Privacy

Commerce Agent is operated by Dubstream. During the open beta this page is the plain-language version of how we treat your data; a fuller policy ships before general availability.

• What we collect. Your signup details (store name, email, region) and the Amazon data you authorize us to pull — orders, finances, ads reports, listings — stored in a database scoped to your account only.
• Credentials. Amazon authorizations are stored encrypted (AES-256-GCM). We never see or store your Amazon password, and credentials are never shown back, logged, or shared.
• Disconnect anytime. Revoke our access from Seller Central or ask us to disconnect a workspace. Disconnecting deletes the provider credentials we hold; it does not by itself cancel Paddle billing or delete the workspace’s historical data.
• Export and workspace deletion. A recently authenticated workspace owner can export normalized workspace data without credential payloads or token hashes. A confirmed workspace-deletion request suspends that workspace, removes its queued jobs, revokes workspace access, deletes provider credentials, and places live data into the configured retention window (30 days by default). A documented legal, dispute, security, or tax hold may extend—but not shorten—that date. Paddle must confirm immediate subscription cancellation before purge can complete.
• Purge and retained evidence. At the end of the applicable window, workspace rows are deleted and the workspace root is anonymized. Shared identities and sessions for your other workspaces remain. We retain a pseudonymous HMAC-protected completion record, not the export or your credentials. Live backups currently age out on a separate seven-day schedule after live-row purge; restores must reapply deletion tombstones. Paddle, Amazon, email delivery providers, and security logs can have their own required retention.
• No resale. We do not sell your data or use one seller’s data to benefit another. Your numbers answer your questions — that is the whole product.
• Email. We send transactional email only (your access key, service notices) to the address you signed up with.

Questions or deletion requests: ops@dubstream.co.