Privacy notice — Crateworth

Crateworth is inventory and profitability software for Amazon sellers. This notice explains what personal information we collect when you visit crateworth.com, create an account, or connect an Amazon seller account to Crateworth, how we use it, who we share it with, and the choices you have. Crateworth is operated by Crateworth Ltd, a company registered in England and Wales (company number 17474756), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Crateworth Ltd is the controller of the personal information described here. Contact us athello@crateworth.com.

Your use of Crateworth is also governed by ourterms of service.

Information we receive from Amazon

When you choose to connect Crateworth to Amazon, you are sent to Amazon to sign in and approve access. Amazon then shares information with us through Login with Amazon and the Amazon Selling Partner API, and, if you also connect your advertising account, the Amazon Ads API. We only receive what you approve on Amazon’s consent screen.

Authorisation details: your selling partner ID, the marketplaces you sell in, and the access and refresh tokens that let Crateworth read data on your behalf. Tokens are encrypted before they are stored.
Seller business data: orders, sales, fees, settlements, refunds, reimbursements, inventory, shipments to Amazon warehouses, listings and product catalogue information for your seller account.
Amazon Ads data, if you connect your advertising account: your advertising profiles, the products you advertise with Sponsored Products, the customer search terms that triggered your ads, and their impressions, clicks, spend and attributed sales, including near-real-time updates through Amazon Marketing Stream. Search terms are aggregated by Amazon and are not linked to individual shoppers.
Amazon profile information, where you allow it: your name, email address and Amazon account identifier, used to link your Amazon account to your Crateworth account.

Crateworth does not request Amazon customers’ names, addresses, phone numbers or email addresses. Order data we receive is used for your sales, fee and profit reporting, not to identify or contact your buyers.

We use information received from Amazon only to provide Crateworth’s features to you: syncing your account, calculating profit, costs, VAT, advertising performance and stock positions, and showing reports. We do not sell it, use it for our own or anyone else’s advertising, or share it with anyone except the service providers listed below who help us run Crateworth. Amazon Ads data is shown only to your account and is not combined with other sellers’ data. Our use of Amazon information follows Amazon’sAcceptable Use PolicyandData Protection Policy.

You can disconnect Amazon at any time from Crateworth’s settings, or remove Crateworth’s access in Seller Central underApps and Services → Manage Your Apps, or fromyour Amazon account’s Login with Amazon settings. You can disconnect your advertising account separately in Crateworth’s settings. When access is removed we stop collecting new data from Amazon.

Information you give us

Account details: your name, email address, password (stored only as a secure hash), your sign-in second step settings (emailed codes, or an authenticator app if you add one), and the people you invite to your team. If you sign in with Google, seeSigning in with Google.
Business information: product costs, purchase orders, suppliers and their addresses, shipments, expenses, bank statement imports, invoices and receipts you upload, VAT settings and anything else you enter into Crateworth.
Billing details: your plan and billing address. Card details are collected and stored by Stripe, not by us.
Messages: emails and support requests you send us, including messages sent with Contact support in the app's Help panel, which include the page you sent them from and are handled in PostHog. To give each of these conversations a short title, the first message you write (without the page and account details sent with it) is also sent to Anthropic's AI model. We keep the title with your login for 12 months, and you can rename it.
Help assistant questions: the questions you ask the in-app help assistant, its answers, the page you asked from and whether you rated an answer helpful, grouped into conversations, each with a short title our AI model writes from its first question. We keep them for 12 months to improve Crateworth and its help centre. You can see your own conversations again in the Help panel under Past conversations, rename them and delete them; other people in your account can't see them. Deleting a conversation deletes its questions and answers too.

Signing in with Google

You can create a Crateworth login, or sign in, with your Google account. This section covers the information Google shares with us when you do.

What we receive: your name, your email address, whether Google has verified that address, your Google account ID, and short-lived sign-in tokens. We ask Google only for the basic sign-in permissions (your name, email address and profile). We do not ask for, and cannot see, your Gmail, Google Drive, contacts, calendar or any other Google data. Google also sends your profile picture link, which we discard.
How we use it: only to create your Crateworth login, sign you in, and show your name and email address in your account. We use your email address to send account messages such as sign-in codes. If you already have a Crateworth login with the same, confirmed email address, we link your Google account to it.
Storage and protection: this information is stored with your login in our database, encrypted in transit and at rest. The sign-in tokens are encrypted again before they are stored, and we do not use them after you have signed in.
Sharing: we do not sell Google user data, use it for advertising, or use it to train AI models. We share it only with the service providers that run Crateworth for us, such as hosting, email delivery and product analytics (seeWho we share information with), under contract and only to provide the service, or where the law requires it.
Keeping and deleting it: we keep it while your login exists. Deleting your login deletes it. You can also remove Crateworth's access at any time in your Google account underThird-party apps and services; you can then still sign in with your email address and a password, if you have set one.

Crateworth's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

Information collected automatically

Security and service logs: IP address, browser and device information, sign-in times and request logs, used to keep accounts secure, prevent abuse and fix problems.
Product analytics: within the Crateworth app we use PostHog to record which pages and features are used and to report errors. We remove sensitive values before events are sent, and we do not record the text on the page or the labels of what you click (such as product names or search terms). PostHog also records how the app's pages are used (clicks, scrolling and page layout) so we can replay a visit to find problems. All text, inputs and images are hidden in your browser before anything is sent, so no business or Amazon data is recorded, and nothing is recorded on sign-in and password pages or in the public demo.
Website analytics: on crateworth.com we only set analytics cookies if you allow them. Until you choose, and if you reject them, PostHog measures basic traffic, where people click, page load speed and errors using a daily rotating identifier without storing anything on your device. If you allow them, the analytics cookie is shared with the Crateworth app, so if you create an account, the pages you visited beforehand and the source that brought you (such as a campaign tag or referring website) are linked to it. With cookies allowed, PostHog also records your visits to crateworth.com so we can replay them to find problems: the pages as you saw them and your scrolling, mouse movements and clicks, with anything you type hidden. Recordings are deleted after 30 days, and nothing is recorded if you reject cookies. You can change your choice at any time using “Analytics preferences” in the footer.

How we use information

To provide, maintain and secure Crateworth (performance of our contract with you).
To bill you and keep financial records (contract and legal obligation).
To send service emails such as sign-in links, security alerts and sync problems (contract).
To understand usage, fix errors and improve Crateworth (our legitimate interests).
To use non-essential website cookies (your consent).
To comply with the law and respond to lawful requests (legal obligation).

Some features, such as listing analysis, invoice scanning, bank statement categorisation and the help assistant, use AI models to process the listing content, documents or questions you submit. The help assistant answers from our public help centre and is not given your account's data. The results are shown only to you, and your data is not used to train those models. We do not make decisions with legal or similarly significant effects about you by automated means.

We do not sell personal information. We share it only with service providers who process it on our behalf under contract, and only as needed to run Crateworth:

Hosting and infrastructure: our server providers, Cloudflare (network and security) and Amazon Web Services (notifications, file storage and encrypted backups).
Email: Amazon Simple Email Service, to deliver service emails.
Payments: Stripe, to take payments and manage subscriptions.
AI processing: Anthropic (listing analysis, bank statement categorisation, the help assistant and titles for help and support conversations) and Google (reading invoices and receipts).
Analytics, error reporting and support messages: PostHog.
Mapping and shipment tracking: MapTiler (to place supplier and warehouse addresses on maps) and container tracking providers (using container and vessel references, not personal information).

Amazon Ads data is stored and processed only by our hosting and infrastructure providers: our server providers, Amazon Web Services (which receives Amazon Marketing Stream updates and holds encrypted backups) and Cloudflare (which carries it to your browser). It is not sent to our analytics, email, payment, mapping or AI providers.

We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a sale or reorganisation of our business, in which case this notice will continue to apply.

International transfers

Some of our providers process information outside the UK and European Economic Area, including in the United States. Where they do, we rely on adequacy decisions or standard contractual clauses (with the UK addendum) to protect it.

How long we keep information

We keep your information while your account is open. If you close your account, or ask us to delete your data, we delete it, including all information received from Amazon, within 30 days, except billing and tax records we must keep by law (normally six years). Backups are overwritten on a rolling basis within 90 days. If you disconnect Amazon but keep your account, the historical data already synced stays in your account until you delete it. Help assistant questions and answers, and the titles of help and support conversations, are deleted after 12 months, or sooner when you delete a conversation.

How we protect information

Data is encrypted in transit and at rest. Amazon access tokens are encrypted separately. Each seller’s data is isolated at the database level, staff access is restricted and logged, and every password sign-in needs a second step (an emailed code or an authenticator app). If we become aware of a security incident affecting information received from Amazon, we will notify Amazon and affected users as required.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent at any time. To make a request, email hello@crateworth.com. We will respond within one month. If you are in the UK you can also complain to theInformation Commissioner’s Office, or in the EU to your local data protection authority.

Children

Crateworth is a business service and is not intended for anyone under 18. We do not knowingly collect information from children.

Changes to this notice

We will update this page when our practices change and revise the date at the top. If a change is significant we will tell account holders by email before it takes effect.