Privacy Policy

When you sign up, we collect your email address and authentication data via Supabase Auth (including Google OAuth data if you sign in with Google — name, email address, and profile picture).

Amazon product URLs or ASINs you submit for analysis, supplier email addresses you enter to send fix emails, and any settings or preferences you configure.

To generate a report, we retrieve publicly available Amazon product and review data (product title, images, price, and customer reviews) for the ASIN you submit, using third-party scraping providers.

Log data, device/browser information, IP address, and usage patterns (e.g. reports generated, credits used) collected automatically when you use the Service.

If you purchase a paid plan or credits, our payment processor collects and processes your billing details. We do not store full payment card numbers on our own servers.

• Provide, operate, and maintain the Service, including generating your fix-plan reports
• Authenticate you and manage your account and credit balance
• Process payments and manage subscriptions
• Send transactional emails (e.g. report ready, supplier fix email you initiate, billing receipts)
• Improve and troubleshoot the Service, including using AI models to generate report content
• Detect, prevent, and address fraud, abuse, or technical issues
• Comply with legal obligations

We do not sell your personal information. We share information only with:

• Infrastructure and processing providers we use to run the Service: Supabase (database and authentication), Vercel (hosting), OpenAI (AI analysis of review content), and Amazon data providers such as Bright Data, Scrapingdog, and Apify (to retrieve product and review data)
• PostHog (product analytics), to understand how the Service is used so we can improve it
• Our payment processor, to handle subscriptions and one-time purchases
• Resend, to deliver transactional and supplier-outreach emails on your behalf
• Law enforcement or regulators when required by law, or to protect our rights, users, or the public

Each of these providers processes data under their own privacy and security terms.

We retain account data for as long as your account is active. Generated reports are cached for up to 30 days to avoid re-charging you for the same analysis, then may be deleted or refreshed. You can request deletion of your account and associated data at any time (see “Your Rights” below).

Depending on your location, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. To exercise any of these rights, contact us at the email below.

We use essential cookies to keep you signed in and to remember basic preferences. We do not use third-party advertising cookies, and we do not sell or share your data with advertising networks.

For product analytics we use PostHog, configured to run without cookies and without storing any identifier in your browser. We record which pages are visited and which actions are taken (for example, a report being generated or an export downloaded) so we can see what works and what doesn’t. Once you sign in, this activity is associated with your account.

Because nothing is stored on your device, repeat visits are recognised using a temporary identifier that PostHog derives on its servers from your IP address and browser type. It is rotated daily and cannot be used to identify you across sites or to build an advertising profile. We rely on our legitimate interest in understanding and improving the Service for this processing, and you can object to it using the contact details below.

We do not record session replays of your screen. Where interaction data is collected, all form fields are masked, so passwords, email addresses, and payment details are never captured. Payment forms run inside our payment processor’s own window and are not visible to us at all. Analytics data is processed on US-based infrastructure.

We use industry-standard measures — including encryption in transit, access controls, and row-level security on our database — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

The Service is intended for business use by Amazon sellers and is not directed to children under 16. We do not knowingly collect personal information from children.

Our infrastructure providers may process and store data in the United States and other countries. By using the Service, you consent to this transfer and processing.

We may update this Privacy Policy from time to time. We will update the “Last updated” date above when we do, and material changes will be communicated by email or in-app notice where appropriate.

If you choose to publish a Public Growth Case Study (an optional, paid-plan feature), some information becomes publicly visible and search-indexable. This only happens after you review the exact page and give explicit consent.

The product identity and ASIN, paraphrased summaries of recurring review themes, our recommendations, and the brand name, statement, responses, optional quote, and product image you supply.

Raw or verbatim customer reviews, reviewer names or other personal information, your account, billing, or credit data, and the private internal report (such as health scores and revenue estimates). Any product image shown is one you upload, not an Amazon-hosted image.

To evidence your authorization, we keep an append-only record of each consent action — including the version of the wording you agreed to, a hash of the exact content, the permissions you granted, a timestamp, and privacy-safe hashes of your IP address and browser (never the raw values).

You stay in control: you can change permissions or unpublish the page at any time from your dashboard, and deleting your account unpublishes any associated pages.

Questions about this Privacy Policy or your data? Email us at support@vibeflip.io.