You are handing a stranger access to your business.
So here is the whole of it on one page — what we get, what we cannot do, where the data sits, and how you switch it all off without asking us.
What we ask for
One thing, to start: a scoped Seller Central user invitation, limited to case management and reporting. That is a standard Seller Central function under Settings → User Permissions, it is granted per-permission, and you can withdraw it yourself at any time.
Later, once our developer application clears Amazon’s review, we will also offer read-only API access through Amazon’s official authorization flow. That one automates the report pulls. It does not widen what we can see.
What we have
- A scoped user seat: case management and reporting
- The ability to open, answer and escalate cases on your behalf
- Read-only report access via Amazon’s official flow, when it opens
What we do not have
- Your password — we never request or store it
- Any ability to edit listings, prices or advertising
- Any access to your payouts or bank details
- Permission to add or remove other users
- Your data mixed with any other seller’s, ever
Why a user seat at all? Because Amazon has no API for filing a reimbursement case. Any service claiming to recover money through the API alone is either not filing claims, or not being straight with you about how it works. The long version is here.
The one thing we would want to know, in your position
FeeBulldog was built by an Amazon seller, auditing their own account. That is our whole origin story, and it should immediately raise a question: are you going to look at my catalogue?
No. In writing, in the privacy policy, and worth repeating where it is actually relevant:
“We do not use your product, pricing, or sales data to inform any competing commercial activity, including our founder’s own Amazon business.”
Your data is used to find your money. Nothing else.
How the data is held
- Encrypted in transit and at rest. TLS everywhere; storage encrypted.
- Amazon tokens are encrypted with AES-256-GCM, using a key held separately from the database — a copy of the database alone does not yield access to your account.
- No passwords exist. Sign-in is a one-time link that expires in fifteen minutes and works once. Session tokens are stored only as irreversible hashes.
- No card details. Payment methods live with Stripe; we see a card brand and last four digits, nothing more.
- Every action inside your account is logged, with who did it and when.
- One seller per query. Every read is filtered to your account at the database level, not in the interface.
Who else touches it
Four subprocessors, and that is the complete list: Cloudflare (hosting, storage, database), Resend (email delivery), Stripe (payments), and Amazon itself. If we add one that handles seller data, the privacy policy is updated.
If something goes wrong
If we become aware of a breach affecting your data, we notify you and — where the data came from Amazon — notify Amazon within 24 hours of discovery, with what we know about scope and remediation as the investigation develops.
Leaving, and taking your data with you
The test of any of this is how hard it is to stop. Ours is a button.
- Revoke access yourself, from your own Seller Central account, in about thirty seconds. You do not need to tell us first.
- Export everything from your account page — findings, claims, cost documentation, the cost-control analysis. One file, no export fee, no request form.
- Close the account with one click. No notice period, no penalty. Your card is removed at the same moment.
- Request deletion and we action it within 30 days, minus what open claims and accounting law oblige us to keep. We say which, rather than pretending there are no exceptions.