Data protection and security

Last updated: October 15, 2026

This English version is provided for convenience. In the event of any discrepancy, the French version prevails.

1. Our commitment

Elevate Seller places particular importance on the confidentiality, integrity and availability of the data used by its application.

Our goal is to let Amazon sellers use analysis and price tracking features while maintaining appropriate control over the data the service accesses.

Data protection is taken into account in the design, development and operation of the service.

2. Protection of Amazon data

Elevate Seller uses the Amazon Selling Partner API (SP-API) to access the data authorized by sellers and required by the enabled features.

Access limited to necessary data

The permissions we request are limited to the functional needs of the service. The authorizations granted by a seller determine the data the application can access.

We do not attempt to circumvent the access restrictions imposed by Amazon.

Controlled use

Amazon data is used to provide the features requested by the user, in particular product analysis, offer tracking and business recommendations.

It is not disclosed to third parties for unauthorized purposes.

Authorization management

Access authorizations are managed in accordance with the authorization mechanism provided by Amazon.

When a user revokes their authorization or disconnects their account, the corresponding access is terminated according to how the relevant APIs work. Data already collected is then handled in accordance with our retention policy and the applicable obligations.

3. Technical security measures

The following measures make up our security framework and apply to the components deployed in the production environment.

Encryption

Communications with the service are protected by HTTPS/TLS.

Stored data, backups and media containing sensitive information are protected by appropriate encryption mechanisms, depending on the components and environments used.

Technical secrets and access credentials are subject to specific protection measures.

Access management

Access to data and infrastructure components is limited to the people and services that need it.

Permissions are defined according to the principle of least privilege. Privileged access is reserved for authorized people and is subject to appropriate controls.

Protection of Amazon credentials

The authorization information required for the Amazon integration, in particular access and refresh tokens where used, is treated as sensitive information.

It must be stored and handled securely, with access limited to the components that need it.

It must not be exposed in source code, user interfaces or technical logs.

Application security

The service is subject to security measures suited to its development cycle and operation, including:

• Dependency management and application of security updates.
• Access control for interfaces and APIs.
• Protection of environments and secrets.
• Monitoring of errors and technical events.
• Identification and remediation of vulnerabilities.
• Security review of changes before production release, according to applicable procedures.

Backups and availability

Backup and restoration mechanisms are in place according to the needs of the service and the characteristics of the infrastructure.

Recovery objectives, backup frequency and backup retention periods are defined in our internal operating procedures.

4. Monitoring and incident management

We use monitoring tools to identify malfunctions and relevant security events.

In the event of an incident, appropriate measures may include:

• Analysis and qualification of the incident.
• Limitation of its impact.
• Remediation of the identified cause.
• Revocation or rotation of compromised credentials, if necessary.
• Restoration of the service and verification of its integrity.
• Notification of individuals, customers or authorities where required by the regulations.

Incidents affecting personal data are handled in accordance with the applicable legal obligations.

5. Service providers and subprocessors

Operating Elevate Seller may require the use of technical providers, in particular for hosting, infrastructure, monitoring, maintenance or subscription management.

Providers with access to personal data are selected and bound by contract according to the processing they perform. Confidentiality, security and data protection obligations are defined in accordance with the applicable regulations.

The list of providers and processing locations appears in the Hosting and international transfers section of our privacy policy. Further details are available on request at [email protected].

6. Data protection by design

Changes to the service must take data protection requirements into account by design and by default.

This means in particular limiting the data collected, reducing unnecessary access, defining retention periods and providing appropriate deletion mechanisms.

Features that use artificial intelligence systems are designed to respect access permissions and authorized purposes. Sensitive data must not be sent to an external model or provider without an appropriate framework.

7. Deletion and end of use

When a user stops using Elevate Seller or requests the deletion of their data, we apply the deletion procedures provided by the service.

Data is deleted or anonymized when it is no longer needed, subject to legal obligations, security requirements and the rules applicable to Amazon data.

Data contained in backups is purged within 90 days, according to the rotation procedures defined for the infrastructure.

Deletion requests can be sent to: [email protected].

8. Responsibilities and compliance

Elevate Seller is committed to applying the data protection requirements that apply to it, in particular the General Data Protection Regulation (GDPR), as well as the Amazon policies and agreements relevant to the use of SP-API.

Security measures are reassessed as the service evolves, according to the risks identified and the applicable obligations.

9. Contact

For any question about security or data protection:

Elevate Seller — DOVEAIA SAS

Email: [email protected]

Address: Parc Lorans — Bâtiment 1G, Rue Jean-Marie Huchet, 35000 Rennes, France