Privacy Policy

Effective date: June 10, 2026

PivotPilot is an AI-powered Amazon advertising management platform operated by Unybex Inc., a company incorporated in Japan (“PivotPilot,” “we,” “our,” or “us”). This Privacy Policy describes what data we collect, how we use it, who we share it with, and the rights available to you.

For questions about this policy or to exercise your rights, contact us at hello@pivotpilot.ai.

1. What Data We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and password (stored as a one-way bcrypt hash — we cannot read it). We record the date and time you accepted these Terms and your email verification status.

1.2 Amazon Advertising Data

With your explicit authorization via Amazon's OAuth flow, PivotPilot imports and stores the following from your Amazon Ads account:

• Campaign names, states, daily budgets, targeting types, and placement settings
• Ad group names and configurations
• Keyword data: match types, bids, and states
• Product and category target data
• Product ads: ASINs and SKUs associated with your advertising campaigns
• Daily performance metrics: impressions, clicks, spend, sales, orders, ACoS, ROAS
• Search term report data: the actual shopper search queries that triggered your ads, with associated performance metrics
• Bid landscape signals and Amazon-generated recommendation signals

Amazon OAuth access tokens are encrypted at rest using AES-256-CBC encryption. We do not access order history, customer personal data, or any data outside the advertising scope you authorized.

1.3 AI Conversation Data

When you use the AI assistant, we store:

• Chat messages you send and AI assistant responses
• AI-proposed actions and their approval or rejection status
• Agent memories: instructions you save and notes the AI generates about your account
• AI feature usage logs (action types, session identifiers)

1.4 Billing and Subscription Data

We store your subscription plan, status, and credit balance. For paid plans processed through Stripe, we store Stripe-assigned identifiers (customer ID, subscription ID). We do not store payment card numbers — those are held by Stripe. We maintain a credit transaction history for your account.

1.5 Bring Your Own Key (BYOK)

If you add an Anthropic API key on a supported plan, we store it encrypted at rest using AES-256-CBC. Only the last four characters are stored in a readable form for display purposes. The full key is decrypted per-request in server memory to make API calls; it is never written to logs or returned in API responses.

1.6 Technical and Usage Data

We collect session records (IP address, browser/device information, session token), application logs for debugging and security monitoring, and records of AI model calls (model type, token usage). Credentials and secrets are redacted from all application logs. Within the authenticated application, we do not use third-party behavioral tracking or advertising pixels.

2. How We Use Your Data

We use the data we collect to:

• Operate the platform, including importing and displaying your advertising data
• Power the AI assistant (including transmitting relevant data to Anthropic — see Section 4)
• Execute changes on your Amazon Ads account when you approve them
• Process payments and manage your subscription
• Send transactional emails (account verification, billing receipts)
• Respond to support requests
• Monitor for security incidents and detect abuse
• Improve platform performance and reliability

We do not use your advertising data for resale, cross-customer profiling, or any purpose unrelated to operating PivotPilot for your organization.

3. Amazon Advertising API Access

PivotPilot connects to the Amazon Advertising API using the advertising::campaign_management scope. You must actively grant access via Amazon's OAuth flow — no data is accessed without your consent. You may revoke PivotPilot's access at any time through the PivotPilot integrations page or through your Amazon account security settings. Revoking access stops further data retrieval immediately.

Amazon Ads data, including search term data, may be included in AI context payloads sent to Anthropic as described in Section 4.

4. AI Assistant and Anthropic

PivotPilot uses Claude, an AI model developed and hosted by Anthropic, PBC (San Francisco, USA). When you send a message to the AI assistant, PivotPilot transmits the following to Anthropic's API to generate a response:

• Your typed messages and recent conversation history
• Relevant Amazon campaign performance summaries and keyword data
• Search term data when relevant to your query
• Your saved account instructions (agent memories)
• Your account economics settings (break-even ACoS, target ACoS per product)

Anthropic processes this data solely to generate AI responses on our behalf. Consistent with Anthropic's standard API terms, data submitted through the Anthropic API is not used to train Anthropic's AI models. Your data is not shared with other Anthropic API customers.

For BYOK users: your data is sent to Anthropic using your own Anthropic API key. Anthropic's terms govern that processing under your account.

For Anthropic's own data practices, see Anthropic's Privacy Policy.

5. How We Share Your Data

We do not sell your personal data. We do not share your Amazon advertising data with other PivotPilot customers. We share data only as described below:

We may also disclose data when required by applicable law, regulation, or valid legal process.

6. Cookies and Tracking

Session cookies (essential)

PivotPilot uses a session cookie to maintain your logged-in state within the application. This cookie is essential to the service and is always active for authenticated users.

Google Analytics 4

Our site (pivotpilot.ai) uses Google Analytics 4, operated by Google LLC, to understand how visitors find and use the site. Google Analytics places _ga and related cookies on your browser when you visit our pages. These cookies may be associated by Google with other data Google holds about you.

Bot protection — Google reCAPTCHA Enterprise

Our site uses Google reCAPTCHA Enterprise on pages with submission forms. reCAPTCHA collects behavioral and device signals to assess whether a submission is automated. This data is processed by Google. For details, see Google's Privacy Policy.

No behavioral tracking in the application

We do not use behavioral tracking, advertising pixels, or third-party analytics within the authenticated PivotPilot application.

7. Data Retention

We retain your account information, Amazon advertising data, conversation history, agent memories, and related records for as long as your account is active.

The following automated retention schedules are currently in operation:

• Amazon recommendation signals (keyword and product target discovery signals): automatically deleted after 30 days.
• Bid landscape signals: automatically deleted after 7 days.
• Raw Amazon report files: deleted after successful parsing; a 7-day fallback cleanup applies.

All other data — including account records, chat messages, execution history, and credit transaction records — has no automated deletion schedule and is retained while your account is active.

If you request account deletion, we will delete or anonymize your personal account information. Certain records, including execution audit logs and financial transaction records, may be retained for legal compliance purposes.

8. Security

We apply the following security measures:

• Amazon OAuth access tokens encrypted at rest using AES-256-CBC
• BYOK Anthropic API keys encrypted at rest using AES-256-CBC
• Passwords stored as one-way bcrypt hashes
• Credentials and secrets automatically redacted from all application logs
• All data transmitted over HTTPS/TLS
• Organization-level data isolation enforced on all database queries
• Access to production systems restricted to authorized personnel

No security measure is absolute. In the event of a data breach that affects your information, we will notify you in accordance with applicable law.

9. International Data Transfers

Unybex Inc. is incorporated in Japan. Key sub-processors — including Anthropic and Stripe — are located in the United States. If you are located in the EU, UK, or another jurisdiction with data transfer restrictions, your data may be transferred to the United States for processing. We rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) for such transfers. The specific transfer mechanisms are subject to ongoing legal review.

10. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

• Access: Request a description of personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and personal data. Note that certain records may be retained for legal compliance (see Section 7).
• Portability: Request your data in a machine-readable format.
• Revoke Amazon access: Disconnect your Amazon Ads account at any time through PivotPilot's integrations settings. This stops all further data retrieval from Amazon immediately.
• Opt out of analytics: Opt out of Google Analytics tracking on our marketing site using the Google Analytics Opt-out Browser Add-on.

For EU/UK users: You may also have the right to restrict processing, object to processing based on legitimate interests, and lodge a complaint with your national data protection supervisory authority.

For California residents (CCPA/CPRA): You have the right to know what personal information we collect, the right to delete it, and the right to opt out of sale. We do not sell personal information.

To exercise any of these rights, contact us at hello@pivotpilot.ai.

11. Children

PivotPilot is a business tool intended for users who are at least 18 years old. We do not knowingly collect data from persons under 18. If you believe a minor has created an account, please contact us at hello@pivotpilot.ai and we will delete the account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and update the effective date at the top of this page. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

13. Contact

For questions, data requests, or concerns about this Privacy Policy, contact us at:

• Email: hello@pivotpilot.ai
• Company: Unybex Inc.
• Country: Japan