Privacy Policy

1.Introduction#

Wrath is committed to protecting your privacy. We will not use or share your information except as described in this Privacy Policy. If you have a question at any point, email us at [email protected].

2.Information we collect#

Account information

When you create an account, we collect information you provide directly to us, including:

• Name and email address
• Account credentials
• Business information
• Billing details, which are processed by our payment processor Stripe (see Payments)

Amazon seller and advertising data

When you connect your Amazon Seller Central and Amazon Advertising accounts, we access and collect data including:

• Sales data and order information
• Fees, settlements and other financial events
• Product listings, pricing and inventory data, including FBA inventory and inbound shipments
• Advertising campaign data (Sponsored Products, Sponsored Brands, Sponsored Display)
• Campaign performance metrics (impressions, clicks, conversions, ACOS, ROAS)
• Keyword and targeting data
• Bid and budget information
• Advertising costs and spend data
• Profit and loss calculations based on your data

Email accounts you connect

Connecting an email account is optional. If you connect a Gmail account, we access the data described in Google user data. If you connect a Microsoft Outlook, Outlook.com, Hotmail or Microsoft 365 account, we access the data described in Microsoft user data. If you connect another mailbox using IMAP, we store the server login you enter in encrypted form and use it only to read your messages, in the same way as described for Outlook. We do not send, delete or change email in an IMAP mailbox.

Content you add

You may upload or enter content such as suppliers, contacts, costs, prices, product information and documents ("Content"). We access Content only as needed to provide and maintain the Service, resolve support requests you raise, comply with law or address policy violations.

Usage data

We automatically collect information about how you interact with the Service, including:

• Log data and IP addresses
• Device information and browser type
• Pages visited and features used
• Time and date of access

3.How we use your information#

We use the information we collect to:

• Provide, maintain and improve our Amazon seller analytics, advertising management and supplier management features
• Process transactions and manage your subscription
• Analyse your Amazon sales and advertising performance
• Generate reports and insights about your business
• Automate and optimise your Amazon advertising campaigns
• Show your supplier and brand email conversations in your workspace, if you connect an email account
• Send you technical notices, updates and support messages
• Respond to your comments, questions and customer service requests
• Monitor and analyse trends, usage and activities
• Detect, prevent and address technical issues and fraudulent activity

Data from Google and Microsoft is used only as described in Google user data and Microsoft user data, which take precedence over this section for that data.

4.Google user data#

This section explains how Wrath accesses, uses, stores, shares and deletes data from your Google Account when you connect a Gmail mailbox. It applies only if you choose to connect one.

What we access

When you connect a Gmail mailbox, Wrath asks Google for one permission: read-only access to your Gmail messages and settings (the gmail.readonly scope). With it we access:

• Your Gmail address, to identify the connected mailbox
• Email messages: sender, recipients (To and Cc), subject, date, message and thread identifiers, a short preview, the message text, and the HTML version where a message has no plain-text version
• Message headers needed to group replies into conversations
• Attachment names and details, and the attachment files themselves
• A Gmail sync marker, so we only fetch messages that are new since the last sync

We read messages received from the start date of your import onwards, plus new messages as they arrive while the account stays connected.

We do not ask for permission to send, delete, label or change your email, and we do not access your Google contacts, calendar or Drive. Read-only access cannot change anything in your mailbox.

How we use it

We use Gmail data only to provide features you can see in Wrath:

• Finding your conversations with suppliers, brands and distributors and showing them in your Wrath workspace
• Linking those conversations to the matching supplier or brand records
• Recognising business documents in attachments, such as invoices, price lists and account application forms, so you can review them
• Keeping your workspace in sync with new messages

We do not use Google user data for advertising, including personalised, retargeted or interest-based ads. We do not sell it, and we do not use it to determine credit-worthiness or for lending purposes. We do not use it to develop, improve or train generalised artificial intelligence or machine-learning models.

No person at Wrath reads your Gmail data unless you give us permission for specific messages (for example, when you ask for support), it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymised for internal operations.

How we store and protect it

• The access and refresh tokens Google issues are encrypted before we store them, and are used only by our servers.
• Gmail data is fetched from Google over encrypted (HTTPS) connections.
• Imported messages are stored in our database, separated per account, so only your Wrath account can see them.
• Attachment files are stored in encrypted cloud storage (Amazon Web Services S3, encrypted at rest).

How we share it

We do not sell Google user data or transfer it to third parties, except:

• To service providers that host and run the Service for us (such as cloud hosting and storage), who process it only on our instructions to provide the Service
• To Generect, our business contact lookup provider, only if contact lookup is switched on for your account and you ask Wrath to find contacts at a supplier or brand. Generect receives that company's website domain, which may have been found in your imported email, and, if you choose to reveal a contact's email address, that person's name or the identifier Generect returned. It never receives your messages or attachments.
• When needed to comply with applicable law, or to protect the security of the Service and its users
• As part of a merger, acquisition or sale of assets, in which case we will notify you first and the data stays subject to this policy

How long we keep it and how to delete it

• When you disconnect a mailbox in Wrath, we immediately stop fetching new messages and delete the stored Google tokens and sync marker.
• Messages and attachments already imported stay in your workspace, so your supplier history remains complete, until you ask us to delete them.
• To delete imported Gmail data, email [email protected] from the address on your Wrath account. We will delete the messages and attachments imported from that mailbox and confirm by email when it is done.

How to revoke access

You can stop Wrath's access to your Gmail at any time, in either or both of these ways:

1. In Wrath: disconnect the mailbox in your mailbox settings. This deletes our stored tokens and stops all syncing.
2. In your Google Account: go to Third-party apps with account access, choose Wrath and remove its access. This cancels the permission at Google itself.

We recommend doing both. Revoking access does not by itself delete messages already imported; see the deletion steps above.

Limited Use

Wrath's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

5.Microsoft user data#

This section explains how Wrath accesses, uses, stores, shares and deletes data from your Microsoft account when you connect an Outlook, Outlook.com, Hotmail or Microsoft 365 mailbox. It applies only if you choose to connect one. We connect through Microsoft's official sign-in and the Microsoft Graph API.

What we access

Wrath asks Microsoft for exactly three delegated permissions: Mail.Read (read your mail), User.Read (sign you in and read your basic profile) and offline_access (keep access to the data you allowed until you remove it). With them we access:

• Your Microsoft account identifier, email address and user principal name, to identify the connected mailbox
• Email messages: sender, recipients (To and Cc), subject, sent and received dates, a short preview, the message body, message headers needed to group replies into conversations, and the folder the message is in
• Attachment names and details, and the attachment files themselves
• A sync marker, so we only fetch messages that are new since the last sync

We skip messages in your Junk Email, Deleted Items and Drafts folders. We read messages received from the start date of your import onwards, plus new messages as they arrive while the account stays connected.

We do not ask for permission to send, delete, move or change your email (we never request Mail.Send or Mail.ReadWrite), and we do not access your contacts, calendar or OneDrive files.

How we use, store and share it

We use, store, protect and share Microsoft data in the same way, and with the same limits, as Google user data: only to provide the features listed under How we use it; never for advertising; never sold; never used to train generalised artificial intelligence or machine-learning models; and not read by people at Wrath except with your permission, for security, or to comply with law. Microsoft tokens are encrypted before we store them, and attachment files are kept in encrypted cloud storage.

How long we keep it and how to delete it

• When you disconnect a mailbox in Wrath, we immediately stop fetching new messages and delete the stored Microsoft tokens and sync marker.
• Messages and attachments already imported stay in your workspace until you ask us to delete them.
• To delete imported Outlook data, email [email protected] from the address on your Wrath account. We will delete the messages and attachments imported from that mailbox and confirm by email when it is done.

How to revoke access

You can stop Wrath's access to your Microsoft mailbox at any time, in either or both of these ways:

1. In Wrath: disconnect the mailbox in your mailbox settings. This deletes our stored tokens and stops all syncing.
2. In your Microsoft account: for a personal account (Outlook.com, Hotmail, Live), go to Apps and services you've given access and remove Wrath. For a work or school account, open My Apps and revoke Wrath's permissions, or ask your organisation's administrator to remove it.

We recommend doing both. Revoking access does not by itself delete messages already imported; see the deletion steps above.

6.Amazon API integration#

Authorisation

We use the OAuth 2.0 protocol to connect to your Amazon Seller Central and Amazon Advertising accounts. You explicitly authorise our access through Amazon's official authorisation process.

Scope of access

We request access to the Amazon Selling Partner API and the Amazon Advertising API with the permissions needed to provide the Service. This includes read access to your sales data and both read and write access to your advertising campaigns for automation. We do not request access to Amazon's restricted buyer personal information, such as buyer names, addresses or contact details.

Data synchronisation

We periodically sync data from your Amazon accounts to provide up-to-date analytics and campaign management. How often we sync depends on your subscription and on the type of data.

Use of Amazon data

Amazon data is used only to provide the Service to you. We do not sell it.

7.Payments#

Payments are processed by Stripe. When you subscribe, you enter your card details on Stripe's checkout and manage billing in Stripe's customer portal. Your full card number is sent to Stripe and is never received or stored by Wrath. We receive and keep the information we need to manage your subscription: a Stripe customer reference, your plan and subscription status, invoices and payment status, and the billing details you give Stripe.

8.Data storage and security#

We implement industry-standard security measures to protect your personal information and business data against unauthorised access, alteration, disclosure or destruction, including:

• Encryption of data in transit and at rest
• Secure cloud infrastructure
• Access controls and authentication mechanisms
• Regular security updates and monitoring
• Encrypted storage of API credentials and access tokens

No method of transmission or electronic storage is completely secure, but we work to protect your information using these measures.

9.Data retention#

We retain your information for as long as your account is active or as needed to provide you the Service. You may request deletion of your data at any time by contacting us.

When you delete your account, it is closed straight away. Your account and Amazon data are then permanently deleted by an automated daily process once a 31-day grace period has passed, except where we must keep information to comply with law. Email data imported from Gmail, Outlook or other mailboxes is deleted on request, as described in Google user data and Microsoft user data.

10.Information sharing#

We do not sell, trade or rent your personal information to third parties. We may share your information only in the following circumstances:

• With Amazon: to access your seller and advertising data through Amazon's official APIs
• With Google and Microsoft: to access your mailbox through their official APIs, if you connect an email account
• Service providers: with trusted third parties who process data on our behalf to run the Service: Amazon Web Services (cloud hosting and encrypted file storage), Stripe (payments), Resend (account and verification emails, and messages sent through our contact form), MailerLite (waitlist and newsletter emails, if you sign up), Vercel (website hosting and website analytics), and Generect (business contact lookup, only when the feature is switched on and you ask Wrath to find contacts at a company; it receives that company's website domain and, if you choose to reveal a contact's email, that person's name or Generect's own identifier for them)
• Legal requirements: when required by law or to protect our rights and safety
• Business transfers: in connection with a merger, acquisition or sale of assets

Google and Microsoft user data is shared only as described in Google user data and Microsoft user data.

11.Your rights and choices#

You have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate information
• Deletion: request deletion of your personal information
• Revoke access: disconnect your Amazon accounts or email accounts at any time (see Revoking access)
• Data portability: request an export of your data in a machine-readable format
• Opt out: unsubscribe from marketing communications

To use any of these rights, email [email protected].

12.Revoking access#

Amazon

You can revoke our access to your Amazon Seller Central and Advertising accounts at any time by:

• Removing Wrath from the authorised applications in your Amazon Seller Central account settings
• Disconnecting your Amazon account in your Wrath account settings
• Contacting our support team for help

Google

Disconnect the mailbox in Wrath, and remove Wrath in your Google Account under Third-party apps with account access. Details are in Google user data.

Microsoft

Disconnect the mailbox in Wrath, and remove Wrath from your Microsoft account: personal accounts or work and school accounts. Details are in Microsoft user data.

Revoking access stops us from accessing new data. Data already synced stays in your account until you request deletion.

13.Cookies#

We use cookies and similar technologies to keep you signed in and to understand how the website is used, including through Google Tag Manager and Vercel Analytics. You can set your browser to refuse cookies, but some features may not work properly without them.

14.International data transfers#

Your information may be transferred to and kept on servers outside your state, province, country or other jurisdiction, where data protection laws may differ. By using the Service, you consent to this transfer.

15.Children's privacy#

The Service is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18.

16.Changes to this Privacy Policy#

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date. If a change materially affects how we use Google or Microsoft user data, we will ask for your consent again before using the data in the new way.

17.Contact us#

If you have questions about this Privacy Policy, your data rights or how we handle your information, email [email protected] or use our contact page.