Privacy policy

Effective 15 October 2026 · applies to mcp.optimiseres.com, its MCP server and the Optimiseres authorisation pages

Who we are

Optimiseres ("we", "us") is an agency that manages Amazon advertising and marketplace operations for brands and sellers. Optimiseres AmzMCP is our platform: it connects authorised Amazon accounts to the AI tools our team and our clients use (such as Claude, ChatGPT, Codex, Gemini and OpenCode) through the Model Context Protocol (MCP), and runs the reports and automations our clients ask for.

What we collect

• Account details - your name, work email, password (stored only as a salted hash) and, if you turn it on, your two-step verification secret.
• Usage records - which tools were called, for which client and marketplace, when, and whether the call was allowed. We keep these to secure the service and to show you and your admin what happened.
• Sign-in records - time, IP address and browser of each sign-in, to detect sign-ins you did not make.
• Messages you send us - support requests and contact form messages.
• Amazon data - only for the Amazon accounts whose owner has authorised us; see the next section.

Amazon data

An Amazon account owner authorises us either by approving our application on Amazon's own consent page (Selling Partner API or Amazon Ads API) or by inviting our team email as a user of their advertising account. We never ask for or receive Amazon passwords. Authorisation gives us a refresh token, which we store encrypted.

With that authorisation we read the data needed for the services the client asked for, such as advertising campaigns, keywords, search terms, budgets and performance, product listing information, inventory, sales and order totals and business reports. We use Amazon data only to provide services to the client who authorised us, and we handle it in line with Amazon's Acceptable Use Policy and Data Protection Policy.

• We do not sell Amazon data, use it to advertise to Amazon customers, or combine one client's data with another's for anyone else.
• We do not contact Amazon customers, except where a client has asked us to send Amazon's own review request through Amazon's official API.
• Where Amazon provides personal information about buyers, we use it only to fulfil the client's request and keep it no longer than Amazon's Data Protection Policy allows.

How we use information

• To run the service: answer questions in AI tools, build reports, apply changes a client approved, and send reports to the recipients a client chose.
• To keep it secure: access control per client and marketplace, rate limits, alerts on unusual activity, and audit logs.
• To support you and to tell you about changes that affect your account.

Changes to live Amazon campaigns, budgets or listings are made only for accounts that authorised us, by people or rules the client has allowed, and every change is logged.

Who we share information with

We do not sell personal information. We use service providers who process data on our behalf, under contracts that require them to protect it:

• Amazon Web Services - hosting, storage and analytics of report data.
• Google Workspace - client reports and spreadsheets we prepare for clients.
• Email delivery - verification codes, alerts and reports.
• WhatsApp delivery (Periskope) - report images sent to the WhatsApp groups a client chose.
• AI tool providers - when you connect an AI tool, the answers our MCP server returns are sent to that tool, under your agreement with its provider.

We may also disclose information when the law requires it, or to protect our users and the service.

Security

Data is encrypted in transit (HTTPS/TLS). Amazon refresh tokens and app secrets are encrypted at rest. Access is limited to authorised staff, per client and per marketplace, with two-step verification available for every account. See Security and data for details.

Retention

• Account and usage records: while your account is active, then up to 12 months for security and audit purposes.
• Amazon report data: while the client relationship is active; deleted on request or within 90 days after the client leaves.
• Amazon authorisation tokens: deleted when a client revokes access, asks us to, or leaves.

Data deletion

A client can revoke our access at any time - in Seller Central (Apps and services, Manage your apps) or in the Amazon Ads console (User management) - and Amazon stops our access immediately. To have us delete the data we hold for you or your Amazon accounts, email contact_us@optimiseres.com or use the contact form. We confirm the request and complete it within 30 days.

Your rights

You can ask to see, correct, export or delete your personal information, and you can withdraw an authorisation at any time. Depending on where you live you may have further rights under local law; we will honour them.

Changes to this policy

We will post any change here with a new effective date, and tell account holders by email when a change is significant.

Contact

Questions about privacy or data: contact_us@optimiseres.com or the contact form.