Effective date: 14 September 2026 Last updated: 14 September 2026
NASST is operated by Way Alpha Traders Ltd, a company registered in Scotland (company number SC893744), whose registered office is at 3 Scylla Drive, Aberdeen, Aberdeenshire, AB12 3EG.
In this policy, "we", "us" and "our" mean Way Alpha Traders Ltd. "You" means the person using NASST.
We are registered with the Information Commissioner's Office under registration number ZC236862.
How to contact us about privacy: info@nasst.co.uk
NASST is a sourcing and analysis tool for Amazon sellers. You connect your own Amazon Selling Partner account, and NASST uses Amazon's official Selling Partner API to show you catalogue information, competing offers, Amazon's fees, whether you are permitted to list a product, your own inventory, and how often you hold the Buy Box. It requires an active Amazon seller account to function. NASST is offered to businesses established in the United Kingdom.
NASST does not collect, receive, store or process personal data about your customers.
Amazon's API can expose buyer names, delivery addresses and order details. NASST does not request them. The part of the application that could read order data was deliberately removed before launch, and we do not hold the Amazon authorisation needed to retrieve it.
If you are assessing us because you are responsible for your buyers' data: no buyer data reaches this system.
| Data | Why we hold it |
|---|---|
| Email address | It is your username, and how we send account emails |
| Password | To authenticate you. Stored only as a one-way hash — see §1.9 |
| Two-factor authentication secret and recovery codes | To protect your account and your connected Amazon account |
We do not ask for your name, postal address, date of birth or telephone number. We do not operate an age-restricted service and NASST is not directed at children.
| Data | Why we hold it |
|---|---|
| Account creation date, last sign-in, last password change, and password expiry (passwords expire after 365 days) | Security, and to show you your own account activity |
| Whether your email address has been verified, and when | To confirm the account belongs to you |
| Previous password hashes | To stop a password being reused when it is changed |
| Failed sign-in counts | To lock an account that is being attacked |
| Session records | To keep you signed in, and to let us end a session immediately if your account is compromised |
When you connect your Amazon account we store:
The refresh token is never sent to your browser under any circumstances. It exists on the server so NASST can act on your instruction, and nowhere else.
We use your IP address to apply rate limits when you register, sign in, enter a two-factor code or ask for a password reset. This protects your account, and the service, from automated abuse.
The counts behind those limits are held in memory for fifteen minutes and are not written to disk. Our error logs do not record your IP address: a log line carries the method, the endpoint, the status and how long the request took. Anything resembling a credential — a token, key, password or authorisation header — is removed before a line is written, and the identifier of the product you were looking at is replaced with a placeholder before the path is logged, so that a year of logs cannot become a year of which products you researched. Logs are kept for 365 days (§1.10).
One address is written down: when a single address scans for known-vulnerable paths, or is refused repeatedly, it is recorded in our security findings with the paths it asked for, so the attempt can be seen and dealt with. That record is kept while the finding is open, and for 30 days after it is resolved.
We do not use analytics, tracking pixels or advertising cookies.
Separately from personal data, NASST processes information about your Amazon selling business: product catalogue data, competing offers and prices, Amazon's fee estimates, listing eligibility, your inventory levels and shipments, and your Buy Box results.
This is generally not personal data, but it is commercially sensitive and it is yours. Our commitments:
business data, aggregate it across customers, sell it, or use it to build market intelligence products
request that cannot be attributed to a specific customer
The third commitment matters and is worth being direct about: we also trade on Amazon ourselves. We do not look at your data to inform what we buy.
When NASST shows you who holds the Buy Box on a listing, it records the winning seller's merchant identifier, whether the item was in stock, the price and the state of the offer. This is keyed to your account and kept for a rolling 7 days.
Some Amazon sellers trade as individuals, so a merchant identifier can be personal data about that person. Where it is, we rely on our legitimate interest in providing a competitor analysis feature to our customers, weighed against the limited and already public nature of the information and its short retention. We do not store a competing seller's trading address, VAT number or company registration number. A seller who wishes to object to this processing may contact us at info@nasst.co.uk.
Under Article 6 of the UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account; delivering the service | Contract — Art. 6(1)(b) |
| Sending service emails (verification, password reset, security notices) | Contract — Art. 6(1)(b) |
| Keeping the service secure; preventing abuse and fraud, including rate limiting by IP address | Legitimate interests — Art. 6(1)(f) |
| Showing you who holds the Buy Box, where a competing seller's identifier is personal data | Legitimate interests — Art. 6(1)(f) |
| Keeping business and tax records | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, our interest is running a secure service and protecting our customers' connected Amazon accounts. We have considered whether this overrides your rights and concluded it does not, because the data involved is limited to security-relevant records and is kept briefly.
We do not currently send marketing email. We may in future send occasional announcements to our existing customers about new NASST features. If we do, we will offer you the choice to opt out when you sign up and in every message, in line with the soft opt-in rules under the Privacy and Electronic Communications Regulations. Notices we are contractually required to send, such as 30 days' notice of a price change under §2.9 of the Terms, are not marketing and will be sent regardless.
We do not sell personal data, and we do not share it for anyone else's marketing.
We use a small number of service providers. The full list, what each receives and where it is located, is in the Sub-processor List (document 6). In summary:
| Who | What they receive | Where |
|---|---|---|
| Amazon | Your requests to your own Amazon account | EU endpoint |
| Brevo | Your email address and the content of service emails | France (EEA) |
| Microsoft 365, supplied by GoDaddy | The contents of any message you send to info@nasst.co.uk | UK or EU mailbox; GoDaddy is a US company |
| Hetzner Online GmbH | Hosts the service, so technically holds everything | Finland (EEA) |
| Stripe | Your email and billing details. Card details are entered on their pages and never reach us | Ireland, with onward processing in the US |
| Keepa | A product identifier, a category, deal filters, and competing sellers' merchant IDs. Nothing that identifies you | Germany (EEA) |
| UPCitemdb | A product name or barcode. No personal data | United States |
| Open Beauty Facts / Open Food Facts | A product name or brand, only when the "Barcode fallback" switch is on. No personal data | France (EEA) |
| SerpApi | Only if you choose to connect your own SerpApi account. A product name or search term, sent on your key and billed to you. Nothing about you — see document 6 §6.4 | United States |
We may also disclose personal data if we are legally required to, or to establish or defend legal claims.
Some of the providers above are outside the United Kingdom. Where personal data is transferred outside the UK, this is our position, provider by provider.
Inside the EEA, so no additional safeguard is needed. Most of our providers are covered by the UK's adequacy decision for the EEA: our hosting (Hetzner, Finland), our email sending (Brevo, France), the Amazon Selling Partner API endpoint we use, Keepa (Germany), and Open Beauty Facts / Open Food Facts (France).
The mailbox that receives info@nasst.co.uk is provided on Microsoft 365 through GoDaddy. Microsoft stores the content within its UK or EU region under its data residency terms, both of which are adequate for UK transfers. GoDaddy, which resells the service and is a United States company, provides the International Data Transfer Agreement within its data processing terms.
Stripe. You contract with Stripe Payments Europe Limited in Ireland, which is within the EEA, so the transfer you make is covered by adequacy and is not a restricted transfer. Stripe's own onward transfer to its United States company is governed by its data processing agreement, which applies whichever safeguard is required: the EEA Standard Contractual Clauses, the UK International Data Transfer Addendum, or the Data Privacy Framework.
The two United States services receive no personal data. UPCitemdb is sent a product name or barcode and nothing else. SerpApi is only ever called on your own account and with your own key.
Nothing is fetched from anywhere else when you load a page. The typefaces, libraries and styling are served from our own servers, so no content delivery network sees your IP address — see document 6 §6.2.
You may ask us for details of the safeguards in place for any specific transfer.
The controls below are what the system actually does, not aspirations. Full detail is in our Security Statement (document 9).
Passwords. Never stored. We keep a scrypt hash with a random per-account salt and deliberately expensive parameters, so that even if the account file were stolen the passwords could not practically be recovered.
Your Amazon token, your two-factor secret, and your SerpApi key if you add one. Encrypted at rest with AES-256-GCM, using a key held outside the data file. GCM is authenticated encryption, so a value that has been tampered with fails to decrypt rather than being used. None of them is ever sent to your browser.
Sessions. Held on our server rather than as a self-contained token in your browser, specifically so that a session can be destroyed the instant an account is suspected of being compromised. Sessions expire after 7 days, or after 12 hours of inactivity. The session cookie is HttpOnly (unreadable to JavaScript), SameSite=Lax (not sent from other sites) and Secure over HTTPS.
Two-factor authentication. Available on every account, using an authenticator app. We do not use SMS codes, which can be defeated by SIM-swap attacks.
Separation between customers. The system is built to refuse rather than guess: a request that cannot be tied to a specific signed-in customer fails instead of falling back to a default account.
Secrets in logs. Credentials are pattern-matched and redacted before any log line is written.
Files. Credential files are written with owner-only permissions.
No system is perfectly secure, and we do not claim otherwise.
Full detail is in the Data Retention and Deletion Schedule (document 7). In summary:
| Data | Kept for |
|---|---|
| Your account | While your account is open |
| Sign-in sessions | 7 days maximum |
| Password reset links | 1 hour |
| Email verification links | 24 hours |
| Buy Box history | A rolling 7 days |
| Error logs | 365 days |
| Your Amazon token | Until you disconnect or close your account |
Under the UK GDPR you have the right to:
Erasure you can do yourself. Closing your account deletes what we hold about you, immediately — Account → Close your account. There is no request to make and no waiting period. Document 7 §7.6 lists exactly what goes.
One thing survives it, and we would rather say so here than leave you to find out. We keep a one-way hash of the Amazon seller account that has used a free trial, with the date. Not your email address, not your name, not your store, not your token — just enough to recognise that a particular Amazon account has already had its fourteen free days, so that closing an account and signing up again with a new email address does not hand out another one. Our lawful basis is legitimate interest in preventing repeated fraudulent use of a free trial (Article 6(1)(f)), and it is kept indefinitely. Document 7 §7.6 explains it in full.
To exercise any of the others, email info@nasst.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
Closing your account. You can disconnect your Amazon account at any time from within NASST, which removes the stored token immediately.
To close the account entirely, go to Account → Close your account. It is immediate and it is yours to do — there is no request to send and no waiting period. Document 7 §7.6 lists exactly what is deleted, in the order it goes. If a live paid subscription is running, cancel it in Billing first; we cannot cancel it for you. If you cannot sign in, email info@nasst.co.uk and we will do it for you once we have confirmed the request came from you.
Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
NASST shows you estimates — profit calculations, fee estimates, sales-rank indicators and eligibility checks. These inform your decisions; they do not make decisions about you. There is no automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22.
Those estimates can be wrong. See §2.6 of the Terms.
Some of NASST runs on a schedule rather than only when you open it. Stated here because an application that queries your seller account unattended is not what most people assume they are agreeing to.
Buy Box sampling. Once you connect your Amazon account, NASST checks who currently holds the Buy Box on your in-stock products roughly every ten minutes, on our server, whether or not you are signed in. It uses your own Amazon connection, so the requests count against your account's API allowance. This is what makes the Buy Box history on your dashboard possible: the figure is built from samples taken across the week, and it cannot be reconstructed after the fact.
It starts when you connect Amazon and stops immediately when you disconnect, or when you close your account. The samples are kept for 7 days (document 7).
Deal feeds. If you save a deal search, we run it about once an hour so the results are waiting for you. Those searches go to Keepa on our account, not yours, and touch nothing in your Amazon account.
Neither process reads anything it would not read if you were sitting at the screen, and neither shares your data with another customer.
If we change this policy we will update the date at the top and, for any change that materially affects your rights, tell you by email at least 14 days before it takes effect.