1. Overview
Black Bear Group LLC, a California limited liability company doing business as Sellrbox (“Sellrbox”, “we”, “us”), builds Astra, AI-powered advertising software for Amazon sellers and brands. Black Bear Group LLC is the controller of the personal information described here. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.
It covers sellrbox.com, the Astra application, and the emails and text messages we send. It does not cover what Amazon or any other company we do not control does with your information. Your use of our software is also governed by our Terms of Service.
2. Information we collect
Information you give us
- Account and contact details: your name, business email address, phone number, company or brand name, and the marketplaces you sell in.
- Onboarding and support information: anything you send us when you start a trial, book a call, open a support request, or reply to one of our emails.
- Billing information: your plan, billing contact, and transaction records. Card details are entered directly with Stripe, our payment processor, and we never store them.
- Communication preferences: whether you have asked to receive marketing email or text messages from us.
Information we collect automatically
- Device and usage data: IP address, browser and device type, the pages you view, the page that referred you, and timestamps.
- Performance data: anonymous page-load and interaction measurements we use to keep the site fast.
- Security data: request rates and similar signals we use to detect abuse, spam, and brute-force attempts.
Information from accounts you connect
- Amazon Advertising data: when you authorize Astra to connect to your Amazon Advertising account, we receive campaign, ad group, keyword, targeting, budget, bid, spend, and performance data for the profiles you select.
- Authorization credentials: the tokens Amazon issues so that Astra can act on your behalf. They are used only to perform the automation you configure, and they stop working when you revoke access.
- Google account data: if you choose to sign in with Google, Google sends us the email address, name, and profile picture on your Google account, together with the identifier Google uses to recognise it. What we do with that is set out under “Google account data” below.
We do not set out to collect sensitive categories of personal information, such as government identifiers, financial account numbers, health data, precise location, or anything about your background or beliefs. Please do not send them to us.
3. How we use information
- To provide the service: create and secure your account, connect the Amazon Advertising profiles you choose, and run the automation you configure, including bid changes, keyword harvesting, dayparting schedules, negative targeting, and reporting.
- To support you: answer questions, troubleshoot, and follow up on the trials and calls you request.
- To bill you: take payment, prevent payment fraud, and keep tax and accounting records.
- To keep the service safe: monitor for abuse, rate-limit automated requests, and investigate security incidents.
- To improve the service: understand which features get used, diagnose errors, and measure site performance.
- To communicate with you: send account and service notices, and, where you have opted in, marketing email and text messages.
- To meet legal obligations: comply with applicable law, enforce our terms, and respond to lawful requests.
We may also produce aggregated, de-identified statistics and benchmarks from advertising data across accounts, and use them to improve and describe how our software performs. Aggregated data cannot be linked back to you, your brand, or your products, and we do not attempt to re-identify it.
4. Legal bases for processing
If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:
- Performance of a contract: to provide the service you signed up for and to bill you for it.
- Legitimate interests: to secure our systems, prevent abuse, improve our software, and send business communications relevant to your role.
- Consent: for marketing email and text messages, and for any non-essential cookies. You can withdraw consent at any time, and doing so does not affect processing that already happened.
- Legal obligation: to keep the records the law requires us to keep.
5. Cookies and analytics
We use a small number of cookies and similar technologies:
- Strictly necessary: sign-in, session security, and abuse prevention. Sign-in does not work without these.
- Support chat: the messaging window in the corner of every page is provided by Intercom, including its AI assistant. It sets its own cookies so a conversation can continue across pages and visits, and when you are signed in it knows which account you are asking about, together with your plan and trial status, so we do not have to ask. It is a functional part of the site, so it is not governed by the consent banner. Intercom, Inc. processes this data on servers in the United States.
- Performance: anonymous measurements of how quickly pages load and respond.
- Analytics (optional): usage analytics through PostHog. If you are in the European Economic Area, the United Kingdom, or Switzerland, we ask first and analytics stays off until you allow it on the consent banner. Everywhere else it is on by default, and you can turn it off at any time via the Cookie preferences link in the footer. Details below.
- Ad conversion measurement (optional): conversion measurement through Google Ads tells us when a Google ad click leads to a booked call, so we know which ads work. It is governed by the same consent banner and the same regional rule as analytics: in the European Economic Area, the United Kingdom, and Switzerland it stays off until you allow it; everywhere else it is on by default and you can turn it off at any time via Cookie preferences. When it is off or declined, no advertising cookies are stored on your device and ad-click identifiers are redacted; Google may still receive aggregate, cookieless signals that carry no identifiers, similar to the cookieless counting described below. We do not use Google Ads to build advertising profiles of you on this site, and we do not run remarketing. Google LLC processes this data on servers in the United States.
- Embedded third-party content: some pages embed a scheduling tool, a review widget, and a signup form hosted by other companies. Those embeds can set their own cookies, governed by the privacy policies of the companies that provide them.
What analytics collects, when it is on: pages viewed, clicks, the routes you take through the site, and technical basics (browser, operating system, screen size, approximate region). It also records session replays so we can see where pages confuse people; anything you type is masked in your browser before it is sent, and codes, phone numbers, and email addresses shown on screen are masked the same way. Analytics events are kept for one year and replays for thirty days. PostHog Inc. processes this for us on servers in the United States under a data processing agreement; it is never used for advertising and never shared for anyone else's marketing.
If you decline or turn analytics off: nothing more is stored on your device and no replay is recorded. Your visit is still counted through PostHog's cookieless mode, which uses a short-lived pseudonymous identifier computed on the server and rotated daily, so we can see totals without recognizing you across days. In the European Economic Area, the United Kingdom, and Switzerland the same cookieless counting applies while you have not yet made a choice. You can change your choice at any time via the Cookie preferences link in the footer.
Beyond the Google Ads conversion measurement described above, we do not run advertising or cross-site tracking cookies on this website: no remarketing lists, no advertising profiles, no third-party ad networks. You can block or delete cookies in your browser settings, but strictly necessary cookies cannot be turned off without breaking sign-in. Because no common standard for them exists, our site does not respond to browser Do Not Track signals.
6. Text messages
If you give us your mobile number and opt in, we may text you about your trial and your account. Where you have separately agreed to it, we may also send occasional marketing messages. Agreeing to marketing text messages is never a condition of buying anything from us.
- Message frequency varies. Message and data rates may apply.
- To stop: reply STOP to any message. You will get one confirmation and no further marketing texts.
- For help: reply HELP, or email hello@sellrbox.com.
- Delivery: mobile carriers are not liable for delayed or undelivered messages.
We do not sell, rent, or share mobile phone numbers or text-message consent with third parties or affiliates for their own marketing. Your number goes only to the providers that deliver messages for us, and only so they can deliver them.
7. Email and marketing
Service email covers password resets, billing notices, security alerts, and material changes to the software. It comes with having an account, so there is no unsubscribe link on it. Tell us to close your account and it stops.
Marketing email goes only to people who asked for it. Every marketing email has an unsubscribe link, and unsubscribing takes effect on all marketing email, not just that campaign. We send it through a third-party email platform that records opens and clicks so we can tell whether a campaign was worth sending. To be removed by hand, email hello@sellrbox.com.
9. Amazon Advertising data
Astra reaches your campaigns through the official Amazon Advertising API, using access you grant and can withdraw. That access is what makes the product work, so it gets its own commitments:
- We use your advertising data only to provide, support, and improve the service you asked for.
- We do not sell it, and we do not disclose it to other Sellrbox customers in any form that identifies you, your brand, or your products.
- You can disconnect Astra from your Amazon Advertising account at any time, from Astra or from Amazon. Revoking access stops all further automation on that account.
- Our handling of Amazon data is also bound by Amazon's own policies and by the agreements we hold with Amazon, which in places are stricter than this policy.
10. Google account data
Signing in with Google is optional; an emailed code does the same job. If you do use it, Google sends us a small amount of data about your Google account, and Google requires that we say plainly what happens to it:
- What we receive. The email address, name, and profile picture on your Google account, and the identifier Google uses for it. We ask Google for its basic sign-in permissions only (
openid,email, andprofile). We never receive your Google password, and we request no access to Gmail, Drive, Calendar, Contacts, Photos, or any other Google service. - How we use it. To create your Sellrbox account, to sign you in, and to show you which account you are signed in as. If you use the support chat while signed in, the email address and name Google sent us are also what it uses to recognise your account, so we do not have to ask you again. We do not use it for advertising, we do not use it to build a profile of you, and we do not use it to contact you beyond the account and service email described elsewhere in this policy.
- How we store it. With the rest of your account record, for as long as your account is active, under the same protections described in “Security” and the same limits described in “Data retention” below.
- How we share it. We do not sell it and we do not share it for anyone’s marketing. It reaches only the service providers listed under “How we share information”, which host our systems on our behalf and may use it only to do so, including Intercom, which uses it to recognise you in the support chat while you are signed in.
- How to take it back. Remove Sellrbox at myaccount.google.com/permissions at any time. You will still be able to sign in with an emailed code, and closing your account deletes this data along with the rest of it.
11. Data retention
We keep personal information for as long as your account is active, and after that for as long as we need it to meet legal, tax, accounting, and dispute-resolution obligations. Advertising data pulled from Amazon is kept while it is useful for the reporting and automation you use, then deleted or de-identified. Backups are overwritten on a rolling schedule, so a deleted record can persist in a backup for a short period after it leaves the live system.
Ask us to close your account and we will delete or de-identify your personal information within a reasonable period, except where we are required to keep it.
12. Security
We use technical and organizational measures appropriate to the risk: encryption of data in transit, access controls that limit who on our team can reach production data, rate limiting on public endpoints, and encrypted storage for the credentials that connect to your Amazon account.
No system is perfectly secure, and we will not pretend otherwise. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulators as the law requires.
13. International data transfers
We are based in the United States, and our service providers may process information in the United States and other countries whose privacy laws differ from your own. Where we move personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, together with the additional safeguards those clauses require.
14. Your privacy rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it;
- correct information that is wrong;
- delete information we no longer have a reason to keep;
- receive your information in a portable format, or have us send it to someone else;
- object to or restrict certain processing, including direct marketing;
- withdraw consent you previously gave;
- opt out of the sale or sharing of personal information, neither of which we do; and
- not be treated worse for exercising any of these rights.
To exercise a right, email hello@sellrbox.com from the address on your account, or write to the postal address below. We will verify the request, usually by confirming that you control the account email, then respond within the time the applicable law allows: 45 days in California, one month in the EEA and the UK, each extendable where permitted. An authorized agent can act for you; we will ask for proof of their authority.
If you are in the EEA or the UK and our response does not satisfy you, you can complain to your local data protection authority.
15. Additional notice for California residents
Under the California Consumer Privacy Act as amended by the CPRA, we disclose the following about the preceding 12 months.
- Categories collected: identifiers (name, business email, phone number, IP address); commercial information (plan, transactions); internet or network activity (pages viewed, interactions); professional information (company, role, marketplaces); and inferences drawn from these about your advertising needs.
- Sources: you, your device, and the advertising accounts you connect.
- Business purposes: those listed under “How we use information” above.
- Categories disclosed for a business purpose: to the recipients listed under “How we share information” above.
- Sold or shared: none, including for anyone we know to be under 16.
- Sensitive personal information: we do not collect or use it for any purpose that would require us to offer an option to limit that use.
Because we neither sell nor share personal information, neither a “Do Not Sell or Share My Personal Information” request nor a browser Global Privacy Control signal has anything to opt you out of. California residents may also request the information described in the state's “Shine the Light” law (Civil Code § 1798.83) once a year, free of charge.
16. Children's privacy
Our software is sold to businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email us and we will delete it.
17. Third-party sites and services
Our site links to and embeds content from other companies: a scheduling tool, a review platform, a signup form, and our own application at a different address. Those companies have their own privacy policies, and this policy does not govern what they do with information you give them. Read their policies before using those features.
Affiliate referrals: if you arrive through a partner's referral link, our affiliate platform (Tolt) sets a cookie for up to 60 days so that partner can be credited if you become a customer. It records that you followed the link, not your browsing anywhere else. Visitors who don't use a referral link never receive this cookie.
18. Changes to this policy
We update this policy when our practices change; the “last updated” date at the top tells you when we last did. If a change materially affects how we use personal information, we will give notice by email or in the application before it takes effect and, where the law requires it, ask for your consent.
19. How to contact us
Questions, requests, or complaints about privacy:
- Email: hello@sellrbox.com
- Mail: Black Bear Group LLC (dba Sellrbox), 168 N Mason Way, City of Industry, CA 91746, USA
We aim to answer every privacy request within 30 days, and sooner where the law requires it.