Privacy Policy

SellerPort MCP (mcp.sellerport.io) is part of SellerPort. It lets you connect your commerce and advertising accounts once and then ask AI assistants such as Claude and ChatGPT about them through the Model Context Protocol (MCP). This policy explains what we collect when you use the website, the dashboard, the remote MCP connector at https://mcp.sellerport.io/mcp, and the MCP client package.

Questions about this policy can be sent to support@growithamazon.com.

• Account details: your name, email address, workspace name and a salted hash of your password. We never store your password in plain text.
• Connection credentials: the OAuth refresh tokens, access tokens or API keys you authorize for Amazon Seller Central, Amazon Vendor Central, Amazon Ads, Noon, Google Ads, Google Analytics 4, Google Search Console and Meta Ads, plus non-secret identifiers such as seller ids, marketplace ids, profile ids and account names.
• AI client authorizations: when you connect Claude, ChatGPT or another MCP client, we store hashed access and refresh tokens, the client's name and when it was last used. Dashboard-issued MCP tokens are stored only as a hash and a short prefix.
• Usage records: which tool or capability was called, for which connection, when, the outcome and timing, and the IP address of the request. These records power your query history and help us detect abuse.
• Messages you send us through the contact form or by email.

When you or an AI assistant you authorized asks a question, we call the relevant provider API with your credentials and return the result — for example orders, sales, inventory, listings, returns, financial events, reports or ad performance — to that assistant. We fetch this data on demand for that request.

We do not build a permanent copy of your account data. Large Amazon reports may be held in short-lived server memory caches so a slow report can finish in the background and a repeated question does not request it again; these caches expire within hours and are cleared when the service restarts.

Results you request are delivered to the AI client you chose, and from then on that provider's own privacy policy applies to them (for example Anthropic for Claude and OpenAI for ChatGPT).

• To run the service: sign you in, keep your connections working, refresh expiring provider tokens, and answer the requests you or your AI assistant make.
• To carry out changes you explicitly ask for, such as a price, stock, listing, campaign or purchase order update.
• To secure the service: rate limiting, detecting misuse and investigating incidents.
• To support you when you contact us.

We do not sell your information, use it for advertising, or use your connected account data to train AI models. We do not share data from one workspace with any other workspace.

• The providers you connect (Amazon, Noon, Google, Meta), to make the API calls you request on your behalf.
• The AI clients you authorize, which receive the results of the tools they call.
• Infrastructure providers that host our servers and database, under confidentiality obligations and only to operate the service.
• Authorities, when the law requires it.

Provider refresh tokens and API keys are encrypted with AES-256-GCM before they are stored and are decrypted only on the server for a single provider call. They are never sent to your browser or to an AI client. All traffic uses HTTPS. AI client access tokens expire after one hour and refresh tokens are rotated on every use. See Security for details.

Account details and connection credentials are kept while your workspace is active. Disconnecting a provider deletes its stored credentials immediately. Disconnecting an AI client revokes its tokens immediately. Usage records are kept for your query history and security, and are deleted with your workspace. When you delete your account we delete your workspace data, except where the law requires us to keep it.

• Disconnect any provider or AI client at any time from the dashboard, or remove the connector inside Claude or ChatGPT.
• Revoke our access at the provider as well, for example in Seller Central under Manage Your Apps or in your Google account permissions.
• Ask us for a copy of your information, to correct it, or to delete your account by writing to support@growithamazon.com.

We answer requests within 30 days.

SellerPort MCP is a business service and is not directed to anyone under 18.

If we change this policy we will update the date above, and for material changes we will notify account owners by email before they take effect.