Privacy Policy

We collect the following categories of personal information that you provide to us:

• Account Information: When you register for an account, we collect your name, email address, username, password, and other registration details.
• Profile Information: Information you add to your profile such as company name, job title, profile picture, and professional background.
• Payment Information: When you make a purchase, we collect payment card details, billing address, and transaction history. Payment processing is handled securely by our payment processor, Stripe, and we do not store complete credit card numbers on our servers.
• Communication Data: When you contact us via email, support tickets, or other channels, we collect the content of your messages, your contact details, and any attachments you provide.
• Survey and Feedback Data: If you participate in surveys, promotions, or provide feedback, we collect your responses and any information you choose to share.
• Marketing Preferences: Your preferences for receiving marketing communications and your communication preferences.

When you connect your Amazon Seller Central account to our Services, we access certain data through Amazon's official Selling Partner API (SP-API). This integration is essential for providing our analytics and optimization services. The data we access includes:

• Product and Inventory Data: Product listings, ASINs, SKUs, pricing information, inventory levels, and product attributes.
• Advertising Data: Sponsored Products, Sponsored Brands, and Sponsored Display campaign data including impressions, clicks, spend, sales, ACoS, and keyword performance metrics.
• Sales and Orders: Order history, revenue data, units sold, returns, and refunds.
• Search Terms and Keywords: Search term reports, keyword rankings, organic and paid search performance data.
• Account Health: Account health metrics, policy compliance status, and performance notifications.
• Brand Analytics: Search frequency rank, click share, conversion share, and market basket analysis (where available based on your Amazon account type).

When you access or use our Services, we automatically collect certain information about your device, browsing actions, and usage patterns. This information is collected using cookies, web beacons, and similar tracking technologies. The information we collect includes:

• Device Information: Device type, operating system, unique device identifiers, browser type and version, screen resolution, and device settings.
• Network Information: Internet Protocol (IP) address, internet service provider, mobile carrier, and network type.
• Usage Data: Pages visited, features used, time spent on pages, click patterns, navigation paths, and interaction with content.
• Location Data: Approximate geographic location based on IP address (country, region, city level). We do not collect precise GPS location data.
• Referral Data: Information about the website or source that referred you to our Services, including search terms used.
• Performance Data: Page load times, error logs, and diagnostic information to help us improve our Services.

We may receive information about you from third-party sources, including:

• Amazon: Data received through the Amazon SP-API as described above.
• Payment Processors: Transaction confirmations and payment status from Stripe.
• Analytics Providers: Aggregated analytics data from services like Google Analytics.
• Social Media Platforms: If you connect your social media accounts or interact with our social media presence.
• Business Partners: Information from partners with whom we offer co-branded services or engage in joint marketing activities.

• To create, maintain, and secure your account
• To provide our analytics, reporting, and optimization services
• To process your transactions and manage billing
• To sync and analyze your Amazon seller data
• To generate insights, recommendations, and reports
• To enable features like keyword tracking, campaign management, and performance monitoring

• To respond to your inquiries, support requests, and feedback
• To send service-related notifications, updates, and alerts
• To provide technical support and troubleshooting assistance
• To communicate about account activity, security alerts, and policy changes

• To send marketing communications about our products, services, and promotions (with your consent)
• To personalize your experience and deliver relevant content
• To conduct surveys, contests, and promotional activities
• To measure the effectiveness of our marketing campaigns

You can opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails or by contacting us directly.

• To analyze usage patterns and trends to improve our Services
• To develop new features, products, and services
• To conduct research and analysis for business intelligence
• To monitor and analyze the effectiveness of our Services
• To identify and fix bugs, errors, and technical issues

• To detect, prevent, and address fraud, abuse, and security threats
• To enforce our terms, conditions, and policies
• To comply with legal obligations and respond to lawful requests
• To protect the rights, property, and safety of Shurq, our users, and the public

We process certain information because it is necessary to perform our contract with you (i.e., our Terms of Service). This includes processing required to create your account, provide our Services, process payments, and deliver the features you have requested.

We may process your information based on our legitimate business interests, provided those interests are not overridden by your rights and interests. Our legitimate interests include:

• Operating and improving our Services
• Understanding how users interact with our Services
• Marketing our Services to existing customers
• Preventing fraud and ensuring security
• Establishing, exercising, or defending legal claims

For certain processing activities, we rely on your consent. This includes sending marketing communications, placing certain cookies, and processing sensitive data where required. You have the right to withdraw your consent at any time, which will not affect the lawfulness of processing conducted before withdrawal.

We may process your information to comply with applicable laws, regulations, legal processes, or governmental requests. This includes tax reporting, responding to subpoenas, and maintaining records as required by law.

We engage trusted third-party companies and individuals to perform services on our behalf. These service providers have access to your personal information only to perform specific tasks and are obligated to protect your information. Our service providers include:

• Cloud Infrastructure: Amazon Web Services (AWS) for secure data hosting and storage
• Payment Processing: Stripe for secure payment transactions
• Email Services: SendGrid for transactional and marketing emails
• Customer Support: Intercom for live chat and support ticket management
• Analytics: Google Analytics and Mixpanel for usage analytics
• Error Monitoring: Sentry for error tracking and debugging

If Shurq is involved in a merger, acquisition, asset sale, bankruptcy, or reorganization, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your information.

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities. This includes:

• Complying with court orders, subpoenas, or legal processes
• Responding to requests from law enforcement or regulatory agencies
• Protecting and defending our legal rights or property
• Preventing or investigating possible wrongdoing
• Protecting the personal safety of users or the public

We may share your information with third parties when you have given us explicit consent to do so. This may include sharing data with integration partners or other services you choose to connect with your Shurq account.

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you. This data may be used for industry analysis, benchmarking, research, and other purposes.

• Encryption: All data transmitted between your browser and our servers is encrypted using 256-bit TLS/SSL encryption. Data at rest is encrypted using AES-256 encryption.
• Secure Infrastructure: Our Services are hosted on enterprise-grade infrastructure with multiple layers of security, including firewalls, intrusion detection systems, and DDoS protection.
• Access Controls: We implement strict role-based access controls, multi-factor authentication, and the principle of least privilege for all system access.
• Regular Security Testing: We conduct regular vulnerability assessments, penetration testing, and security audits to identify and address potential weaknesses.

• Employee Training: All employees receive regular security awareness training and are bound by confidentiality obligations.
• Background Checks: We conduct background checks on employees with access to sensitive systems and data.
• Incident Response: We maintain a comprehensive incident response plan to quickly detect, respond to, and recover from security incidents.
• Vendor Management: We carefully vet third-party vendors and require them to maintain appropriate security measures.

• Security Audits: We conduct regular security assessments and are working toward SOC 2 Type II certification.
• GDPR Compliance: We maintain compliance with the General Data Protection Regulation (GDPR) for EU/EEA users.
• PCI DSS: Payment processing is handled by PCI DSS-compliant service providers.

When you request deletion of your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain certain information for legal, regulatory, or legitimate business purposes. After deletion, your data cannot be recovered.

All Shurq users have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain exceptions.
• Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Opt-Out: Opt out of marketing communications at any time.
• Withdraw Consent: Withdraw consent for processing based on consent.

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the GDPR:

• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Automated Decision-Making: Not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
• Lodge a Complaint: File a complaint with your local data protection authority (e.g., the UK Information Commissioner's Office).

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Delete: Request deletion of personal information we have collected.
• Opt-Out of Sale: Opt out of the "sale" of personal information (note: we do not sell personal information).
• Non-Discrimination: Not be discriminated against for exercising your privacy rights.
• Correct: Request correction of inaccurate personal information.
• Limit Use of Sensitive Information: Limit the use and disclosure of sensitive personal information.

To exercise any of these rights, you may:

• Submit a request through your account settings
• Email us at legal@shurq.com
• Contact us using the details in the "Contact Us" section below

We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request. In some cases, we may be unable to fulfill your request due to legal obligations or legitimate business reasons, in which case we will explain the reason.

When we transfer personal information internationally, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries recognized as providing adequate data protection.
• Standard Contractual Clauses: EU-approved standard contractual clauses for transfers to other countries.
• Data Processing Agreements: Contractual commitments with all processors to protect your data.
• Additional Measures: Technical and organizational measures to ensure data protection during transfer.

For transfers from the UK, we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, as appropriate, to ensure your data receives equivalent protection.