Privacy Policy
This policy explains what data Donna collects from a connected Amazon selling account, why it is collected, where it is stored, who can reach it, and how it is deleted.
1. Who we are
Donna is operated by YUGI GREEN LTD, an Israeli company (Company No. 516051620), Kibbutz Sde Nehemya 1214500, Northern District, Israel. YUGI GREEN LTD is the data controller for the data described here. Contact: info@donnacentral.com.
2. What we collect
2.1 Amazon selling account data
Once a seller authorizes Donna, we retrieve the following through Amazon's Selling Partner API and Amazon Ads API:
- Inventory quantities and fulfillment status
- Order and sales history, in aggregate and per product
- Advertising campaign, ad group, and targeting performance metrics
- Product listing details, such as ASIN, SKU, and title
- The seller identifier and marketplace of the connected account
2.2 Account and contact data
The name, email address, and chosen notification channel of the person operating the account, so that we can deliver alerts and respond to requests. If you write to us at the address published on this website, we receive the name and email address you send from, so that we can reply.
2.3 Authorization credentials
The OAuth tokens that permit Donna to read the account, described in section 4.
3. What we do not collect
We do not collect buyer personal information. Donna does not request, receive, or store customer names, shipping addresses, phone numbers, email addresses, order-level customer records, or tax documents. We do not request the Amazon permission roles that grant access to that information, because no feature of Donna requires it.
We do not operate advertising trackers and we do not sell data to anyone. This website is a set of static pages. It sets no cookies, runs no analytics, and contains no forms — the only way to contact us is to send email to the address below. Nothing on this website is connected to any seller Amazon account data, which is processed separately as described below.
4. How credentials are handled
Long-lived OAuth refresh tokens are stored in the encrypted credential store of our workflow automation platform. They are not written to our application database and are not accessible to the parts of the system that process seller data. Short-lived access tokens, which expire approximately one hour after issue, are cached only for the duration of their validity.
Credentials are never transmitted over email or messaging services, and are never logged.
5. Why we process this data
Solely to operate the service the seller asked for: to detect stock-out risk, identify advertising spend that is not producing return, surface material changes in performance, and present recommendations for the seller's approval. We do not use one seller's data to serve another seller, and we do not use it to train machine learning models.
6. Where it is stored and who can reach it
Data is stored in a managed PostgreSQL database, encrypted at rest, and transmitted only over TLS. Access is restricted to the personnel operating the service who require it, authenticated individually. Every read of Amazon data and every action taken by the system is recorded in an audit log retained alongside the data.
7. Service providers
We share data only with the infrastructure providers required to run the service, and only to the extent each requires. Each is bound by a data processing agreement and is assessed before use:
| Provider | Purpose |
|---|---|
| Supabase | Managed database hosting and storage |
| n8n | Workflow automation and encrypted credential storage |
| AI model providers | Generating analysis and recommendations from account data. Data sent for this purpose is not used by those providers to train their models. |
| Telegram | Delivery of alerts and approval requests, where the seller has chosen that channel |
| GitHub Pages | Hosting of this website. Serves static pages only; receives no seller data. |
| GoDaddy | Domain registration and DNS for donnacentral.com |
| Zoho Mail | Delivery and storage of email sent to, and sent from, our published contact address |
Not all of these receive Amazon selling account data. Only Supabase, n8n, the AI model provider and the seller's chosen notification channel process data retrieved from a connected Amazon account. GitHub Pages, GoDaddy and Zoho Mail support this website, its domain and our contact address; no Amazon account data is sent to them.
We do not sell personal data, and we do not share seller data with other sellers, advertisers, or data brokers.
8. Retention and deletion
Amazon account data is retained for as long as the seller's authorization remains active, and is used to calculate the historical trends the service depends on.
A seller may withdraw Donna's authorization at any time from within Amazon Seller Central. Doing so immediately ends our ability to read the account. On withdrawal, or on a written deletion request to the address below, we delete the seller's stored data within 30 days, other than records we are required by law to keep.
9. Your rights
A seller may request a copy of the data we hold about them, ask for it to be corrected, or ask for it to be deleted. Write to info@donnacentral.com and we will respond within 30 days.
10. Security incidents
If we become aware of a breach affecting a seller's data, we will notify the affected sellers and the relevant authorities as required by applicable law, without undue delay.
11. Children
Donna is a business tool and is not directed at, or intended for use by, anyone under 18.
12. Changes to this policy
If we change this policy materially, we will update the effective date above and notify connected sellers by email before the change takes effect.
13. Governing law
This policy is governed by the laws of the State of Israel, including the Protection of Privacy Law, 5741–1981.
14. Contact
YUGI GREEN LTD, Kibbutz Sde Nehemya 1214500, Northern District, Israel
info@donnacentral.com