Privacy Policy - How we handle your data

Goyal Studio (“Goyal Studio,” “we,” “us,” or “our”), operated by Goyal Advisory LLC, a company organized under the laws of the State of Illinois, provides retail-media management and analytics services for brands selling on Amazon and other marketplaces. This Privacy Policy explains how we collect, use, share, and protect information when you visit goyalstudio.com (the “Site”) or use our services (collectively, the “Services”).

By using our Services, you agree to the practices described in this Policy. If you do not agree, please do not use our Services.

1. Information We Collect

1.1 Information you provide directly

• Account and contact information — name, business name, email address, phone number, role, and similar information you provide when you contact us, sign up for our Services, or correspond with us.
• Authentication credentials and tokens — when you authorize Goyal Studio to access your Amazon Seller Central, Vendor Central, Amazon Advertising, or related accounts, we receive OAuth refresh tokens and account identifiers necessary to operate the Services on your behalf.
• Communications — content of emails, messages, and other correspondence you send us.
• Billing information — to the extent we process payments directly, we may collect billing contacts and payment-related details (we do not store full payment-card numbers; payment processing is handled by third-party processors).

1.2 Information we receive from third parties on your behalf

When you authorize us to connect to your accounts on platforms such as Amazon Selling Partner API, Amazon Advertising API, Amazon DSP, and similar services, we may receive:

• Sales, order, inventory, fulfillment, and product catalog data;
• Advertising campaign performance data, including impressions, clicks, spend, conversions, ACOS, ROAS, and related metrics;
• Customer-level data exposed by those platforms only as strictly necessary to deliver the Services (for example, aggregated traffic and conversion metrics; we do not request access to end-customer personally identifiable information except where strictly required for an authorized use case);
• Other data made available by these platforms under the scope you have authorized.

We refer to data we receive from Amazon platforms collectively as “Amazon Information.” We treat Amazon Information as confidential and use it only as described in this Policy and as permitted by Amazon’s applicable terms and Data Protection Policy.

1.3 Information collected automatically

• Site usage data — IP address, browser type, device identifiers, pages visited, referring URLs, and similar information collected through cookies, log files, and analytics tools.
• Cookies and similar technologies — we use cookies for essential site functionality and analytics. You can control cookies through your browser settings.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Services, including generating reports and analytics for clients;
• Manage and optimize advertising campaigns, listings, and operations on behalf of clients who have authorized us;
• Communicate with you about the Services, support requests, and account matters;
• Improve and develop new features of the Services, using only information for which we have a lawful basis;
• Detect, prevent, and address technical issues, fraud, and abuse;
• Comply with legal obligations and enforce our agreements.

We do not sell Amazon Information or client data to third parties, and we do not use Amazon Information for advertising or marketing to anyone other than the client to whom it pertains.

3. How We Share Information

We share information only as follows:

• Service providers (subprocessors) — cloud hosting, database, analytics, email, error monitoring, and similar vendors that process information on our behalf under written contracts requiring confidentiality and appropriate security.
• With your direction — when you instruct us to share data with a third party (for example, your accounting team or another tool you use).
• Legal and safety — when required by law, valid legal process, or to protect the rights, property, or safety of Goyal Studio, our clients, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to standard confidentiality protections and applicable law.

We do not sell or rent personal information or Amazon Information.

4. Amazon Data Handling

To the extent we receive Amazon Information through Amazon’s APIs, we comply with Amazon’s Data Protection Policy and applicable Acceptable Use Policies. Specifically:

• We use Amazon Information solely to provide the authorized Services to the client to whom it pertains.
• We protect Amazon Information using encryption in transit (TLS) and at rest, role-based access controls, and the principle of least privilege.
• We do not share, sell, license, or otherwise distribute Amazon Information to unauthorized third parties.
• We retain Amazon Information only as long as necessary to provide the Services or as required by law, and we delete or anonymize it when no longer needed.
• If a client revokes authorization or terminates services, we cease accessing their Amazon accounts and delete or return Amazon Information in accordance with applicable Amazon policies and our agreement with the client.

5. Data Security

We use commercially reasonable administrative, technical, and physical safeguards to protect the information we hold, including encryption, access controls, monitoring, and regular review of our security practices. No system is perfectly secure; we cannot guarantee absolute security and encourage clients to use strong, unique credentials and enable multi-factor authentication wherever offered.

6. Data Retention

We retain personal information and Amazon Information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it.

7. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate personal information;
• Request deletion of personal information;
• Opt out of certain uses of your information;
• Request portability of your personal information;
• Lodge a complaint with a supervisory authority.

To exercise these rights, contact us at the email below. We will respond within the timeframes required by applicable law. We do not discriminate against individuals for exercising their privacy rights.

8. International Data Transfers

We are based in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to such transfers, subject to applicable law.

9. Children’s Privacy

Our Services are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

10. Third-Party Services

The Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with information.

11. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the “Effective date” above and, where appropriate, provide additional notice (for example, by email or a notice on the Site). Your continued use of the Services after changes become effective constitutes acceptance of the updated Policy.

12. Contact Us