Privacy Policy

Last updated: July 20, 2026

This Policy describes how HatchEcom, LLC. ("AstralQ", "we") collects, uses and protects information when a seller or vendor ("Seller") authorizes AstralQ to access their Amazon account through Login with Amazon.

1. Information we receive

AstralQ accesses only the data of the Seller who expressly authorizes it, through the official Amazon APIs (Selling Partner API, Data Kiosk and Amazon Advertising API). This includes catalog, orders, inventory, sales and traffic data, financial reports and advertising campaign metrics.

2. How we use the information

Solely to provide the service to the Seller who authorized it: combine their data, detect operational events (stockouts, sales drops, ad spend without return), generate narratives and projections, and display them in their dashboard.

3. Authorization and scope

Each Seller authorizes access through the Login with Amazon OAuth flow. Access is limited to the requested roles and may be revoked at any time from "Manage Your Apps" in Seller/Vendor Central.

4. Security

Information is encrypted in transit (TLS) and access tokens are stored encrypted at rest. We restrict internal access by roles and job functions. We maintain an incident response plan and will notify security@amazon.com and the affected Seller of any material security incident within 24 hours.

5. We do not sell data

We do not sell the Seller's information. We do not use the information for third-party advertising or to train models shared with third parties.

6. Subprocessors (where data is hosted)

Information is processed only on the following services, under confidentiality and compliance agreements:

• Amazon Web Services (AWS) — cloud infrastructure (managed PostgreSQL, storage, compute) in the US region.
• Amazon Selling Partner API y Amazon Advertising API — the original sources of the Seller's data.

We will notify the Seller of any material change to the subprocessor list at least 30 days in advance.

7. Retention

We retain information while the Seller keeps the authorization active. Access tokens are stored encrypted for as long as they are needed to operate the service.

8. Deletion

The Seller can request deletion of their data at any time by emailing jonathan.a@hatchecom.com or by revoking authorization from "Manage Your Apps" in Seller/Vendor Central.

Deletion process:

• Within 30 days of the request or revocation, we delete: access tokens, derived processing data (events, narratives, projections) and account configuration.
• Encrypted backup copies are purged within the following 90 days, per backup retention cycles.
• We confirm deletion to the Seller by email once completed.

All of the above complies with the Amazon Data Protection Policy (minimum-necessary retention and deletion on request).

9. Your rights (GDPR, CCPA and applicable laws)

Depending on your jurisdiction, the Seller may exercise the following rights by emailing jonathan.a@hatchecom.com:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): delete your data per section 8.
• Portability: receive your data in a structured format.
• Objection and restriction of processing.
• Non-discrimination: we will not penalize you for exercising these rights.

We respond to verifiable requests within 30 days. To file a complaint you may contact your local data protection authority.

10. International transfers

Information is processed in the United States. By using the service, the Seller consents to the transfer of their data to the US under standard contractual clauses and applicable frameworks (e.g. EU-US Data Privacy Framework, where applicable).

11. Compliance

AstralQ complies with the Amazon Services Solution Provider Agreement, the Acceptable Use Policy and the Data Protection Policy, incorporated by reference into our Terms of Service.

Privacy contact

For any privacy inquiry, data request or deletion request: jonathan.a@hatchecom.com

HatchEcom, LLC. — United States