How XTREME ROI handles data.

1. Scope

This Privacy Policy applies to XTREME ROI's public website, sales and support communications, consulting services, reporting, internal business applications, and any client-facing dashboards or portals that we operate.

When we process marketplace, advertising, sales, listing, logistics, inventory, or other client business data on behalf of a client, we generally act as a service provider or processor under that client's instructions. Clients remain responsible for the privacy notices, permissions, and legal bases required for the data they provide to us or authorize us to access.

2. Information we collect

Depending on how you interact with us, we may collect or receive the following categories of information:

• Contact and business information, such as name, email address, company, role, phone number, billing details, and communications with our team.
• Account and access information, such as login credentials, authorized user details, email domain verification, authentication records, user roles, and access permissions.
• Client business data, such as marketplace performance, advertising metrics, sales data, listing data, catalog data, inventory, fulfillment, supply chain information, reports, tasks, notes, and other operational information provided by clients or authorized integrations.
• Dashboard and application usage data, such as pages viewed, actions taken, timestamps, device and browser type, IP address, approximate location, log files, error logs, and security events.
• Website and analytics data, such as cookie identifiers, referral sources, pages visited, and similar information used to operate, secure, and improve the website.

3. How we use information

We use information to operate our agency, provide services, and protect client data. This includes:

• Providing marketplace consulting for Amazon sellers, advertising management, listing optimization, operations support, reporting, and related services.
• Operating internal tools, client dashboards, portals, reports, automations, and administrative systems.
• Authenticating users, enforcing access controls, monitoring authorized use, and maintaining security logs.
• Analyzing marketplace and advertising performance, identifying account opportunities, creating recommendations, and measuring outcomes.
• Using AI-enabled tools and automation to support analysis, prioritization, content workflows, reporting, quality control, and internal operations.
• Responding to inquiries, scheduling calls, providing support, managing contracts, billing, compliance, and legal obligations.
• Improving our website, services, dashboards, processes, documentation, and client experience.

We may use aggregated or de-identified information for internal analysis, benchmarking, service improvement, and business planning, provided it does not reasonably identify a client, individual, or confidential client account.

4. Internal apps and client dashboards

XTREME ROI operates internal applications that may display client statistics and operational information to authorized XTREME ROI personnel, including users authenticated with an xtremeroi.com email address or other approved credentials.

We may also provide client-facing dashboards or portals that require client login. Client dashboard users may see account, campaign, sales, operational, or reporting information associated with the client account or role they are authorized to access.

• Users are responsible for maintaining the confidentiality of their login credentials and for promptly notifying us of suspected unauthorized access.
• Clients are responsible for telling us when a user should be added, changed, or removed from dashboard access.
• We may log dashboard activity for security, auditing, troubleshooting, compliance, and service quality purposes.
• We may restrict, suspend, or remove access if we believe credentials have been compromised, a user is no longer authorized, or continued access may create a security or confidentiality risk.

4a. Amazon selling partner data (Stats & Strats)

This section applies when a brand authorizes Stats & Strats, our analytics app, to read its data through the Amazon Selling Partner API or the Amazon Ads API. It supplements the rest of this policy, and where the two differ for Amazon data, this section controls.

What we access. For a seller account, Stats & Strats requests the Brand Analytics role only. That gives it read access to aggregated reports such as sales and traffic by product, search query and search catalog performance, search terms, market basket, and repeat purchase reports. For an advertising account, it reads campaign performance reports. We do not request access to orders, buyer names, shipping addresses, email addresses, phone numbers, tax information, or any other personally identifiable information about Amazon customers. If a report ever contained such information, we would not store it.

How we use it. We use Amazon data only to provide Stats & Strats to the brand that authorized it: to build that brand's dashboards, reports, and weekly action list, and to support that brand's account if it is an XTREME ROI client. We do not sell Amazon data, use it to advertise to anyone, share it with other sellers, combine it with other brands' data, or use it to build benchmarks or products for anyone else.

Who can see it. A brand's Amazon data is visible only to the users that brand authorizes and to the XTREME ROI personnel who need it to operate the app or serve that brand. Access is granted per brand, reviewed regularly, and removed promptly when someone no longer needs it.

Service providers. We store and process Amazon data using infrastructure providers, such as our cloud hosting provider, that act on our instructions under confidentiality and security obligations. We do not otherwise disclose Amazon data to third parties, except where the law requires it.

How we protect it. Amazon data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256. Application sign-in goes through an identity provider, requests are authenticated at the network edge before they reach the app, and API credentials are held as encrypted secrets that are never exposed to browsers. Access to production systems is limited to authorized personnel, and we log access for security and auditing.

Retention and deletion. We keep a brand's Amazon data while its authorization is active, so the app can show week-over-week and year-over-year history. When a brand revokes access or asks us to delete its data, we delete its stored Amazon data within 30 days, unless the law requires us to keep it longer. Brands can revoke access at any time in Seller Central under Manage Your Apps, or in their Amazon Ads account.

Security incidents. If we become aware of a security incident involving Amazon data, we will notify Amazon at security@amazon.com within 24 hours of detection, notify affected brands without undue delay, contain and investigate the incident, and cooperate with Amazon and law enforcement as required.

Amazon's policies. We handle Amazon data in line with Amazon's Acceptable Use Policy and Data Protection Policy for Selling Partner API developers. Questions or deletion requests can be sent to privacy@xtremeroi.com.

5. How we share information

We do not sell personal information. We do not use client business data for cross-context behavioral advertising. We may share information in the following limited circumstances:

• With service providers and vendors that help us host, secure, analyze, support, automate, communicate, bill, and operate our services.
• With platforms, integrations, marketplaces, advertising channels, or tools authorized by a client or needed to perform requested services.
• With professional advisors, such as attorneys, accountants, auditors, and insurers.
• When required by law, legal process, court order, subpoena, government request, or to protect rights, safety, security, property, or enforce agreements.
• In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to appropriate confidentiality protections.

6. Security and access controls

We use reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, misuse, loss, disclosure, alteration, and destruction. These may include authentication, access controls, logging, vendor review, encrypted transmission where appropriate, and internal confidentiality practices.

No website, application, dashboard, integration, or storage system can be guaranteed to be completely secure. If you believe your account, dashboard access, or information has been compromised, contact us immediately.

7. Data retention

We retain information for as long as needed to provide services, operate dashboards and internal applications, comply with legal and contractual obligations, resolve disputes, enforce agreements, maintain backups, preserve security logs, and support legitimate business needs.

Clients may request deletion or return of client business data, subject to applicable law, contractual requirements, backup retention, accounting records, security records, and other legitimate retention needs.

8. Privacy rights and choices

Depending on where you live and the information involved, you may have rights to request access, correction, deletion, portability, restriction, or objection to certain processing of personal information. You may also have the right to opt out of certain uses of personal information where applicable law provides that right.

To exercise privacy rights, contact us using the details below. If your information is part of a client account or dashboard, we may direct your request to the relevant client or ask the client to confirm the request.

XTREME ROI does not knowingly collect personal information from children under 13 and does not direct its services to children.

9. Cookies, analytics, and third-party sites

Our website and applications may use cookies, local storage, pixels, analytics tools, and similar technologies to operate the site, remember preferences, measure performance, improve services, and help protect accounts. You can adjust cookie settings through your browser, but some features may not work properly without them.

Our website, reports, or dashboards may link to third-party websites, platforms, marketplaces, or tools. Their privacy practices are governed by their own policies, not this Privacy Policy.

10. International processing

XTREME ROI is based in the United States. Information may be processed in the United States and other locations where we or our service providers operate. These locations may have privacy laws that differ from those in your jurisdiction.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make changes, we will update the effective date above. If changes are material, we may provide additional notice through the website, dashboard, email, or other reasonable method.

12. Contact us

If you have questions about this Privacy Policy, dashboard access, client data, or a privacy request, contact us at [email protected] or through your XTREME ROI representative.