Privacy notice

1. Who operates the service

LEVILEV SUPPLY CO LLC operates Munchello Commerce Control. For platform administration, access security, and support information, LEVILEV SUPPLY CO LLC acts as the responsible business. When processing Amazon advertising or seller data for a subscribing seller, LEVILEV SUPPLY CO LLC acts as that customer's service provider or processor.

The service is available by paid subscription to Amazon selling partners. A seller connects their own Amazon account by explicit authorization and may revoke it at any time. Questions can be sent to amazon-api@munchellollc.com.

2. Information we process

• Amazon account and advertiser identifiers, marketplace, authorization status, and encrypted OAuth credentials.
• Advertising campaigns, portfolios, budgets, bids, placements, targets, keywords, search terms, impressions, clicks, spend, attributed orders, and sales.
• When separately authorized through the Selling Partner API: catalog, listing, inventory, fulfillment, order, return, refund, fee, and settlement information.
• Business-provided costs, expenses, profitability targets, inventory thresholds, policies, approvals, and change history.
• Authorized-user identity, role, authentication events, IP address, device and browser information, application logs, and security telemetry.

The initial service does not request restricted buyer personally identifiable information. If that scope changes, this notice, the security design, and Amazon approvals will be updated before collection begins.

3. How we use information

We use information to connect authorized accounts; synchronize and reconcile data; calculate performance and contribution economics; detect waste, risk, and anomalies; generate recommendations; enforce seller-approved budgets and rules; execute authorized changes; investigate incidents; maintain audit records; and support the service.

4. Tenant isolation and prohibited uses

Each seller organization receives a separate authorization and logical data boundary. We do not sell Amazon data, use it for behavioral advertising, disclose one tenant's data to another, publish tenant benchmarks, attempt to reidentify individuals, or permit Amazon data to train general-purpose external models.

5. AI-assisted analysis

When an authorized organization enables AI-assisted analysis, the service sends only the minimum structured data needed for the task to the configured business or API provider. Amazon passwords, client secrets, access tokens, and refresh tokens are never provided to an AI model. Model output is treated as a recommendation until it passes server-side policy checks and the organization's configured approval rules.

6. Sharing and subprocessors

We disclose information only to Amazon, infrastructure and security providers, support providers, and optional AI providers needed to operate the service. Those providers are listed on our Subprocessors page. We may also disclose information when legally required or to protect the service and its users.

7. Retention and deletion

• OAuth transaction state: up to 15 minutes.
• Access tokens: until their normal expiration; encrypted refresh tokens: until disconnection, then deleted from active systems within 7 days.
• Raw advertising and seller reports: up to 90 days.
• Normalized performance data and security/audit records: up to 24 months, unless a shorter tenant instruction or longer legal requirement applies.
• Other disconnected-tenant data: deleted from active systems within 30 days; encrypted backups expire within 35 additional days.

Details and request steps are on the Data Deletion page.

8. Security

We use encrypted transport, encrypted credential storage, least-privilege access, multi-factor authentication, tenant-scoped authorization, change controls, monitoring, backups, and audit logging. No system is risk-free. See our Security page to report a vulnerability or incident.

9. Your choices

An authorized organization may disconnect Amazon access, revoke a grant through Amazon, request a copy of its service data, or request deletion. Individual privacy requests will be verified and coordinated with the seller organization that controls the relevant account data.

10. Changes

We will update this notice before materially expanding data categories or uses. The effective date above identifies the current version.