Privacy Policy

Version 1.1 · last updated 16 September 2026. This policy is reviewed at least once a year and whenever the service changes how it handles personal data; material changes are announced to account holders by e-mail.

Sellergoo (sellergoo.com) is a profit-and-operations analytics service for e-commerce sellers, operated by Huseyin Kurtoglu Wolfsohn (sole proprietor), Alte Schulgasse 9, 64850 Schaafheim, Germany · [email protected]. Sellergoo is a subscription SaaS: each customer connects their own marketplace or store account and Sellergoo processes that data on the customer's behalf.

When a seller connects an account (e.g. Shopify, Amazon, eBay) via authorization (OAuth) or API credentials, we read that seller's own business data required for analytics: orders, order line items and SKUs, prices, fees, refunds/returns, settlements and payouts, inventory levels, product listings and account/performance metrics.

Our integrations retrieve order and financial fields. We do not request buyer payment details, and we never build profiles of end-customers.

Delivery details. Where a seller uses multi-channel fulfilment — a marketplace order that Sellergoo hands to a fulfilment provider such as Amazon MCF — the delivery address is part of the order and is required to create the shipment. For those orders we store the recipient name, street address, postal code, city, state/region, country and, where the marketplace supplies them, a contact phone number and e-mail address used solely for carrier and delivery notifications. This applies only to orders from channels that carry a delivery address; the majority of orders we process carry none and none is stored for them.

This data is processed on the connected seller's behalf and on their instructions (Art. 28 GDPR): it is used to create and track shipments they request, and for aggregate regional reporting at postcode/region level. It is never used for our own marketing, never enriched, never sold, never shared with other customers, and never used to contact a buyer on our own account — automated buyer messaging runs through the marketplace's own messaging API, so we do not need and do not keep a buyer mailing list. Repeat-customer analytics use a one-way hash, not a name.

Data is used solely to provide the connected seller with analytics and automation: net profit, margins, ROI and cost per order/product, inventory and reorder insights, repricing and review-request automation, and consolidated multi-channel reporting. We do not use it to advertise to end-customers, to profile end-customers, or for resale.

Amazon Advertising. Where a seller connects their Amazon Advertising account, we retrieve campaign, ad group, keyword, target and search-term reporting together with the associated spend, click and conversion metrics for that seller's own advertiser profile only. This data is used solely to produce that seller's own profitability reporting and optimisation suggestions, and — where the seller enables it — to submit bid, budget and campaign-state changes they have approved. Amazon Advertising data is stored in the seller's isolated tenant, is never combined with another advertiser's data, never used to build benchmarks or models, never used for our own retail or advertising decisions, and never shared with or sold to third parties. It is deleted when the seller disconnects the account or requests deletion.

Data is processed and stored on our own server in a Hostinger data center in Frankfurt, Germany, with traffic routed through Cloudflare. It is encrypted in transit (TLS) and credentials are encrypted at rest (AES-256). Each customer's data is isolated in a separate per-account database; no customer can access another customer's data. Access is limited to authorized staff on a least-privilege basis.

Backups. A daily backup of those databases is encrypted on our server — with a key the storage provider does not hold — and copied to object storage operated by Cloudflare (R2). That storage bucket is restricted to the European Union jurisdiction, so backup copies cannot leave the EU. Backups are kept for 30 days and then deleted — which also means that data deleted at your request remains in an encrypted backup copy for up to 30 days before it ages out.

Where it is stored, and where it is accessed from. All storage and processing happens inside the European Union: the application and its databases on a server in Germany, backup copies in an EU jurisdiction-restricted bucket. No customer data is stored outside the European Union.

Customer data is processed by the service itself, on that German infrastructure. Development is carried out in a separate environment against generated test data, never against customer data, and changes reach production through an automated deployment pipeline rather than by hand. Administrative access to live systems is governed by the role-based controls in our security policy, limited to what the task requires, carried only over an authenticated encrypted connection, and recorded with its source address every time customer data is reached.

We do not sell or share connected-account data with third parties for their own purposes. The only processors involved are our infrastructure provider (Hostinger, under a data-processing agreement) and, for subscription billing only, Stripe — Stripe receives billing/payment data, never marketplace order data.

Nothing in this section happens unless you switch it on. It applies only if a member of your workspace deliberately connects an AI assistant. Sellergoo publishes a connector built on the Model Context Protocol (MCP), which lets a seller connect an AI client of their choice — such as Claude (Anthropic) or ChatGPT (OpenAI) — to their own workspace. It is off by default. No data reaches any AI provider until someone approves a connection on a consent screen naming the client and the workspace, and after that only as the answer to a question that person asks. If you never connect one, nothing here applies to you.

Once connected, the connector can read the following, and nothing else:

• Workspace and connection status — workspace name and plan, how many channels, orders and products it holds, the name of the AI client, and the name and e-mail address of the account that approved the connection.
• Sales and profit figures — sales, units, refunds, fees, cost of goods, advertising, expenses, gross and net profit, margin and ROI, plus a month-by-month profit and loss.
• Order economics — order number, channel, date, status, the items on the order, and its sales and fee totals.
• Per-SKU figures, settlements, stock levels and alert events.

Order records returned by the connector carry no buyer names, no postal addresses, no e-mail addresses or telephone numbers and no payment or bank details. The tools return order economics and SKUs, not customer identities. The connector also never calls a marketplace API — it reads only the data Sellergoo already holds for that workspace.

Connecting sends the data you ask for to the AI provider you chose. From the moment it leaves us, that data is handled under that provider's own terms and privacy policy — how long they keep it, where they process it and whether their staff may review it are their decisions, not ours. Providers based outside the European Economic Area will normally process it outside the EEA. Read the provider's terms before you connect.

Access is read-only. The only scope issued is mcp:read and no write tool exists, so the connector cannot create, change or delete anything — not in Sellergoo, and not in any marketplace or store account you have connected. Each token is bound to one workspace and can never read another.

Of the connection itself we store only sha256 hashes of the access and refresh tokens — never the tokens themselves — with the client's name, which account approved it, when, and when it was last used. Access tokens expire after one hour. We do not store your prompts or the assistant's replies; we never see them. Data returned through the connector is not used to train any model.

You can revoke a connection at any time under Settings → API keys → Connected AI apps. Revocation takes effect immediately, with no grace period, and the refresh token cannot mint a replacement. It stops all future access; it cannot recall data already delivered to the AI provider. Technical detail is at /docs/mcp.

We retain connected-account data for as long as the connection is active. A seller can disconnect at any time, which revokes our access. For Shopify, uninstalling the app (and the subsequent shop-redaction request) revokes the store token and disconnects the store. You can also request deletion of your data at any time by contacting [email protected]. On termination, or on request, we delete the workspace and the database file that holds its data; encrypted backup copies containing it age out within 30 days, after which no copy remains.

Sellers (and, where applicable, their end-customers) have the rights granted under the GDPR, including access, rectification, erasure and portability. For any privacy request or question, contact [email protected] — the mailbox we monitor for privacy matters, and the first point of contact for a data incident or an authority inquiry. The German-language data-protection statement is available at /datenschutz.