strictly necessary cookies, set by our API:

accessToken and refreshToken — keep you signed in across the sign-in and dashboard domains;
mfaTicket — holds a pending sign-in for up to 5 minutes while you enter your two-factor code;
trustedDevice — set only when you choose to trust a browser, so it is not asked for a two-factor code for 30 days;
oauthState — protects a Google sign-in in progress for up to 10 minutes.

Because we do not track visitors, there is nothing for a "Do Not Track" browser signal to disable: every visitor is treated as if the signal were on.

15. Children's privacy

The Service is a business tool for users aged 18 and over. We do not knowingly collect personal data from anyone under 18; if you believe a minor has provided us data, contact us at support@selltics.net and we will delete it.

16. Changes to this policy

We may update this policy as the Service evolves. Material changes are published on this page with a new effective date before they take effect. The current version is always available at this page; it is effective as of October 23, 2026.

17. Contact

Questions, requests, or complaints about privacy: support@selltics.net, or by post at Individual Entrepreneur Myroshnichenko Dmytro, 17 Tekstylna St., Bldg. 41, Kherson, Kherson District, Kherson Region, Ukraine.