Privacy Policy

Contents

1. Who we are and what this policy covers

SellRadar ("SellRadar", "we", "us", "our") operates the keyword and product-opportunity analysis service at sellradar.ai. You submit a keyword and a marketplace, we analyse the live listings ranking for it, and we return a verdict, a set of scores, a competitor breakdown, and a written recommendation.

This policy explains how we handle personal data — any information that identifies you or can be linked to you. It applies to the SellRadar website, the signed-in application, our marketing emails, and our support channels. It does not apply to Amazon, Google, or any other site we link to or analyse.

For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), SellRadar is the data controllerfor the personal data described here. Our team is established in Estonia, so our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). Under the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), we act as a business.

Privacy contact: support@sellradar.ai. We answer privacy questions from this address and no other.

This policy forms part of our Terms of Service.

2. Information we collect

We collect three kinds of information: what you give us, what our systems record while you use the service, and what our sign-in and payment partners send back to us.

(a) Information you provide

(b) Information collected automatically

One exception on IP addresses: if someone attempts to sign in to our internal admin console, the IP address and the email address used are written to a security audit log. That log covers our own staff and anyone probing the admin login. It does not record ordinary customer activity.

(c) Information we receive from third parties

3. How we use your information, and our legal basis

Under the GDPR we must have a lawful basis for every use of your personal data. The table below pairs each purpose with the basis we rely on. "Contract" means Article 6(1)(b) — processing necessary to deliver the service you signed up for. "Legitimate interests" means Article 6(1)(f), where we have balanced our interest against your rights and recorded the outcome. "Consent" means Article 6(1)(a), which you can withdraw at any time. "Legal obligation" means Article 6(1)(c).

If you want more detail on any legitimate-interests assessment above, email support@sellradar.ai and we will summarise it for you. You can object to processing based on legitimate interests — see section 10.

4. Cookies and similar technologies

A cookie is a small file a site stores in your browser. We also use local storage and session storage, which work similarly but are never sent to our servers — they exist only to remember your preferences on your own device. We use no advertising cookies, no tracking pixels, and no cross-site or cross-context trackers.

Strictly necessary — always on

These make sign-in and security work. The service cannot function without them, so they do not require consent, and there is no way to switch them off while staying signed in.

Functional — on your device only

These are browser storage keys, not cookies. They stay on your device, are never transmitted to us, and clearing your browser data removes them.

Analytics and tag management

We use Google Tag Manager to load our measurement tags, and Google Analytics 4 — loaded through that container — to understand which pages people use and where they get stuck. We run both in Google Consent Mode v2 with ad_storage, ad_user_data, and ad_personalization permanently set to denied — so this data is never used for advertising, remarketing, or audience building, whatever you choose.

Consent works by region, as Google Consent Mode allows. If you are in the EEA, the UK, or Switzerland, no analytics cookie is written and no analytics identifier is stored until you accept — until then Google receives only a cookieless signal. Elsewhere, analytics storage starts on, in line with the opt-out model those jurisdictions apply. Declining switches it off immediately wherever you are, and we never enable advertising or personalisation storage for anyone.

5. How we share your information

We share personal data only with the vendors listed below, who process it on our instructions and on our behalf under a written data processing agreement. This list is complete — no other company receives your personal data from us.

Keywords you scan are also stored in a shared cache so that a keyword someone has recently analysed can be served without spending a fresh API call. That cache holds the keyword and the marketplace result only. It is never linked to your account, your email, or your identity, and no other user can see that you were the one who scanned it.

6. AI processing

The written explanation and recommendation on every scan are generated by Claude, a large language model operated by Anthropic PBC. We call Anthropic's API directly from our servers.

Anthropic processes this data as our sub-processor to return a response, and does not use it to train its models. Their commercial terms prohibit training on API inputs and outputs. See Anthropic's privacy policy for how they handle API data on their side.

We also do not train any model of our own on your keywords, tags, or feedback. We use aggregate patterns across scans to calibrate our scoring algorithm, which is statistical work on de-identified data, not model training on your content.

7. International data transfers

SellRadar is hosted in Amazon Web Services' US East (Northern Virginia) region. If you use the service from the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to and stored in the United States.

The United States has not received an adequacy decision covering transfers generally, so we rely on the safeguards below:

SellRadar itself is not certified under the Data Privacy Framework, and we make no claim to be. We rely on the Standard Contractual Clauses as our own transfer mechanism. You can ask us for a copy of the clauses we have in place, with commercial terms redacted, by emailing support@sellradar.ai.

8. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. These are the periods we work to:

9. Security

We take the measures below to protect personal data. They are technical and organisational measures within the meaning of GDPR Article 32.

No service can promise perfect security, and we will not pretend otherwise. We hold no security certification — we are not SOC 2 audited, not ISO 27001 certified, and not HIPAA compliant — and SellRadar is not built for protected health information, payment card data, or any other regulated category. If you believe you have found a vulnerability, please report it to support@sellradar.ai rather than disclosing it publicly, and we will work with you on it.

10. Your privacy rights

If you are in the EEA, the UK, or Switzerland

The GDPR and UK GDPR give you the following rights:

• →Access. Get confirmation of whether we process your data, and a copy of it along with the details in this policy.
• →Rectification. Have inaccurate data corrected and incomplete data completed. Your name and email come from Google or Apple, so correcting them there and signing in again updates them here.
• →Erasure. Have your data deleted where we no longer need it, where you withdraw the consent it rested on, or where you successfully object. We may keep billing records where the law requires it.
• →Restriction. Have us pause processing while a dispute about accuracy or our legitimate interests is resolved.
• →Portability. Receive the data you gave us, and the scans you generated, in a structured, commonly used, machine-readable format, and have us send it to another controller where technically feasible.
• →Objection. Object to processing based on legitimate interests, on grounds relating to your situation. You can object to direct marketing at any time, for any reason, and we will stop immediately.
• →Withdraw consent. Withdraw consent at any time — decline analytics via the footer Cookies link, or switch off any email category in settings. Withdrawal does not affect processing already carried out.
• →Complain. Lodge a complaint with a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). In the UK that is the Information Commissioner's Office. In the EEA you may also complain to the authority where you live, work, or where the issue arose. We would appreciate the chance to put things right first.

If you are in California

Under the CCPA as amended by the CPRA you have the right to:

• →Know. Learn the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of third parties we disclose it to. Sections 2, 3, and 5 set all of this out.
• →Delete. Ask us to delete the personal information we collected from you, subject to the exceptions the statute allows — such as completing a transaction or complying with a legal obligation.
• →Correct. Ask us to correct inaccurate personal information.
• →Opt out of sale or sharing.We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not need a "Do Not Sell or Share My Personal Information" link, and we honour Global Privacy Control signals as a matter of course.
• →Limit use of sensitive information. We do not collect sensitive personal information as CPRA defines it, and we use nothing for purposes that would trigger a right to limit.
• →Non-discrimination. We will never deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right. We run no financial incentive programmes.

An authorised agent may submit a request on your behalf with written permission that we can verify. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other US states with comprehensive privacy laws have equivalent rights, including — where the state provides it — a right to appeal a decision we make on your request.

How to exercise any of these rights

Email support@sellradar.ai with the subject line Data request, from the email address on your account, and tell us which right you want to exercise. Sending from your account address is normally all the verification we need; if we cannot match it, we may ask for one more piece of information, used only to verify you and then discarded.

11. Children's privacy

SellRadar is a business tool for people selling products online. It is not directed at children, and our Terms of Service require you to be at least 18 to hold an account.

We do not knowingly collect personal data from anyone under 16, and we do not knowingly collect personal information from children under 13 as the US Children's Online Privacy Protection Act defines them. We do not offer child-directed features and we do not build profiles of minors.

If you believe a child has given us personal data, email support@sellradar.ai and we will delete the account and its data promptly, without requiring a formal rights request.

12. Automated decision-making and profiling

SellRadar scores keywords automatically. A scan produces an opportunity score, a competition weakness score, a viability score, a data-confidence rating, and a verdict, all computed by our algorithm and then described in writing by Claude.

Those outputs are advisory market research about a keyword, not decisions about you. They do not produce legal effects concerning you and do not similarly significantly affect you, so they fall outside GDPR Article 22. They do not determine your price, your access to the service, your creditworthiness, or your eligibility for anything. You are free to disagree with a verdict and target the keyword anyway.

To be explicit about the other automated processes in the product: quota enforcement applies the numeric limit of the plan you chose and is a contractual term, not a profiling decision; rate limiting and bot challenges can temporarily slow or block a request on volume and challenge signals, and you can email us to have it reviewed; and account suspension is always a human decision made by a member of our team, never automatic. In every case you can contact support@sellradar.ai to ask for human review, express your point of view, and contest the outcome.

We do not profile you for advertising, we do not score you as an individual, and we do not build behavioural profiles for sale or disclosure.

13. Changes to this policy

We update this policy when the product changes, when we add or remove a processor, or when the law requires it. The "Last updated" date at the top of this page always shows when it last changed.

If a change is material — a new purpose for your data, a new category of data, a new sub-processor receiving personal data, a shorter retention period, or a change to your rights — we will email every account holder at least 14 days before it takes effect and describe what is changing and why. Where a change requires your consent, we will ask for it rather than assume it.

If you disagree with a change, you can close your account before the effective date. Continuing to use SellRadar after that date means the updated policy applies to you.

14. How to contact us

For anything in this policy — questions, rights requests, complaints, or a security report — email support@sellradar.ai. We read everything sent there.

If you email us about a privacy matter and do not hear back within five working days, send it again and mark it urgent — it means something went wrong on our side, not that we are ignoring you.