1. Scope and controller
This notice covers the LayeredOps Catalog Guard website and software service. The organization identified as the operator above is the controller for personal data processed to run the website and service.
2. Information the service processes
The service may process contact details provided for private-beta access or support, catalogue files a user chooses to submit, product identifiers and listing attributes in those files, requirement files, field mappings, analysis results, review notes, generated exports, and technical request or error information.
If a seller authorizes a private-beta Amazon connection, Catalog Guard is designed to receive listing product data and Product Type Definition data through read-only SP-API operations. The product does not need order, buyer, payment, tax, or shipping data for this purpose.
3. Why information is used
Information is used to compare requirements, check catalogue data, explain affected products, provide exports and support, protect the service, and maintain reliability. Depending on the context, the legal basis may be performance of a contract or steps requested before a contract, the operator’s legitimate interests in providing and securing the service, consent where specifically requested, or compliance with a legal obligation.
4. Storage and retention
Catalogue data, requirement versions, analysis results, field mappings, review state, notes, and non-secret connection status may be stored to provide the service. Uploaded files are processed as data, and exports are created when requested. Amazon client secrets and refresh tokens are not stored in browser code or shown in diagnostics.
Information is retained only for as long as needed to provide the service, resolve support or security issues, and meet legal obligations. Private-beta participants can ask about retention or request deletion through the privacy contact.
5. Sharing and processors
The service does not sell personal data. Information may be handled by service providers used for hosting, storage, monitoring, or support, and may be disclosed where legally required. Amazon data is exchanged with Amazon only for an authorized read-only SP-API workflow.
6. International transfers
Service providers may process information outside the user’s country. Where the GDPR applies and information is transferred outside the EEA, the operator will use an applicable lawful transfer mechanism and appropriate safeguards.
7. Security
Catalog Guard is designed for read-only Amazon access, keeps credentials on the backend, redacts diagnostic errors, validates uploaded files, rejects remote references in requirement files, and protects spreadsheet exports against formula injection. No system can be guaranteed completely secure.
8. Individual rights
Depending on applicable law, individuals may have rights to access, correct, delete, restrict, or object to processing; receive portable data; and withdraw consent. They may also complain to their local supervisory authority. In Denmark, the supervisory authority is Datatilsynet. Requests can be sent to the configured privacy contact, and identity may need to be verified before a request is completed.
9. Cookies and browser storage
The public website does not currently use advertising trackers or analytics cookies. If non-essential cookies or similar technology are introduced, this notice and any required consent choices will be updated.
10. Children and changes
The service is intended for business users and is not directed to children. Material changes to this notice will be published here with a revised date.