- Home
- Privacy policy
Privacy policy
What we collect, why, who else handles it and how to make us delete it. No fine print hiding inside the fine print.
In short
We collect what it takes to run WavyCloud: your contact details, your account and settings, and the Amazon data you ask about. We never request Amazon buyer names or addresses. We don't sell or share personal information, we don't train AI models on your data, and the site has no analytics or ad trackers. Email hello@wavycloud.com to see, fix or delete what we hold about you.
On this page
Who we are
WavyCloud makes the MCP connector for the Amazon Ads API and the Amazon Selling Partner API. This policy covers wavycloud.com, the WavyCloud app and the connector at https://mcp.wavycloud.com/mcp. “We” and “us” mean WavyCloud.
For your account, billing and the forms on this site, we decide how your information is used. For the Amazon data we fetch for you, we act on your instructions: we fetch it when you or your schedules ask, and use it to answer you.
WavyCloud is not affiliated with Amazon. Amazon's own privacy notice covers what Amazon does with your data.
What we collect
When you visit wavycloud.com
- Request data. Like every website, ours receives your IP address, browser and device type, the page you asked for and the page that sent you. Our host, Cloudflare, processes it to deliver the site and keep out abuse.
- Fonts. Pages load fonts from Google Fonts, so your browser sends your IP address and browser details to Google.
- No trackers. The site has no analytics, no ad pixels and no tracking cookies. See Cookies and local storage.
When you fill in a form
- Free trial form: your work email, the plan you picked and which form you used.
- Monsoon application: your name, work email, brand or store name, monthly revenue and ad spend ranges, and anything you write in the notes box.
- With every form: the time we received it, your approximate country (worked out from your IP address by Cloudflare) and your browser's user agent.
When you use WavyCloud
- Account details: your name, email, company and sign-in details.
- Billing details: your plan, invoices and billing address. Card numbers go straight to our payment processor; we don't see or store them.
- Amazon connection: the access tokens Amazon issues when you approve WavyCloud, your seller account ID, marketplaces and the ad profiles you pick. Never your Amazon password.
- Amazon data you ask about: orders and order items without buyer names or addresses, sales metrics, inventory, shipments, fees, settlements, catalog, pricing, ad campaigns, keywords, bids and reports.
- Your setup: settings, schedules, alerts, and the change log of every ads change you approved.
- Requests from your AI app: the tool calls your AI app sends us, such as “list campaigns for this profile,” and our logs of them. We don't see the rest of your conversation.
- Messages: support emails and, on Monsoon, our shared Slack channel.
What we never collect
- Amazon buyer names, addresses or phone numbers. Those need a restricted data token from Amazon, and WavyCloud never requests one.
- Your Amazon password. You approve access on Amazon's own consent screens.
- Card numbers. Our payment processor handles them.
How we use it
- To run WavyCloud: answer your requests, run your schedules, deliver reports and alerts, and make the ads changes you confirm.
- To reply to you: about a trial, a Monsoon application or a support question.
- To bill you and keep the records tax law requires.
- To keep it secure: spot abuse, prevent fraud and fix errors.
- To make it better: we look at how the product is used, such as which tools get called and how often they fail.
- To tell you things: service notices, and the occasional product update you can unsubscribe from.
What we don't do:
- Sell or share personal information. We don't sell it, rent it or share it for cross-context behavioral advertising.
- Train AI models. We don't train models on your data or your Amazon data.
- Reuse Amazon data. We use data from Amazon only to provide WavyCloud to you. We don't use it to contact your customers, and we don't share it with other sellers.
Legal bases (EEA and UK)
If you're in the European Economic Area or the UK, these are the legal bases we rely on:
| What we do | Legal basis |
|---|---|
| Run WavyCloud and bill you | Performing our contract with you |
| Reply to a form or an application | Steps you asked for before a contract, and our legitimate interest in answering |
| Security, logs and product improvement | Our legitimate interest in a safe, working product |
| Product update emails | Our legitimate interest, or your consent where the law requires it |
| Tax and accounting records | Legal obligation |
Who we share it with
We share information only with the companies that help us run WavyCloud, and only what each one needs:
| Who | What they get | Why |
|---|---|---|
| Cloudflare | Site and connector traffic, form submissions, stored data | Hosting, storage, logs and security |
| Google Fonts | Your IP address and browser details | Delivering the site's fonts |
| Amazon | Requests we make for you, signed with your tokens | Fetching your data and applying changes you confirm |
| Your AI provider | The results your AI app asks for | You chose them; see below |
| Our payment processor | Billing details | Charging your plan |
| Our email and team chat tools | Messages, form submissions, scheduled reports | Talking to you and delivering reports |
Your AI provider. When your AI app asks WavyCloud a question, the answer goes into your chat with Claude, ChatGPT, Cursor or whichever app you use. From there, that provider's privacy policy and your plan's settings apply, including whether chats are used for training. Pick the plan and settings you're comfortable with.
We also disclose information when the law requires it, to protect our rights or someone's safety, or to a buyer if WavyCloud is sold or merged. In a sale, we'll tell you before your data moves to a new privacy policy.
How long we keep it
| Data | How long |
|---|---|
| Website request logs | Up to 7 days |
| Form submissions | Up to 24 months after our last conversation, unless you become a customer |
| Account, settings and change log | While your account is open, then deleted within 30 days of closing it |
| Amazon access tokens | Until you disconnect the account or close WavyCloud |
| Amazon data you ask about | Only as long as it takes to answer the request or deliver the report |
| Billing records | As long as tax and accounting law requires |
How we protect it
- Encrypted in transit. Every page and connector request uses HTTPS.
- Encrypted at rest. The tokens Amazon issues are encrypted before we store them.
- Least access. Seller Central access is read-only. Ads access stays read-only until you allow changes, and every change needs your confirmation. See Security and privacy.
- Need to know. Only the people who run WavyCloud can reach customer data, and only to do their job.
- If something goes wrong. If a breach affects your data, we'll tell you without undue delay, and Amazon too where its developer policies require it.
No system is perfectly secure, but we built this one to hold as little as it can.
Your choices and rights
Wherever you live, you can:
- Ask what we hold about you, and get a copy.
- Ask us to correct it or delete it.
- Unsubscribe from product updates with the link in any of them.
- Disconnect Amazon in WavyCloud, or revoke access from Amazon: Apps and Services → Manage Your Apps in Seller Central, and the Login with Amazon apps list in your Amazon account for ads.
EEA and UK. You can also object to or restrict how we use your data, ask for it in a portable format, withdraw consent at any time, and complain to your local data protection authority.
California and other US states. You have the right to know what we collect, to delete it, to correct it and to opt out of its sale or sharing. We don't sell or share personal information, and we don't use sensitive personal information to infer things about you. We won't treat you differently for using your rights. An authorized agent can ask on your behalf. We treat a Global Privacy Control signal as an opt-out, though there's nothing to opt out of.
How to ask. Email hello@wavycloud.com with “Privacy” in the subject. We'll confirm the request comes from you, usually from the email address on your account, and reply within 30 days.
Cookies and local storage
- No tracking cookies. wavycloud.com sets no analytics or advertising cookies.
- One local storage item. If you close the announcement bar, your browser remembers it with
wc-announce-closed. It stays on your device and never reaches us. - Security cookies. Cloudflare may set a strictly necessary cookie, such as
__cf_bmorcf_clearance, to tell people from bots. - Signing in. The WavyCloud app uses strictly necessary cookies to keep you signed in.
International transfers
We and our providers process data in the United States and in the other countries where Cloudflare runs its network. When personal data leaves the EEA, the UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
Children
WavyCloud is a tool for businesses. It isn't directed at children, and we don't knowingly collect personal information from anyone under 16. If you think we have, email us and we'll delete it.
Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use data you've already given us, we'll email customers before it takes effect.
Contact
Questions, requests or complaints: hello@wavycloud.com, subject “Privacy.” A person reads every one.