Privacy notice

Last updated 16 October 2026.

Terms of use · Privacy notice · Cookie notice · Refund policy

1. Who is responsible for your data

Product Healer is a service of Commercelia Ltd, which is the data controller for the personal data described here (company number 13087198), registered address Suite 109, 28a Church Road, Stanmore, England, HA7 4AW.

To contact us about privacy, email support@producthealer.tech or use the contact form.

2. What we collect

• Account details — your name or username, your email address and your password, stored only as a one-way hash. We never store a readable password.
• Your work — the hunts you run, keywords you star, products, costs, expenses, purchase orders, supplier quotes, alert rules, reports and AI conversations you create. This is visible to your workspace and the people you invite into it.
• Data from connected accounts — if you connect a marketplace or shop, we read and store your orders (order numbers, dates, amounts, items and status), the fees and refunds the channel reports, your listings, stock levels and advertising performance. We do not store your buyers' names, addresses or contact details, except for dropshipping (next point). Nothing is read from an account you have not connected.
• Buyer shipping addresses (dropshipping only) — when you use dropshipping and an order is routed to a supplier, we read that buyer's name, shipping address, phone and email from your channel, keep them encrypted, send them to the supplier you chose so the parcel can be delivered, and delete them 30 days after the order ships or is cancelled. For these buyers you are the controller and we process their details for you; our staff cannot read them.
• Shipping labels — when you send an order to your courier from Shipping labels, we read that buyer's name, address, phone and email from your channel and pass them straight to the courier account you connected; we do not store them. The courier's label (which prints the address) is kept encrypted for 30 days so you can reprint it, then deleted.
• eBay seller tools — eBay Messages keeps your buyers' messages and your replies (the buyer's eBay username, the subject and the text) so you can read and answer them here; Auto Feedback records which sales it left feedback for. Both read and write only through the eBay account you connected.
• Supplier quote requests — when you send one, your supplier's name and email address (which you entered) and your own email address, as the reply address, go in the email we send for you.
• Product feeds — a feed holds your shop's public product details (titles, prices, photos, links) at a secret address you give to Google or Meta.
• Referrals — if you sign up through someone's referral link, we record which account referred you, and when you first pay we record that their reward was earned (they see a count, never who you are).
• UK Fulfilment — if you ask for a fulfilment quote, the name, business, email, phone and details you type in. If you use our UK warehouse, the products you list, the stock we hold for you and every movement of it, the orders you send to us (order number, channel, items, courier and tracking) and what each piece of work cost. To dispatch an order, our warehouse team prints its packing slip with the buyer's name and address read from your channel at that moment; the address is printed for that parcel only and not stored in our database. When our warehouse buys the courier label, the address is passed to the courier for that parcel and the label is kept, encrypted, for 30 days. We also keep the batch codes and best-before dates of the stock we hold for you, and the returns you tell us to expect. For an order you send us yourself (a CSV, the order form, our API, or your BigCommerce, Wix, Squarespace, PrestaShop, OnBuy, Etsy, Magento, ManoMano, Not On The High Street, Mirakl marketplace, Faire, Ankorstore, Kaufland, Allegro, bol.com, Fruugo, Linnworks or Veeqo account) we keep the buyer's name, address and phone number encrypted until the parcel is sent, then delete them 30 days after dispatch or cancellation. If you give the buyer's email address and switch dispatch emails on, we keep it encrypted with the address, send that buyer one email when the parcel leaves (in your shop's name, replies to you) and delete it with the address. Questions you and our team write about your orders, the damaged stock you ask us to return or dispose of, the delivery slots you book and freight quotes are kept with your account. For parcels sent with a courier that reports it (DHL Express, Aramex), we read the parcel's delivery status by its tracking number and keep the latest status with the order; refunds you send to buyers from here are recorded with the order (amount, channel, outcome). If you switch on your Amazon stock as a backup, the buyer's name, address and phone number of a held order are passed to Amazon (your own Amazon account) for it to send the parcel; nothing more is kept. Webhooks you add receive our references, SKUs, units, courier and tracking - never a buyer's name, address or email. When a buyer asks for an exchange on your returns page, the swap is sent to the address read from the original order at that time. Photos our team takes of deliveries, returns and parcels are kept for 365 days; a courier's proof of delivery (which can show who signed for the parcel) is kept for 90 days and shown only to your workspace; purchase orders you upload as EDI files become orders like any other, and the file itself is not kept; serial numbers of the units we hold, the fulfilment centre and business addresses of bulk shipments you book, gift notes and the problems we record against your orders are kept with your account. For a subscription box, the names, addresses and phone numbers of the people it goes to are kept encrypted for as long as they are on the box and deleted when you remove them or the box; each month's orders are then kept like any order you send us. If you offer prepaid return labels, the buyer's delivery address is read from the order when they book the return and passed to our courier for that label only; the label is kept encrypted for 30 days so the buyer can print it. Amazon seller-shipped orders can have their label bought through Amazon's own shipping, on your Amazon account; Amazon sees the parcel as it already sees the order. Your buyers' tracking page shows the parcel's progress and the items, never their name or address; your returns page asks a buyer for the order number and the delivery postcode, checks the postcode against the delivery address and keeps neither - only the return they book (items, reason, return number). We run a second warehouse in the United Arab Emirates: if your account is there, your stock, orders and the addresses above are handled by our team there, with the same rules (a UAE address carries the buyer's emirate and phone number instead of a postcode). For a cash-on-delivery order we keep the amount to collect, whether the courier paid it to us and when we paid it to you, with your account. For a Noon order the airway bill you attach (which shows the buyer's address) is kept encrypted for 30 days like our own labels. When stock moves between our two warehouses, the commercial invoice shows your business name and the goods, never a buyer.
• Online Store — for a shop you build: its settings, pages, products, delivery prices and the domains you connect; your Stripe secret key and webhook secret, encrypted and never shown back; and its orders (what was bought, the amounts, discount codes used, Stripe's fee when Stripe reports it). For each order we keep the buyer's name, email, delivery address and phone number encrypted - you, as the shop's seller, decide what they are used for - and delete them 30 days after the order is sent or refunded, or after 120 days at most. A shop sets a cookie only to remember the password of a password-protected shop; a buyer's basket stays in their own browser. Photos you upload are stored on our server for your shop. A shop's visits are counted without cookies: a visitor is recognised for one day only by a code made with a salt we replace daily (deleted after two days), and the figures you see are totals. A shop's customer list keeps each buyer's name and email encrypted with their order count until two years after their last order (you can forget one sooner), and a review a buyer leaves shows their chosen first name and words once you approve it.
• Landing pages — for a page a seller publishes, we count how many times it was opened and its button pressed. No cookie is set and no visitor's address is kept.
• Chrome extension — if you use it, it sends us the product IDs (ASINs) of the Amazon product and search pages you open, the words of an Amazon search, and the marketplace, so it can show our figures for them; only when you press the extension's button to use the page, the public listing details of the product page you have open (title, brand, price, Best Sellers Rank, rating, number of reviews, size and weight, and Amazon's own labels shown there), used for that one fees-and-profit answer and not stored; on eBay, TikTok Shop, Walmart, Etsy, AliExpress, CJdropshipping, Alibaba.com, 1688 and Noon product pages, that listing's public details (title, price, postage, units sold, rating, reviews, watchers, seller and barcode), and on those sites' search and category pages each result's title, price and units sold as shown, used to compare them with Amazon and not stored; the reviews shown on a product page (star rating and text) when you open the extension's Complaints tab, used to find recurring complaints and not stored; the product page's title, bullet points and description when you press "Score this listing", used for that score and not stored; the keywords you ask the Listing tab to check, kept with the check like the Index Checker in the app; a product you choose to add to your buy list, with your cost and (from a supplier page) its link; and the cost or price you type into its profit tab or panels, which is used for that calculation and not stored by us (the extension remembers your cost per product, your fee rate per site and the products you opened lately in your own browser). Every 15 minutes it asks producthealer.tech how many of your notifications are unread, to show the count on its icon. "Download these reviews" builds a file in your browser from the reviews shown on the page, without reviewer names, and sends nothing. "Check this Shopify store" reads the store's public Shopify settings on the tab you are on, only when you press it, and sends nothing. It does not read your own accounts, your orders, any other browsing or your passwords. Its sign-in is kept in the extension's own storage in your browser and is sent only to producthealer.tech. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements: it is used only to show you these figures, never sold, never used for advertising and never shared except as this notice describes.
• Provider credentials — API keys and access tokens you give us are encrypted at rest, never shown back in full to you or to our staff, never written to our logs, and deleted when you disconnect.
• Billing — Stripe processes payments. We keep your plan, subscription status, Stripe's customer reference and copies of your invoices. We never see or store your full card number.
• Support — messages you send through the contact form or to our support address, and our replies.
• Security and usage records — sign-in history and active sessions (with your browser type), a record of the actions taken in a team workspace, usage counts against your plan's allowances, and logs of calls to connected providers. Where we record an IP address in our database for rate limits, sessions or sign-in history, we store it only as a salted one-way hash.
• One-trial checks — a one-way hash of your email mailbox, so a trial cannot be claimed twice.
• Server logs — our web server records requests, including IP addresses, for security and troubleshooting.
• Visits to our public pages — which pages were viewed and when, the buttons and links pressed, the site or campaign that sent you there, your type of device, browser and system, and the town and country your internet address points to (looked up on our own server in the MaxMind GeoLite2 and DB-IP location databases; your address is not sent to anyone for this). We record no cookie and nothing in your browser. Visits are joined only by a code made from your internet address and browser with a key that is replaced every day and then discarded (a copy can remain in a database backup until that backup is deleted), so the code cannot be turned back into your address and we cannot recognise you on another day. We do not link a visit to your account. If your browser sends "Do Not Track" or "Global Privacy Control", nothing is recorded.

3. Why we use it, and our legal bases

• To provide the service you signed up for (performance of a contract): your account, the tools, connected accounts, billing, and the emails the service sends — sign-in, security, billing, and alerts and reports you set up.
• To keep the service secure and fair (our legitimate interests): rate limits, sign-in protection, one trial per person, preventing abuse, and fixing faults.
• To understand how our website is used (our legitimate interests): counting visits to the public pages, where they come from and which pages help people decide, so we can improve the site.
• To answer you (legitimate interests, or steps before a contract): support requests and contact-form messages.
• To meet legal duties (legal obligation): tax and accounting records of payments, and responding to lawful requests.

We send product news and tips by email only if you choose "Yes, email me" (asked once on your dashboard; change it any time on your profile) - consent you can withdraw whenever you like, recorded with its date. Without it you get account, security and billing emails only. We do not use your data for advertising or profiling. We make no decisions about you with legal or similarly significant effects by automated means alone.

4. Who receives data

We do not sell your data or share it for advertising. It is shared only with the service providers below, and only to provide the service:

• Stripe — processes payments and issues invoices when you subscribe, and calculates tax where it applies.
• Anthropic — when you use an AI feature, your question or pasted text, together with the research data from your workspace that is relevant to it, is sent to Anthropic's API to produce the answer. Nothing is sent to Anthropic if you do not use an AI feature.
• fal.ai — when you make a video with Ai Healer, your description, script and any photo you upload are sent to fal.ai, which runs the video model and returns the video. The photo and the video are kept in your workspace until you delete them. Product photos work the same way: the photo and your description of the background go to fal.ai, and the photo and the result are kept until you delete them. Nothing is sent to fal.ai if you do not use Ai Healer.
• Google Sheets links — a sheet link is a private address that answers with the figures you chose (product profit, sales by channel, profit and loss or expenses). Anyone holding the address can read them, so only the workspace owner can make one, and deleting it stops it at once. Nothing is sent to Google by us; the spreadsheet fetches the address.
• Google (YouTube Data API) — when you search for creators, the topic and country you enter are sent to YouTube's API (on our key, or on your own key if you added one). Nothing else about you is sent.
• SerpApi — when you search retailers for a product (Retail Matches) or check nearby stock, the product's title or barcode and the marketplace's country are sent to SerpApi, which runs the Google Shopping search (on our key, or on your own key if you added one). For a nearby stock check the US ZIP code you type is sent as well; we do not keep it. Retail results are public search results and are kept for a day.
• Meta (Ad Library API) — when you search the Meta Ad Library, your search words and the EU countries you pick are sent to Meta with your own access token. We keep no results.
• Slack, Discord and Telegram — if you add one of them as an alert channel, each alert's title, one line of detail and a link into your account are sent to the channel you set up. Nothing is sent there until you add it.
• EUIPO — when you run a trademark search, the name and classes you enter are sent to the European Union Intellectual Property Office's trademark search API. Nothing else about you is sent.
• European Patent Office — when you run a patent search, the words you enter (and any year) are sent to the EPO's Open Patent Services. Nothing else about you is sent. The worldwide trademark and patent buttons only open those registers' own sites in your browser.
• Keepa — when you look up a product without your own Keepa key, the product identifiers you look up (such as an ASIN and its marketplace) are sent to Keepa on our key.
• Keyword suggestion sources — when you run a keyword hunt, the seed keywords you enter are sent to the public autocomplete services of eBay, TikTok, Google and YouTube by our server. Amazon's suggestions are read by your own browser directly from Amazon (so Amazon sees your browser's request, without your Amazon cookies) and the answer is passed to us; our server never calls Amazon's suggestion service.
• The marketplaces and providers you connect — requests made for you go to them with your credentials, as you would expect when you connect an account.
• Your dropshipping suppliers — when an order is placed for you with AliExpress, CJdropshipping, Avasam, vidaXL, BigBuy, Printful, Printify, Gelato or Doba, the buyer's name, shipping address, phone and (where the supplier asks for it) email go to that supplier to deliver it.
• Your couriers — when you send an order to Royal Mail Click & Drop or ShipStation, the buyer's name, address, phone and email and the order's items go to that courier account of yours.
• Our email delivery provider — receives your email address and the content of the messages we send you.
• Our hosting provider — runs the servers the service and its database live on.
• Authorities — only where the law requires it.

Exchange rates come from the European Central Bank's public reference rates; nothing about you is sent to fetch them. Our support staff can view your account's data when that is needed to help you, but cannot read your provider credentials. There are no advertising networks, third-party analytics trackers or third-party scripts; the visit counting described above is our own. Inside the workspace, product images are loaded from Amazon's image servers (see the cookie notice).

5. International transfers

Some of our providers, including Stripe, Anthropic and fal.ai, process data in the United States and other countries outside the UK and European Economic Area. When your data goes to them, we rely on the safeguards the law provides for such transfers, such as adequacy decisions or the standard contractual clauses and UK addendum those providers offer.

6. How long we keep it

• Your account and work — for as long as your account exists, including after a trial or subscription ends, so you can pick up where you left off. Ask us to delete the account and it is removed, together with its hunts, products, connections, credentials, orders, support tickets and usage records.
• Provider credentials — deleted as soon as you disconnect that account.
• Team activity records — 180 days, then deleted automatically.
• Rank tracking history — 365 days.
• Buyer shipping addresses (dropshipping) — 30 days after the order ships or is cancelled, then deleted automatically.
• Shipping labels — 30 days after they are made, then deleted automatically.
• eBay buyer messages (eBay Messages) — 90 days, then deleted automatically here; eBay keeps its own copy.
• Rate-limit and sign-up counters (a hashed address and a time) — 2 days, then deleted automatically.
• Free tool usage counts (a hashed address, the tool and the day) — 180 days, then deleted automatically.
• Records of visits to our public pages — 395 days (13 months), then deleted automatically.
• Database backups — encrypted; we keep the 14 most recent backups and every backup from the last 14 days, then they are deleted. Deleted data can remain in a backup until that backup is removed.
• Provider call logs (a record of each call we made to Amazon or another provider you connected, without your credentials) — 90 days, then deleted automatically.
• Emails we sent you and our record of sending them — 90 days, then deleted automatically.
• Sign-in history — 365 days, then deleted automatically.
• Audit logs (changes made by our staff, and changes made in your workspace) — 730 days, then deleted automatically. All of these are also removed when the account is deleted, except our staff audit log.
• Records we must keep — invoices and payment records, for as long as tax and accounting law requires. The one-way hash of your mailbox is kept so a trial cannot be claimed again.

7. Security

• All traffic is encrypted with HTTPS.
• Passwords are stored as one-way hashes. Provider credentials and our own keys are encrypted at rest.
• Every customer query is limited to that customer's own workspace.
• Staff use separate accounts with mandatory two-factor authentication, and staff changes to settings are logged.
• Repeated failed sign-ins are blocked, and resetting or changing your password signs out your other browsers and revokes your API tokens.

No system is perfectly secure. If a breach affects your data, we will tell you and the regulator where the law requires.

8. Data from Amazon

This section applies when you connect your Amazon Seller Central account (Selling Partner API) or Amazon Ads account, and to the Amazon details our Chrome extension reads from pages you open when you ask it to. How to connect and disconnect is on Connecting your Amazon account.

• What we read. Only what the tools you use need: your orders (order numbers, dates, amounts, items and status), fees, settlements and refunds, stock and FBA shipments, listings and catalogue details for your own products, prices and Buy Box offers, the reports you ask for (such as Brand Analytics and business reports) and your advertising performance. We do not read buyers' names, addresses or contact details from Amazon unless you use UK Fulfilment with Amazon seller-shipped orders (see "Buyer addresses" below).
• Buyer addresses (only for UK Fulfilment). If you send seller-shipped Amazon orders to our warehouse, and only once Amazon has approved our app for its restricted shipping role, we read the buyer's name, delivery address and phone number for that order through a one-time restricted token, only to print the packing slip and buy the delivery label. The address itself is never stored in our database; the label (which shows it) is kept encrypted for 30 days in case it must be reprinted, then deleted, and only the warehouse staff handling the parcel can open it. It is never used for marketing, profiling or anything else, and never shared except with the courier delivering the parcel. Until that approval and your choice to send Amazon orders to us, none of this happens.
• What we use it for. Only to provide the tools to you, the seller who connected the account: your dashboards, profit and stock figures, alerts and the changes you switch on. We do not sell it, use it for advertising, or use it for any other customer.
• Never combined or shared. Your Amazon data is kept in your own workspace. It is never combined with other sellers' data, never used to build figures, estimates or models that anyone else sees, and never shared with another customer. It goes only to the service providers that run this service for us (our server host and, for an AI tool you choose to use, the AI provider described in section 4).
• Who can see it. You and the people you invite to your workspace. You can (and, if you connect Amazon, should) switch on two-step sign-in with an authenticator app on Account → Security. Our staff use separate accounts with mandatory two-factor authentication, and every staff action is recorded; they look at your data only to help you when you ask us to.
• Where it is kept. On a server we rent from our hosting provider; the provider and its location will be named here.
• Protection. It travels only over encrypted connections (HTTPS). The tokens and keys that let us reach your Amazon account are encrypted at rest and are never shown back in full, logged or sent to a browser.
• How long we keep it, and deleting it. While your account exists, so your history stays complete. You can remove it at any time: Delete my Amazon data on Account → Integrations disconnects Amazon and deletes everything we read from it straight away (your own costs, batches and product links stay), and deleting your account deletes it all. Disconnecting alone stops all further reading at once. Deleted data can remain in a backup for up to 14 days. Provider call logs are deleted after 90 days.
• Security incidents. If we find a security incident involving Amazon data, we report it to Amazon (security@amazon.com) within 24 hours of finding it, and we tell the sellers affected.

9. Your rights

UK and EU (UK GDPR / GDPR)

You can ask for a copy of your data, have it corrected, have it deleted, restrict or object to how we use it, and receive it in a portable format. You can also complain to a data protection authority: in the UK that is the Information Commissioner's Office (ico.org.uk); in the EU, the authority where you live or work.

California (CCPA / CPRA)

You can ask what personal information we hold and how we use it, ask us to correct or delete it, and you will not be treated differently for doing so. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of.

United Arab Emirates (PDPL)

You can ask for information about and access to your data, have it corrected or erased, restrict or stop its processing, and object to decisions made about you by automated processing alone.

How to ask

To use any of these rights, including to delete your account, email support@producthealer.tech or use the contact form. There is no self-service delete button yet: we delete accounts on request. We may need to confirm your identity first. We reply within one month (45 days where California law applies), and tell you if the law lets us take longer. Many of your records can also be exported yourself as CSV from the relevant pages.

10. Children

The service is for adults running or researching a business. It is not meant for anyone under 18, and we do not knowingly collect data from children.

11. Changes to this notice

When we change how we handle personal data, we update this notice and the date at the top. For a significant change we will also tell you by email or in the workspace.

← Back to the homepage