Legal

Privacy Policy.

Last updated: 29 May 2026

This Privacy Policy explains how Mt. Lyra Commerce ("Mt. Lyra Commerce," "we," "us," or "our") collects, uses, stores, and protects information when you use our application that connects your Amazon Selling Partner account to Claude (the "Service"). By using the Service, you agree to the practices described here.

1. Who we are

Mt. Lyra Commerce provides software that lets Amazon sellers query and act on their own Amazon business data through Claude, using Amazon's official Selling Partner API (SP-API) and Amazon Ads API. We are an independent product and are not affiliated with, endorsed by, or sponsored by Amazon.com, Inc.

For any privacy question, contact us at hello@mtlyracommerce.com.

2. Information we collect

Account & contact information

When you request access or contact us, we collect the information you provide — such as your name, email address, brand or company name, and the contents of your message.

Amazon authorization credentials

When you connect your Amazon account through the standard Login-with-Amazon (OAuth) flow, Amazon issues us an authorization token that lets us call the Selling Partner API and Amazon Ads API on your behalf. We store this token in encrypted form. We never receive or store your Amazon password.

Amazon business data

To answer your questions and carry out actions you approve, the Service accesses business data from your Amazon account, which may include: orders and settlement data, fees, inventory and fulfillment data, catalog and listing data, pricing and Buy Box data, and advertising data. This data is retrieved to fulfill your request and returned to your Claude session; it is not stockpiled in a database of ours.

Information we do not collect

We do not request or retrieve personally identifiable information about your customers — including buyer names, email addresses, phone numbers, or shipping and billing addresses — and we do not access payment instruments or financial account details. We handle data in accordance with Amazon's Data Protection Policy and Acceptable Use Policy.

3. How we use information

  • To provide the Service — answering your questions and performing actions you explicitly approve.
  • To authenticate to Amazon on your behalf using your authorization token.
  • To respond to your inquiries and support requests.
  • To maintain the security, integrity, and reliability of the Service.

We do not sell your data, and we do not use your Amazon data to train AI models — ours or anyone else's.

4. How information is shared

We share information only as needed to operate the Service:

  • Amazon — we send requests to Amazon's Selling Partner API and Ads API using your authorization token to retrieve data and carry out approved actions.
  • Anthropic (Claude) — your questions and the relevant business data needed to answer them are processed by Claude. Anthropic's API does not use inputs or outputs to train its models.
  • Service providers — we use trusted infrastructure providers (for hosting and email delivery) bound by confidentiality obligations.
  • Legal — we may disclose information where required by law or to protect our rights and the safety of users.

We do not sell, rent, or trade your information to third parties for their marketing purposes.

5. Data security

We protect your information using industry-standard measures:

  • Amazon authorization tokens are encrypted at rest using AES-256-GCM.
  • All data in transit is encrypted using TLS 1.2 or higher.
  • Access to credentials and systems is restricted on a least-privilege basis.
  • The Service requests only the minimum SP-API and Ads API scopes required.

See our Security & Data Handling overview for more detail.

6. Data retention

We retain your authorization credential and operational records only as long as necessary to provide the Service. When you disconnect Amazon or request deletion, your authorization credential is deleted promptly and the OAuth grant is severed at Amazon's side. Contact records may be retained for a reasonable period for support and legal purposes.

7. Your rights and choices

  • Disconnect at any time. You can revoke our access from your account page or from within your Amazon account; this immediately stops all access and writes.
  • Access and deletion. You may request a copy of the personal information we hold about you, or ask us to delete it, by emailing hello@mtlyracommerce.com.
  • Corrections. You may ask us to correct inaccurate contact information.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. We honor applicable requests.

8. Children's privacy

The Service is intended for business use by Amazon sellers and is not directed to children. We do not knowingly collect personal information from anyone under 18.

9. International transfers

Your information may be processed in countries other than where you live. Where we transfer data internationally, we take steps to ensure it remains protected in accordance with this policy and applicable law.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact us

Questions about this policy or your data? Email us at hello@mtlyracommerce.com and we'll respond personally.