Security & Amazon data

Last updated 29 October 2026

Brands trust Shelfcrew with access to their Amazon Ads account. This page explains exactly what we access, why, how we protect it, and how to report a security, privacy or data misuse issue.

What Shelfcrew does with Amazon Ads

Shelfcrew is software for brands that sell on Amazon, as professional sellers enrolled in Brand Registry or as vendors. It helps them collect creator video ads, run them on Meta, and measure the Amazon sales each video drives with Amazon Attribution. Shelfcrew doesn't buy media, resell ad inventory, sell products, or create, change or pause Sponsored Ads campaigns.

Amazon data we access, and why

Data	Why we need it
Advertiser profiles you authorize	To let you pick which Amazon Ads account to connect
Amazon Attribution advertiser and publisher IDs	To create tags for the right account and channel (such as Meta)
Attribution tags created by Shelfcrew	One tag per approved creator video, so each video's results can be measured
Aggregated daily Attribution results per tag and product (clicks, detail page views, add-to-carts, purchases, sales)	To show your results per video and creator, and to calculate the commission you set for each creator

We request only these permissions. Attribution reports are aggregated and contain no shopper-level personal data. Read access is used once a day per connected account, within Amazon's rate limits.

How we handle Amazon data

Your data stays yours. Only your brand team sees your Amazon data. Creators see only their own earnings, calculated on your instruction, never your account data or other creators' results.
No selling or combining. We don't sell, license or share Amazon data with other brands or third parties, combine it with other third-party data, use it for ad targeting, or use it to train machine learning models.
Service providers only. Amazon data is processed only by our hosting provider, under a confidentiality and data processing agreement, to run Shelfcrew.
Deletion. You can disconnect Amazon Ads at any time. We then revoke the access token and delete your Amazon data within 30 days.

How we protect it

Brands connect through Login with Amazon (OAuth 2.0). We never ask for Amazon passwords.
Refresh tokens are encrypted at rest and never sent to the browser.
All traffic uses TLS (HTTPS). Data is hosted in the EU with Hetzner.
Each brand's data is separated by account, and access is checked on every request.
Staff access is limited to the people who need it, with two-factor authentication on admin tools.
Access to Amazon data is logged, and we review logs for misuse.

Report a security, privacy or data misuse issue

If you find a vulnerability, suspect a privacy problem, or believe Amazon or customer data is being misused, email security@getshelfcrew.com. Please include what you found, how to reproduce it, and how to contact you.

We confirm receipt within 2 business days.
We investigate, contain the issue and keep you informed of progress.
We fix confirmed vulnerabilities as quickly as their severity requires, and tell you when they are resolved.

We won't take legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and that gives us reasonable time to fix the issue before disclosure. Our security.txt has the same contact details.

If an incident happens

If we confirm a security incident involving Amazon data, we notify Amazon and affected brands within 24 hours, contain it, and share what happened and what we changed. Where personal data is involved, we also notify the Dutch Data Protection Authority within 72 hours and inform affected people when the law requires it.