Legal

Privacy Policy

Last updated: October 2026

1. Privacy at a glance

Protecting your personal data is important to us. We process your data solely on the basis of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). This policy explains which data we process on sellercore.io and in the Sellercore app, for what purpose and on which legal basis.

2. Controller

Onfidence GmbH, Forstbergstraße 18, 4470 Enns, Austria. Phone: +43 660 216 89 59, email: info@sellercore.io

3. Hosting and server locations

The website sellercore.io is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, on servers in Germany. The Sellercore app (app.sellercore.io) runs on DigitalOcean servers in Frankfurt am Main. We have data processing agreements with our hosting providers (Art. 28 GDPR).

Connections to the website and the app are encrypted via TLS. We serve the website's fonts and videos from our own server; no data is transferred to third parties in the process.

4. Which data we process

Server log data when you visit the website

When you access the website, the server processes technically necessary data: IP address, date and time, page requested, referrer, browser and operating system. This is required to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Log data is deleted automatically after a short period.

Cookie settings

We store your choice in the cookie banner (version, choice for statistics and marketing, time) in your browser's local storage (key "sc_consent_v2") so that we do not ask you again on every visit and can demonstrate your consent. In addition, we set the cookie "sc_consent" (version and choice only, e.g. "v4.a1.m0", stored for 1 year) for sellercore.io and app.sellercore.io so that the Sellercore app also knows your decision and reports nothing to advertising or analytics services without consent. It contains no identifier that identifies you. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can change your choice at any time via the "Cookie settings" link in the footer or delete the data in your browser.

Web analytics with Google Analytics and Google Tag Manager

Only if you consent in the cookie banner do we use Google Analytics 4 and Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). No connection to Google is established before you consent (Google Consent Mode, default "denied").

Google Analytics sets cookies (e.g. "_ga", stored for up to 2 years) and records how the website is used: pages viewed, time on page, traffic source, button clicks, device, browser and approximate location. Your IP address is truncated. We use the analysis to improve the website. Tag Manager is only used to load Google Analytics and does not analyse any data itself.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future via "Cookie settings". More information: policies.google.com/privacy.

Usage analysis and session recording with PostHog

Only if you consent to the "Statistics" category in the cookie banner do we use PostHog (PostHog Inc., San Francisco, USA). We use PostHog's EU cloud; the data is stored in Frankfurt am Main. No connection to PostHog is established before you consent.

PostHog records which pages you view, how you move around the page (e.g. clicks, scrolling, mouse movements), where you came from, and your device, browser and approximate location. We also record sessions, i.e. the course of your visit, to see where the site is unclear or has errors. Inputs in form fields are masked and not recorded. For this, PostHog sets a cookie ("ph_…_posthog", stored for up to 1 year) that also applies to app.sellercore.io, so that we understand the path from the website to sign-up.

If you have consented to the "Statistics" category, on the website or in the app, we also use PostHog to the same extent in the Sellercore app (app.sellercore.io). This shows us how the app is used and where it is unclear or has errors.

PostHog processes the data as our processor (Art. 28 GDPR). Recordings are deleted after no more than 90 days. The legal basis is your consent (Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021). You can withdraw it at any time with effect for the future via "Cookie settings". More information: posthog.com/privacy.

Ad measurement (OpenAI pixel)

Only if you consent to the "Marketing" category in the cookie banner do we use the OpenAI pixel to measure the success of our ads in ChatGPT. The pixel is provided by OpenAI (OpenAI Ireland Ltd., Dublin, or OpenAI, L.L.C., San Francisco, USA). No connection to OpenAI is established before you consent.

The pixel records that you visited our website, which pages you view and whether you came to us via an ad, together with technical data such as IP address, browser and device. For this, information is stored on or read from your device (cookies or similar identifiers). We use the analysis to see which ads work. Data may be transferred to OpenAI in the USA.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021). You can withdraw it at any time with effect for the future via "Cookie settings" in the footer. More information: openai.com/policies/privacy-policy.

Google Ads (conversion measurement and remarketing)

Only if you consent to the "Marketing" category in the cookie banner do we use Google Ads by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This lets us measure whether someone who clicked one of our ads then, for example, requests a call or signs up, and show ads to visitors of our website later (remarketing). For this, Google sets cookies (e.g. "_gcl_au", "_gcl_aw", stored for up to 90 days) that also apply to app.sellercore.io.

If you submit the contact or call form, with your consent we additionally transmit your email address to Google in encrypted (hashed) form so that the request can be attributed to an ad ("enhanced conversions"). Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021), which you can withdraw at any time via "Cookie settings". More information: policies.google.com/technologies/ads.

Meta pixel (Facebook and Instagram)

Only if you consent to the "Marketing" category in the cookie banner do we use the pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland ("Meta"). This lets us measure the success of our ads on Facebook and Instagram and show ads there to visitors of our website.

The pixel records which pages you view and whether you, for example, send a request or click "Try for free", together with IP address, browser and device, and sets cookies (e.g. "_fbp", stored for up to 90 days). We and Meta are joint controllers for collecting and transmitting this data (Art. 26 GDPR, agreement with Meta); Meta alone is responsible for any further processing. Data may be transferred to Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

If you submit the contact or call form with this consent, we additionally transmit the request directly from our server to Meta (Conversions API) so that it is counted even if your browser blocks the pixel. This includes your email address in encrypted (hashed) form, IP address, browser identifier, the Meta cookie identifiers ("_fbp", "_fbc"), an event ID and the type of request. Likewise, we report a sign-up in the Sellercore app to Meta and Google Ads, and the purchase of a subscription to Google Ads, if you have consented to the "Marketing" category here. Without consent, nothing is transmitted.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021), which you can withdraw at any time via "Cookie settings". More information: facebook.com/privacy/policy.

YouTube videos

Some blog articles embed videos from YouTube (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com). The video is only loaded when you click the preview image. Only then is data such as your IP address transferred to YouTube, possibly also to Google LLC in the USA (see above, Data Privacy Framework). The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR).

Newsletter and waiting list

If you sign up for the newsletter or a waiting list for upcoming features, we process your email address together with the time, page and language of the sign-up and the version of the consent text. The data is stored in and sent from our own CRM system (crm.onfidence.at). We use double opt-in: your sign-up only becomes effective once you click the link in our confirmation email.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to info@sellercore.io. After you unsubscribe we delete your address; to prove your earlier consent we keep the sign-up data for up to three years (Art. 6(1)(f) GDPR).

Contact form, email and phone

If you book a call or ask a question using the form on our contact page, we process the details you enter there: name, email address and, if provided, company, phone number, message and your preferred day and time for the call. We also store the time, page and language of the request. The request is stored in our own CRM system (crm.onfidence.at), which notifies us of the new request by email. We use the data to answer your request and to arrange a call with you.

The call takes place as a video call on Google Meet (Google Ireland Limited). Google processes the data needed for the call, such as name, email address, IP address and, if you enable them, video and audio. Data may be transferred to Google LLC in the USA (see above, Data Privacy Framework). The call is not recorded.

If you contact us by email or phone, we likewise process your details only to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or steps prior to entering into one, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your request). We delete the request once it has been dealt with and no contract has been concluded, at the latest after two years, unless retention obligations apply.

Account, contract and payment

To register for and use the Sellercore app we process account, contract, billing and usage data (e.g. name, email address, company, billing address, VAT ID, chosen plan). The legal basis is Art. 6(1)(b) GDPR. Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). For this we transfer the data needed for the payment to Stripe, such as name, email address, billing address, amount and payment method. You enter payment data such as card numbers directly with Stripe; we do not store it ourselves. Stripe may transfer data to Stripe, Inc. in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Stripe also processes data under its own responsibility for fraud prevention and to meet legal obligations. More information: stripe.com/privacy. We keep invoice data for seven years as required by law (§ 132 Austrian Federal Fiscal Code, Art. 6(1)(c) GDPR).

Amazon marketplace data

When you connect your Amazon account, we process the data required for the service via Amazon's official interfaces (Selling Partner API and Amazon Ads API), for example products, prices, inventory, orders, advertising campaigns and metrics. Order data may include details of your customers; we process these on your behalf (Art. 28 GDPR). The legal basis is Art. 6(1)(b) GDPR. You can revoke access at any time in Sellercore or in Amazon Seller Central.

Connecting online shops (Shopify, WooCommerce)

If you connect a Shopify or WooCommerce shop in Sellercore, we process the following data from your shop on your behalf (Art. 28 GDPR):

  • Orders without customer data: order number, date, status, currency, amounts (subtotal, discounts, shipping, taxes, total, refunds) and order lines (item, SKU, EAN/barcode, quantity, price). Names, email addresses, phone numbers, shipping and billing addresses and customer IDs of your customers are not stored.
  • Products and variants: titles, descriptions, images, prices, SKU, barcodes, weight, status.
  • Stock levels and locations of your shop.
  • Shop credentials (Shopify access token or WooCommerce API keys and webhook secrets). We store these only in encrypted form (AES).

Purpose: analysing revenue and contribution margin per sales channel and product, matching with your product information management (PIM) and, only if you enable and confirm it, sending product data, prices and stock levels to your shop.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). For your customers' data we act as a processor.

Storage period and deletion: the data is stored as long as the shop is connected to Sellercore. When you disconnect, you can have all shop data deleted immediately ("Delete data"). If you uninstall the Sellercore app in Shopify, we delete the shop data at Shopify's request (webhook "shop/redact"). Logs of incoming shop notifications (webhooks) contain no personal data and are deleted automatically after 30 days.

Privacy requests from end customers: as we do not store any customer data from your shop, we hold no data relating to access or deletion requests from your customers (Shopify webhooks "customers/data_request" and "customers/redact").

Transfer: the data is transferred encrypted (TLS) and stored on DigitalOcean servers in Frankfurt am Main (EU). The data is not passed on to third parties or sold.

Data export: the shop data is included in your account's GDPR data export.

AI assistant and Amazon Seller MCP

The Sellercore AI assistant processes your requests and the data from your account needed for them in order to produce answers and carry out actions according to your rules.

If you connect the Sellercore connector (Amazon Seller MCP) to an external AI client such as Claude (Anthropic) or ChatGPT (OpenAI), you grant that client access to your Sellercore account via OAuth. The data the client retrieves at your request is transferred to that provider, which processes it under its own responsibility and privacy policy. The legal basis is Art. 6(1)(b) GDPR. You can disconnect at any time in Sellercore or in the AI client.

5. Use of AI features

Sellercore offers features that work with artificial intelligence (AI). For this, we transfer the data required in each case to specialised AI providers, who process it on our behalf. AI features only run when you use them or activate them for your account (e.g. automatic ads optimisation).

Which features use AI

  • Help chat and Sellercore agent: answering your questions; for this, the agent reads data from your account on request (e.g. campaigns, sales, return reasons).
  • Copy: creating and optimising product copy, A+ Content, keyword translations and social media copy.
  • Images and videos: generating and editing product images, backgrounds and short product videos.
  • Ads and pricing: suggestions and, if you activate them, automatic adjustments of Amazon ad campaigns as well as AI-supported analyses (e.g. weekly repricing report).
  • Documents: text recognition in scanned PDF documents that you upload to the knowledge area ("Brain").

Which data is processed

  • Your input: text you write in chats or input fields, as well as images and documents you upload.
  • Account and business data: product data (titles, descriptions, images, prices), sales, advertising and inventory metrics, and campaign and keyword data – in each case only as far as the feature requires.
  • Reviews: content of public Amazon reviews without details about their authors. We only pass comments from your seller feedback to the AI without the order number and after automatically removing recognisable contact details (e.g. email addresses, phone numbers).
  • No buyer data: names, email addresses and delivery addresses of your Amazon buyers and customer data from your online shops are not transferred to AI providers.

Important for free text and uploads

Please do not enter personal data of third parties (e.g. names, addresses or contact details of customers, suppliers or employees) in chats, input fields or uploaded files unless your request requires it. Whatever you enter is transferred to the respective AI provider. If you do enter such data, you are responsible for being allowed to share it.

AI results can be incorrect or incomplete. Please check copy, images, videos and recommendations before you publish or adopt them. Sellercore only makes changes to your Amazon listings or shops if you trigger them or have explicitly activated an automation.

Labelling AI content: in the image editor you can label AI-generated images as such. Whether and how you label AI content when publishing (e.g. on Amazon or TikTok) is up to you, within the rules that apply there.

Purposes and legal bases

  • Providing the AI features you use: performance of the contract with you (Art. 6(1)(b) GDPR).
  • Processing personal data of third parties contained in your account data: here we act as a processor on your instructions (Art. 28 GDPR, data processing agreement).
  • Security, abuse detection and error analysis of the AI features (e.g. technical logs without chat content): legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Recipients

AI processing is carried out by the following providers as processors or subprocessors:

  • Anthropic (Claude) or Amazon Web Services (Claude via Amazon Bedrock) – copy, chats, agent, analyses, document text recognition
  • OpenAI – image generation and editing
  • Google (Gemini API) – image generation
  • BytePlus (Seedance) – video clip generation

The complete list of our subprocessors shows each provider's registered office, place of processing and safeguards.

No use for training by the providers

We use the AI providers through their business interfaces (APIs). Under their contractual terms, Anthropic, Amazon Web Services and OpenAI do not use the transferred data to train their AI models. The providers store inputs and outputs at most for a limited period for abuse detection (up to 30 days at Anthropic and OpenAI); Amazon Bedrock does not store inputs and outputs.

Where processing takes place

Our servers and databases are hosted by DigitalOcean in Frankfurt (EU). We use text AI (Claude) via Amazon Bedrock exclusively in Amazon Web Services data centres in the EU; this data does not leave the EU for that purpose. For image and video generation, data is transferred to countries outside the EU: to OpenAI and possibly Google in the USA and to BytePlus in Southeast Asia. The basis is the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where the provider is certified, the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). Which basis applies to which provider is shown in the list of our subprocessors.

Storage period

  • Help chat: conversations are not stored.
  • Agent, image, video and social media chats: we store chat histories in your account so that you can continue a conversation and access results again – as long as your account exists or until you delete the chat.
  • AI results (copy, images, videos, reports) remain in your account until you delete them.
  • Uploaded documents in the knowledge area remain stored until you delete them or your account is deleted.
  • At the AI providers: see "No use for training by the providers".

All chat histories and database entries for AI results stored in your account are included in the GDPR data export and are removed when your account is deleted.

Your rights

You can leave the AI features unused at any time or deactivate automations in the settings. Your rights of access, rectification, erasure, restriction, data portability and objection as well as your right to lodge a complaint with the supervisory authority (in Austria: Datenschutzbehörde, www.dsb.gv.at) remain unaffected; details can be found in the section "Your rights" of this privacy policy.

6. Disclosure of data

Data is only disclosed to third parties where described in this policy, where necessary to provide the service (processors) or where we are legally obliged to do so. We do not sell any data.

7. Your rights

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

8. Storage period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. We delete account data after the end of the contract unless retention obligations apply.

9. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). Automatic changes in Sellercore, for example to prices or bids, only happen according to the rules you set yourself.

10. Privacy contact

For questions about privacy or to exercise your rights, contact info@sellercore.io.