Privacy Policy — Key points

1. Controller

Orbis Networks S.L., Spanish company, Tax ID (CIF) B-27870088, registered in Pontevedra (36201), Spain. Privacy queries and rights: privacidad@ametrix.io. No Data Protection Officer has been appointed, as it is not mandatory for this processing.

2. What we collect

Account identifiers (email, hashed password, company name), tax data (via Stripe), Amazon Ads OAuth tokens (encrypted AES-256-GCM), audit trail of write operations, technical session data (≤90 days).

Email and tax data are required to provide the service; without them the contract cannot proceed. Other business data is optional and improves the analysis.

Data origin

We process the data you provide and the advertising-account identifiers you authorize via Amazon Ads. Market intelligence comes from external market-data providers (prices, positioning, per-product estimates); these are aggregated market data, not third parties’ personal data.

3. Legal basis

Contract performance (art. 6.1.b): account, authentication, subscription, Amazon Ads API integration. Legal obligation (art. 6.1.c): billing and accounting. Legitimate interest (art. 6.1.f): immutable operation log, platform security and fraud prevention (balancing test available on request). Consent (art. 6.1.a): commercial communications, withdrawable at any time.

4. Recipients

We rely on processors, each under a data processing agreement (DPA) pursuant to art. 28 GDPR: Amazon Ads API (EU), Supabase (EU), Stripe (Ireland), Anthropic (US, under SCC), Hetzner (Germany), Resend (transactional email) and Telegram (contact messages and leads, outside the EU). Market-data providers powering market intelligence process only aggregated market data, not the Client’s personal data. No commercial sale of data to third parties.

International transfers

Transfers to Anthropic PBC (USA) rely on Standard Contractual Clauses (SCC) approved by the European Commission, supplemented by additional measures (encryption in transit and at rest) in line with the Schrems II ruling. Under Anthropic’s commercial terms, API customer data is not used to train its models. You may request a copy of the safeguards at privacidad@ametrix.io. Contact leads may be transmitted via Telegram (outside the EU) under the same safeguards.

Automated decisions and profiling

We do not make decisions based solely on automated processing producing legal or similarly significant effects (art. 22 GDPR). Ametrix AdsIQ analyzes and recommends but does not act on its own: any action on your Amazon Ads account requires your decision. We carry out light commercial profiling (sector, goals, budget) only to tailor the analysis, with no binding automated effects.

5. Retention

Account data: until you cancel + request deletion. Tokens: deleted ≤7 days post-cancel. Audit trail: ≥1 year post-cancel. Tax data: 6 years. Tech logs: 90 days.

6. Your rights

GDPR rights apply: access, rectification, erasure, objection, restriction, portability, consent withdrawal. Email privacidad@ametrix.io. We respond within one month (extendable to two). We only request an ID document if there are reasonable doubts about your identity. Complaints: AEPD (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

7. Security

TLS 1.3 in transit. AES-256-GCM at rest for tokens. Mandatory 2FA (TOTP) for admin. Immutable operation log. Read-only by default; per-plan monitoring limits.