Privacy Policy

EcomLinked ("we", "us") helps Amazon sellers turn settlement reports into accurate journals, invoices and bills in QuickBooks Online and Xero. This policy explains what data we handle, why, and your rights under UK GDPR and the Data Protection Act 2018. Questions: squarezoned@gmail.com.

1. Data we collect

• Account data: your name, email address and sign-in details.
• Google sign-in data: if you choose "Continue with Google", we receive your name, email address and profile picture from your Google Account (scopes: openid, email, profile). We do not access your Gmail, contacts, Drive, calendar or any other Google data.
• Amazon financial data: settlement reports and financial events (fees, sales totals, refunds, reserves, reimbursements, payouts), retrieved through the Amazon Selling Partner API with your authorisation, or files you upload.
• Order destination country: the delivery country of an order ID, used only to classify fees and VAT as domestic or international.
• Accounting settings: account mappings, VAT registration details, product groups and SKU VAT rates you configure.
• Connection tokens: OAuth tokens for Amazon, QuickBooks and Xero so we can act on your behalf.

2. Data we do not collect

We do not request, store or process buyer personally identifiable information (PII) such as buyer names, street addresses, phone numbers or email addresses. We do not request Amazon restricted-data roles. We never sell data or use it for advertising.

3. How we use data

• To calculate split-month journals, VAT, rollovers and reserves, and reconcile payouts to your bank.
• To post journals, invoices or bills to the accounting software you connect, or to produce CSV exports.
• To provide support, keep the service secure and meet legal obligations.

Our lawful basis is performance of our contract with you, and our legitimate interest in running a secure service.

4. Amazon data

Data obtained through the Amazon Selling Partner API is used solely to provide accounting services to the seller who authorised it, in line with Amazon's Acceptable Use Policy and Data Protection Policy. It is never shared with other sellers or third parties except the accounting platform you choose to connect.

4a. Google User Data and Google Sign-In

Google data we access

EcomLinked uses Google OAuth to allow users to sign in to their EcomLinked accounts. When a user chooses "Continue with Google" and authorises the request, EcomLinked receives the basic Google profile information permitted by the following scopes: openid, email, and profile.

This information may include the user's Google account identifier, email address, name, and profile picture. EcomLinked does not request access to Gmail messages, Google Drive files, Google Calendar, Google Contacts, or other Google account content through these scopes.

How we use Google data

We use Google profile information only to authenticate users, create or identify their EcomLinked accounts, associate sign-in sessions with the correct account, display their name and profile picture within the application, and protect the account against unauthorised access.

We do not use Google user data for advertising, sell it, or use it to build data-broker databases. We do not use Google user data to train general-purpose artificial intelligence or machine-learning models.

Storage and protection

EcomLinked processes Google sign-in information through its authentication system. Where account information is retained, it is stored only for account administration, authentication, security, and the purposes described in this policy.

Information transmitted between the user's browser and EcomLinked is protected using HTTPS/TLS. Stored information is protected using the security measures applicable to the systems in which it is held, including encryption where supported and access controls intended to prevent unauthorised access.

Sharing and disclosure

EcomLinked does not sell or disclose Google user data to advertising networks, data brokers, or information resellers. Google user data may be processed by service providers acting on EcomLinked's behalf, such as authentication, hosting, and database providers, solely as necessary to operate, secure, and maintain the service.

We do not otherwise transfer Google user data to third parties, except where required by law or permitted under the Google API Services User Data Policy. Service providers are permitted to process data only for their authorised service-related purposes.

Human access and confidentiality

EcomLinked does not routinely review Google profile information manually. Authorised personnel may access relevant information when necessary to provide user-requested support, investigate security incidents or abuse, or comply with legal obligations, subject to appropriate access controls.

Retention and deletion

Google profile information associated with an EcomLinked account is retained for as long as necessary to operate that account and provide the sign-in functionality. When an account is deleted, associated Google profile information held by EcomLinked is deleted or de-associated as part of the deletion process, subject to applicable legal requirements and limited backup retention periods.

Users can request account deletion through the account deletion feature in EcomLinked or by contacting squarezoned@gmail.com. Users may also revoke EcomLinked's Google account access through their Google Account permissions page at https://myaccount.google.com/permissions.

Google API Services User Data Policy

EcomLinked's access to and use of information received through Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only for the purposes disclosed in this policy and is not used or transferred for prohibited purposes.

Privacy questions and deletion requests can be sent to squarezoned@gmail.com.

5. Who we share data with

• Amazon — to retrieve your reports.
• Intuit QuickBooks / Xero — only when you connect them, to post your entries.
• Infrastructure providers — hosting and database services that process data on our behalf under contract.

6. Security

• All traffic is encrypted in transit using TLS (HTTPS).
• Data is encrypted at rest (AES-256) in our hosted database.
• Connection tokens are held server-side only, never exposed to the browser, with row-level access controls so each user can access only their own data.
• Administrative access is limited to authorised personnel using multi-factor authentication.
• Security incidents affecting your data will be notified to you and, where required, to the ICO and Amazon within 24 hours of discovery.

7. Retention and deletion

Payouts, accounting settings, product groups and delivery-country data currently stay in the browser where you use EcomLinked. Connection tokens and any remaining beta submissions are stored server-side. In the workspace, open Profile → Delete my account to permanently remove your sign-in account, server-side connection records and remaining beta uploads, and clear workspace data from the current browser. You must confirm before deletion starts. Entries already posted to QuickBooks or Xero, downloaded files and data saved in other browsers or devices are not removed; clear those separately and revoke EcomLinked access in connected services. Deleting your account does not close your Amazon seller account. You may also request deletion assistance by emailing squarezoned@gmail.com; we aim to complete requests within 30 days. Backup copies may persist until the hosting provider's backup retention period expires.

8. Your rights

You may request access, correction, deletion, restriction, portability, or object to processing. Contact squarezoned@gmail.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

9. Cookies

We use only essential storage needed to keep you signed in and remember preferences such as theme and settings. We do not use advertising or analytics tracking cookies.

10. International transfers

Our hosting providers may process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or the UK International Data Transfer Addendum to standard contractual clauses.

11. Children

EcomLinked is a business service and is not intended for anyone under 18. We do not knowingly collect children's data.

12. Data controller and contact

EcomLinked is the data controller for the personal data described in this policy. For any privacy question, access request or deletion request, email squarezoned@gmail.com. We respond within 30 days.

13. Independence and trademarks

Ecomlinked is a trading name of Squarezoned Ltd, a company registered in England & Wales with company number 15065588. Ecomlinked is an independent third-party solution and is not affiliated with, endorsed by, sponsored by, or otherwise associated with Amazon.com, Inc. or any of its subsidiaries.

Amazon, Amazon Seller Central, Selling Partner API, FBA, and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates. Xero is a registered trademark of Xero Limited. All other trademarks are the property of their respective owners.

14. Changes

We will post updates on this page with a new "Last updated" date and notify you of material changes by email before they take effect.