Privacy Policy

Introduction

1stPage LLC (“1stPage,” “we,” “us,” or “our”) provides an analytics and AI platform for Amazon sellers, vendors and the agencies that work with them (the “Service”). This Privacy Policy explains what information we collect through the Service and our website at 1stpage.com, how we use and share it, how long we keep it, how we protect it, and the choices and rights you have, including under the EU and UK General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”).

This Policy forms part of our Terms & Conditions, and the two use the same defined terms. If your organization has signed a master services agreement, order form, data processing agreement or similar written agreement with 1stPage (a “Signed Agreement”), that agreement controls where it conflicts with this Policy (see Section 13). Questions about this Policy can go to privacy@1stpage.com.

Key terms

Customer: the company or other organization that holds a 1stPage workspace, and Users are the people a Customer allows to use it.
Customer Data: data a Customer or its Users submit to the Service, or that the Service retrieves on the Customer’s behalf, including Amazon Data, questions asked of our AI features and the answers they produce, dashboards, schedules and settings.
Amazon Data: data the Service retrieves from Amazon services (such as the Amazon Selling Partner API and the Amazon Ads API) under the authorization a Customer grants.
AI Providers: the third-party AI model providers that power our AI features. Today they are OpenAI and Anthropic.

Our role. For Customer Data, we act on the Customer’s instructions as its service provider (a “processor” under GDPR). For account, billing, website and security information about Users and visitors, we act as the “controller.” If you are a User and want to exercise rights over Customer Data, we may refer you to the Customer that controls the workspace.

1. Information We Collect

In Short: We collect the details you give us when you sign up and use the Service, the Amazon Data you authorize us to retrieve, and technical and usage data generated when you use the Service or visit our website.

Information you provide

Account details: name, email address, password (stored only as a one-way hash), company name, and the role and permissions you assign to Users. If you sign in with Microsoft, we receive your name, email address and organization identifier from Microsoft; if you sign in with Google, we receive your name and email address from Google. When you create an account, we record that you agreed to our Terms & Conditions and this Policy, with the date, time and version.
Billing details: billing contact, plan and payment history. Card details go directly to our payment processor, Stripe; we do not store full card numbers.
Content you create: questions you ask our AI features and the answers returned, saved conversations, dashboards, alerts, schedules, notes and other settings.
Communications: what you send us through support emails, our contact and demo-request forms, or meetings, such as your name, work email, company and message.

Amazon Data

You connect Amazon accounts by authorizing 1stPage through Amazon’s own consent screens for the Selling Partner API and the Amazon Ads API. We never ask for your Amazon password, and we do not sign in to Seller Central or Vendor Central on your behalf unless you choose to give our team named user logins. You can revoke our access at any time in your Amazon account.

Depending on what you connect and which features you use, Amazon Data can include:

sales and orders (including vendor purchase orders and shipments);
inventory and fulfillment;
advertising campaigns, settings and performance;
brand analytics, search and market-share data;
returns and customer feedback;
financial and settlement data, such as fees and payouts; and
catalog and listing data.

Most Amazon Data is business performance data, but some of it relates to Amazon buyers. It can include limited buyer-related fields that Amazon provides: shipping city, state, postal code and country; free text buyers write in returns and feedback; and buyer email addresses that Amazon has anonymized through its relay service. We do not request or hold Amazon’s restricted buyer data, such as buyer names, street addresses or phone numbers. We use Amazon Data only to provide the Service to the Customer that connected it, as Amazon’s data protection and acceptable use policies require. We never use it to market to or contact Amazon buyers.

Information collected automatically

Usage and log data: pages and features used, actions taken, AI credit usage, timestamps, and errors.
Device and network data: IP address, browser and device type, and operating system.
Security records: sign-ins, verification codes sent, permission changes and similar events, with the IP address and browser that made them.
Website analytics: on our website and, where you allow it, in the app, we use Google Analytics and first-party cookies as described in Section 8.

We do not knowingly collect sensitive personal information such as government ID numbers, precise geolocation, health or biometric data.

2. How We Use Information

In Short: We use information to run the Service for you, keep it secure, bill for it, support you, and improve it. We do not sell personal information.

To provide the Service: create and manage accounts, verify sign-ins, retrieve and process Amazon Data, produce dashboards, alerts, scheduled reports and AI answers, and carry out actions you enable or approve.
To bill and support you: manage plans, AI credits and payments, and answer questions.
To communicate with you: send sign-in codes, account, billing and security notices, reports you schedule, and notice of changes to our terms. We send marketing email only where the law allows it, and you can opt out at any time.
To secure the Service: detect and prevent fraud, abuse and unauthorized access, and investigate incidents.
To improve the Service: analyze usage, errors and performance, in aggregated form where we can. We do not use Customer Data to train AI models.
To comply with law: keep financial records and respond to lawful requests.

Legal bases (GDPR). If you are in the European Economic Area, the UK or Switzerland, we rely on: performance of our contract with you or your organization; our legitimate interests in running, securing and improving the Service, where those interests are not overridden by your rights; your consent, for website analytics and marketing where required, which you can withdraw at any time; and compliance with legal obligations.

3. AI Features and AI Providers

In Short: When you use AI features, we send your question and the Customer Data needed to answer it to our AI Providers. They do not train their models on it.

The Service includes AI features such as chat, insights, recommendations and scheduled AI reports. When you use them, we send your request, the relevant Customer Data that our tools retrieve to answer it, and the conversation context to an AI Provider, currently OpenAI or Anthropic, through their commercial APIs. The AI Provider processes it to generate the response and returns it to us.

Under their API terms, our AI Providers do not use the data we send them to train their models.
AI Providers may keep API data for a limited time to monitor for abuse and misuse. OpenAI, for example, keeps it for up to 30 days and then deletes it unless the law requires otherwise.
We keep your conversations and AI-generated reports in the Service so you can return to them, until you delete them or they are deleted under Section 6.
AI output can be wrong or incomplete. Our Terms & Conditions explain how to rely on it.

4. AI Clients, the Platform API and Other Integrations

In Short: If you connect another app to 1stPage, the data you ask it to retrieve goes to that app and is then governed by its terms.

You can connect third-party AI clients, such as ChatGPT, Claude or other tools that support the Model Context Protocol (MCP), to your 1stPage workspace, or call our Platform API with an API key. When you or the AI client ask 1stPage for data, we send the requested Customer Data to that client. From then on, its handling is governed by the client provider’s terms and privacy policy, not this Policy, and that provider is not one of our service providers. The same applies to other destinations you set up, such as a Slack workspace or email recipients for alerts and scheduled reports. Connections only reach the data the connecting User can see, and you can revoke them in the Service at any time.

6. Data Retention and Deletion

In Short: We keep Customer Data while your account is active and delete it when the account is deleted or our agreement ends. Database backups expire on a rolling schedule, and security logs are kept for at least 12 months.

Customer Data is kept for as long as the Customer’s account is active. When a connected Amazon account is deleted, its data is deleted after a short grace period (currently 14 days) during which it can be restored. When a Customer’s agreement with us ends or the Customer asks us to close its workspace, we delete its Customer Data.
Backups: our production databases are backed up automatically, and those backups expire on a rolling schedule (after 14 days for our main database). Deleted data leaves the backups as they expire.
Security logs, such as sign-in and access records, are kept for at least 12 months.
Account and billing records: User account details are kept while the account exists. We keep invoices and other records we are legally required to keep, such as tax records, for the period the law requires.
Website and form data: analytics data is kept according to our Google Analytics settings, and messages you send us are kept as long as needed to respond and follow up.

Data that has left our systems at your direction, for example data sent to an AI client you connected, is outside our control and is handled under that recipient’s terms.

7. Data Security

In Short: Data is encrypted in transit and at rest, access is restricted and logged, and we will tell you if a security incident affects your data.

In transit: connections to the Service are encrypted with HTTPS, and plain HTTP requests are redirected to HTTPS. Our API accepts only TLS 1.2 or higher.
At rest: production databases, caches, object storage, backups and server volumes are encrypted with AES-256. Amazon authorization tokens and other credentials are encrypted again at the application level.
Access: password sign-ins are verified with a one-time code sent by email or from an authenticator app, unless the User has chosen to trust that device, and organizations can require Microsoft sign-in instead. Access within a workspace follows the roles the Customer assigns. Access to our production systems is limited to authorized personnel. Security-relevant events in the Service are logged, and AWS CloudTrail and GuardDuty record and monitor activity in our cloud infrastructure.
Incidents: if we confirm a security incident that affects personal information or Customer Data, we will notify the affected Customers without undue delay, and regulators and individuals where the law requires.

No system is perfectly secure, and we cannot guarantee that data will never be accessed without authorization. Please use a strong password, keep your sign-in codes private, and tell us right away at support@1stpage.com if you suspect unauthorized use of your account or find a security vulnerability.

8. Cookies and Site Analytics

In Short: We use a few first-party cookies to run the site and our homepage experiment, and Google Analytics to understand visits. We do not use advertising cookies.

Essential: the app uses browser storage to keep you signed in and remember your settings, and the website remembers your analytics choice.
Homepage experiment: we test different versions of our homepage. A first-party cookie (hp_v, kept for 90 days) records which version you saw so it stays the same on your next visit. When you go from the website to the app to sign up, the version you saw is passed along so we can measure which version leads to sign-ups.
Google Analytics: measures visits, page views and clicks on our website, and in the app records sign-up and account-connection events, linked to the homepage version you saw. We do not send your name, email address or any Amazon Data to Google Analytics, and Google’s advertising features are turned off.

If you visit from the European Economic Area, the UK or Switzerland, Google Analytics does not load unless you agree. Elsewhere it is on by default and you can opt out. You can change your choice at any time with “Analytics choices” in our website footer, or through your browser’s cookie settings.

9. Children’s Privacy

The Service is for business use by adults. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact privacy@1stpage.com and we will delete it.

10. Your Privacy Rights

In Short: Depending on where you live, you can ask to access, correct, delete or move your personal information, and to object to or limit how we use it.

EEA, UK, Switzerland and other regions

Access: confirmation of whether we process your personal information, and a copy of it.
Rectification: correction of inaccurate or incomplete personal information.
Erasure: deletion of your personal information, unless an exemption applies.
Restriction: limits on processing in certain circumstances.
Portability: your data in a structured, machine-readable format.
Objection: to processing based on legitimate interests, and at any time to direct marketing.
Withdrawing consent: at any time, without affecting processing that already happened.

You can also complain to your local data protection authority, though we would appreciate the chance to address your concern first.

California (CCPA)

Right to know and access the personal information we collect, use and disclose about you.
Right to delete personal information we collected from you, subject to exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising.
Right to limit use of sensitive personal information: the only sensitive personal information we hold is account sign-in credentials, which we use only to provide the Service.
Right to non-discrimination for exercising these rights.

Categories collected and disclosed. In the past 12 months we have collected identifiers (such as name, email address, IP address and account identifiers), customer records (contact and billing details), commercial information (plan, billing and usage history), internet or network activity (log, usage and analytics data), and limited buyer-related information contained in Amazon Data as described in Section 1. We disclosed these categories for business purposes to the service providers listed in Section 5. We have not sold or shared personal information.

How to make a request. Email privacy@1stpage.com. California residents may use the subject line “CCPA Request.” We will verify your identity, or your agent’s authority, before acting, and respond within the time the law requires (45 days under the CCPA). Requests about Customer Data may be referred to the Customer that controls it.

11. Do-Not-Track Signals

There is no common standard for responding to browser “Do Not Track” signals, so we do not respond to them. You can control website analytics as described in Section 8.

12. International Transfers

1stPage is based in the United States, and we store and process data in the United States. If you use the Service from outside the U.S., your information will be transferred to the U.S. For personal data from the EEA, UK or Switzerland, we rely on safeguards the law recognizes, such as the European Commission’s Standard Contractual Clauses, or on the transfer being necessary to perform our contract with you. Contact privacy@1stpage.com for more information.

13. Signed Agreements

If your organization has a Signed Agreement with 1stPage, including any data processing terms in it, the Signed Agreement governs how we handle your organization’s Customer Data. Where it conflicts with this Policy, the Signed Agreement controls. This Policy still applies to everything the Signed Agreement does not address.

14. Updates to This Policy

We may update this Policy as the Service, our providers or the law change. The “Last Updated” date above shows when it last changed. If we make a material change, we will notify account owners by email or in the Service before it takes effect. Continuing to use the Service after the change takes effect means you accept the updated Policy.

15. Contact Us

Email privacy@1stpage.com or write to: 1stPage LLC, Attn: Privacy, 12175 Visionary Way, Fishers, IN 46038, USA. To report a security issue, email support@1stpage.com with “Security” in the subject line.