Bamboo Rank respects the privacy of website visitors, prospective clients, and the Amazon sellers whose advertising accounts we manage. This policy explains, in plain terms, what information we hold, why we hold it, how we protect it, and the choices available to you.
01Who we are
Bamboo Rank is the trading name of Bamboo Rank LLC, a limited liability company registered in the State of Wyoming, United States. Operations are conducted from Kuala Lumpur, Malaysia, where the founder and primary operator is based.
For the purposes of UK GDPR and EU GDPR, Bamboo Rank LLC is the data controller for personal information collected through our website and during business correspondence. Where we process Amazon seller data on behalf of a client, the client is the data controller and Bamboo Rank LLC acts as a data processor under the terms of the engagement contract.
For privacy enquiries, contact [email protected].
02What this policy covers
This policy is structured around the two distinct categories of data Bamboo Rank handles:
- Website data: information collected when you visit bamboorank.com, complete a form, book a call, or otherwise interact with our online presence.
- Amazon seller data: information accessed via Amazon's Selling Partner API (SP-API) and Advertising API on behalf of clients who have authorised Bamboo Rank to manage their advertising.
The two categories are governed by different legal frameworks and protected by different controls. We address each separately below.
03Website data, what we collect
Information you provide
When you book a call through Calendly, send an email, or otherwise contact us, you may provide:
- Your name and email address
- Your business name and website
- Information about your Amazon advertising goals or current performance
- Any other information you choose to share
We use this information to respond to your enquiry, prepare for the fit call, and (where you become a client) to deliver the service. Calendly is a separate service operated by Calendly LLC; their own privacy policy applies to data collected through their booking flow.
Information collected automatically
Like most websites, bamboorank.com collects limited technical information automatically when you visit:
- Pages viewed, time on page, navigation paths, and outbound link clicks
- Browser type, operating system, and approximate screen size
- Approximate geographic location at country or region level (derived from IP, not stored)
- Referring website or advertisement (where applicable)
We do not store full IP addresses, do not attempt to identify individual visitors, and do not build advertising profiles based on your visit.
04Cookies and analytics
The site currently runs no analytics, tag-management, or advertising-tracking tools. No cookies are set for these purposes, no behavioural data is collected, and no visitor profiles are built.
If we add any tracking in the future, for example to understand how visitors use the site or to measure paid advertising, this policy will be updated, the "Last updated" date at the top of the page will reflect the change, and visitors located in the United Kingdom or European Union will be prompted to consent through a cookie banner before any tracking loads.
We do not, and will not, use cookies for behavioural advertising, share visitor data with data brokers, or sell or rent visitor information to any third party.
05Amazon seller data
When a client authorises Bamboo Rank, the authorisation is initiated from a page on bamboorank.com and completed on Amazon's own Seller Central consent screen, where the client signs in to their own Amazon account and approves the access. Bamboo Rank never sees the client's Amazon password. Amazon then redirects the client briefly back to a small, scoped component on bamboorank.com, which receives Amazon's authorisation code, exchanges it for an access token, and verifies the token works for the region the client intended. Only verified tokens are accepted. The component carries the encrypted credential required for that exchange and nothing else; no Amazon datasets, reports, or buyer information ever passes through it. This section explains what we access via that authorisation, what we do not access, and how we protect what we do access.
What we access
Under the Amazon Selling Partner API, the only report Bamboo Rank routinely retrieves is the open listings report (GET_FLAT_FILE_OPEN_LISTINGS_DATA), which contains the seller's active SKU catalogue, prices, and quantities. Its primary use is each product's current price, which is a direct input to advertising bid optimisation and to new campaign creation. It is also used as a catalogue check: if a product is not present in the seller's listings data, no campaign is created for it.
Under the Amazon Advertising API, we access the seller's advertising campaigns, ad groups, keywords, product targets, bids, budgets, and performance metrics, in order to optimise those campaigns on the seller's behalf.
Through the Seller Central user-permissions framework, the seller may additionally grant us read-only ("View") access to specific reports and tools that support the advertising service. The exact permissions granted are visible to the seller in their Seller Central account and may be revoked by the seller at any time.
What we do not access
- Buyer or customer personally identifiable information (PII)
- Order data, shipping addresses, or fulfilment information
- Banking, payment, or tax information
- Brand registry data beyond what is required to manage advertising
- Any seller data that is not directly necessary to deliver the contracted advertising service
How we protect Amazon seller data
Bamboo Rank operates a single managed developer workstation for Amazon API access. Specific controls include:
- Encryption at rest: full-disk encryption (FileVault) on the workstation; encrypted backups
- Isolated credentials: per-client refresh tokens stored in an encrypted credential store outside source control; never embedded in shared documents or email
- Audit logging: every API request issued to Amazon is recorded in structured logs retained for at least 90 days
- Kill switch: a manual control that halts all Amazon API access immediately, used during incident response or credential rotation
- Scoped processing: Amazon datasets, reports, and buyer data are not transmitted to any third-party cloud service, analytics platform, or AI training pipeline; they are processed only on the managed workstation. Limited, scoped exceptions that involve no Amazon datasets, reports, or buyer data, namely Bamboo Rank's own operational records, a single client-owned analytics figure, and the small serverless component that handles the OAuth authorisation handshake itself, are described on our Security & Compliance page.
- Retention discipline: operational files retrieved during a workflow run are deleted at the end of the run; only structured audit logs are retained.
The full set of controls and the incident response plan are described on our Security & Compliance page.
Security incidents
In the event of a security incident affecting Amazon seller data, Bamboo Rank will notify Amazon at [email protected] within 24 hours of detection, in line with the Amazon Data Protection Policy. Affected clients will be informed in parallel.
06How we share information
We do not sell, rent, or trade personal information. We share information only in the following limited circumstances:
- Service providers we use to operate the business (for example: email hosting, accounting software, the Calendly booking platform). These providers are bound by their own contractual confidentiality obligations.
- Amazon, where the data is Amazon seller data accessed through the Amazon APIs as part of delivering the advertising service.
- Legal compliance, where disclosure is required by law, court order, or to protect against fraud or harm.
We do not transfer Amazon seller data to any party other than Amazon and the seller themselves. The limited, scoped external touchpoints that do not involve Amazon datasets, reports, or buyer data are described on our Security & Compliance page.
07International data transfers
Bamboo Rank LLC is registered in the United States and operations are conducted from Malaysia. Where we process the personal data of UK or EU residents, that processing inevitably involves an international transfer.
Where required, we rely on appropriate safeguards for such transfers, including the UK International Data Transfer Agreement and the EU Standard Contractual Clauses. For Amazon seller data, the Amazon Data Protection Policy governs cross-border handling and we comply with its requirements.
08Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and resolve disputes:
- Enquiry correspondence: retained for up to 24 months after the last contact, then deleted unless we are working together.
- Client records: retained for the duration of the engagement and for seven years afterwards, in line with US tax and corporate record-keeping requirements.
- Amazon seller operational data: deleted after each optimisation cycle. Audit logs of API activity, which contain no buyer personal data, retained for at least 12 months and no longer than 18 months, in line with the Amazon Data Protection Policy.
09Your rights
Depending on your location, you may have the following rights in relation to personal data we hold about you:
- The right to access a copy of your data
- The right to request correction of inaccurate data
- The right to request deletion of your data, where we have no overriding legal obligation to retain it
- The right to object to processing, or to request restriction of processing
- The right to withdraw consent at any time, where we rely on consent
- The right to data portability, where applicable
- The right to lodge a complaint with a data protection authority, for UK residents, this is the Information Commissioner's Office
To exercise any of these rights, write to [email protected]. We will respond within 30 days.
10Children
Bamboo Rank's services are directed at business owners and are not intended for individuals under the age of 16. We do not knowingly collect information from children. If you believe we have inadvertently received such information, please contact us so we can delete it promptly.
11Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. The "Last updated" date at the top of this page is always current. Material changes will be communicated through a notice on the homepage for at least 30 days before they take effect. Substantial changes affecting active clients will additionally be communicated by email.
12Contact
For all privacy-related correspondence, including the exercise of your rights and reports of suspected security incidents:
Privacy Officer
Bamboo Rank LLC
30 N Gould Street, Suite R
Sheridan, WY 82801
United States
[email protected]