Data Processing

Last updated: October 14, 2026
Effective date: October 14, 2026

This page explains how BrimScout, operated by BRIMSCOUT LLC, handles data from Amazon and the other platforms our clients connect: what we read, why, where it is kept, how long, how it is deleted and protected, and which providers help us. It is part of our Terms of Service and works together with our Privacy Policy and Security page.

1. Roles

The client owns its data and decides how it is used. BrimScout processes that data on the client's behalf, only to provide the service the client asked for, and only under the client's instructions in the Terms of Service and the client's Engagement Summary.

2. What we read, and how

We ask only for the access we need. We do not ask for your passwords, we do not share logins, and we do not use screen-scraping or automated browser tools on your accounts.

When data reaches us through a connector such as Windsor.ai, the connector is the developer registered with the platform. We hold that data to the same standards described on this page.

3. What we do not collect

• Buyer personal information. We do not request Amazon or TikTok Shop buyer names, addresses, phone numbers or email addresses, and our app database has no place to store them. If a data source sends them to us, we do not keep them and we delete them within 30 days of discovering them.
• Payment card numbers. We never collect them.
• Access we do not need. We do not request platform permissions or data that BrimScout does not use.

4. How we use the data

We use each client's data only to provide the service to that client:

• showing sales, ad results, stock and profit by product;
• auditing ad spend and proposing Changes, with the reasons and math;
• applying Changes the client approves;
• running the client's creator programs;
• answering the client's questions in the AI chat; and
• calculating our fee under the client's agreement.

We do not:

• sell, rent or license platform data to anyone;
• combine data across clients, or use one client's data to serve another client;
• use platform data to build or improve advertising profiles of people, or for ad targeting outside the client's own campaigns;
• use platform data to compete with Amazon or any other platform; or
• contact a platform's customers.

5. Keeping clients separate

Every record of client data in our app database is labeled with the client account it belongs to. Each login can see only the client accounts assigned to it. The AI chat can look up data only for the client account, or the accounts, that the user is viewing. Inside our company, access to client data is limited to people who need it to do the work.

6. Where data is kept

7. How long we keep data

• During the engagement: we keep client data for as long as the client uses BrimScout, so reports can compare periods and the change log stays complete.
• Audit files from prospects: 90 days after we deliver the audit, unless the prospect becomes a client or asks us to keep them longer.
• Billing records: invoices, signed baselines and fee calculations are kept as long as tax and accounting rules require, generally up to 7 years. These contain totals, not keyword-level or product-level platform data.

8. Deletion

We permanently delete a client's platform data within 30 days after the earliest of these events:

1. the client ends the engagement, or removes or revokes our access to the platform;
2. the platform tells us to delete the data;
3. we learn that we are no longer authorized to access or process the data; or
4. our own access to the platform's services ends.

Deletion covers our app database, our working copies, and files in our email and file storage. We also remove the client's connections from our Windsor.ai account. Our database provider keeps a restore history for up to 30 days, so deleted records expire from that history within 30 days after we delete them. We keep data longer only where the law requires it, and only for that purpose.

On request, we will confirm in writing that the deletion is complete. Before deleting, we offer the client an export, as described in our Terms of Service.

9. Security

What is in place today, and what is not yet, is described on our Security page. In short: data travels over encrypted connections, our database provider encrypts stored data, passwords are stored only as salted hashes, sign-in attempts are rate limited, and each login sees only its own client accounts.

10. Security incidents

A security incident means any actual or suspected unauthorized access to, use, disclosure, change or loss of client data, or a breach of a system that holds it.

If we detect one, we will:

• act right away to contain it and investigate it, and keep a record of what happened and what we did;
• notify Amazon within 24 hours of detecting it, at security@amazon.com for Selling Partner API information and 3p-security@amazon.com for Amazon Ads information, when Amazon information may be involved, as Amazon's data protection policies require;
• notify other affected platforms, such as Meta or TikTok, as their terms require;
• notify each affected client without undue delay, and no later than 72 hours after we confirm that the client's data was affected, with what we know and what we are doing; and
• meet any notice duties under applicable law, including Florida's data security law.

11. Service providers (subprocessors)

These providers process client data for us. Each is bound by its own data processing terms.

We will email clients at least 30 days before a new provider begins processing client data. A client that objects may cancel before the change takes effect.

12. Platform requirements we follow

• Amazon. We follow Amazon's Data Protection Policy and Acceptable Use Policy for Amazon information, including: no sale of Amazon data; no combining of data across sellers; access limited to people who need it; no buyer personal information kept; deletion within 30 days of the events in section 8; notice to Amazon within 24 hours of detecting a security incident; and sharing data only with providers whose security standards are at least as strict as ours. When we use the Amazon Ads API for a client, we act only for that client, under the client's authorization.
• TikTok Shop. We use TikTok Shop data only for the client that authorized it, and only for that client's shop operations, under TikTok's partner and data terms that apply to the connection.
• Meta. We do not sell, license or purchase Meta platform data, we delete it when it is no longer needed or when a client or Meta asks, and we report incidents as Meta's Platform Terms require.

13. Your controls

• You can remove our access at any time in each platform's settings. Tell us when you do, so we can complete deletion.
• You can ask for an export or for deletion at any time by emailing support@brimscout.com.
• You can ask us for the current list of providers and for a copy of their data processing terms.

14. Contact

BRIMSCOUT LLC
4861 NE 12th Ave, Oakland Park, FL 33334
support@brimscout.com