How we handle
your Amazon data.
Mt. Lyra Commerce connects to Amazon through the official Selling Partner API and Amazon Ads API. Below is a plain-English account of what data we access, how we protect it, how long we keep it, and the controls that keep you in command. We hold ourselves to Amazon's Data Protection Policy and Acceptable Use Policy.
Plain English, no hedging.
An assistant with access to your account is only worth using if you can trust where the data goes and who can touch it. Here is how we've answered that.
Claude is instructed to confirm before any action that changes your account. It shows you the exact SKU, value, and scope, then waits for your explicit OK. Nothing is written to Amazon silently.
Your Amazon authorization token is encrypted at rest using AES-256-GCM. It is used only to call Amazon on your behalf and is never exposed to the AI model, shared, or sold.
All traffic between Mt. Lyra Commerce, Amazon, and Claude is encrypted in transit using TLS 1.2 or higher. Data is never transmitted in the clear.
We request only the Selling Partner API roles and Ads API scopes the assistant actually needs to do its job. We do not request access we cannot justify.
We do not pull buyer names, shipping addresses, or other personally identifiable customer information. The assistant works from business data — listings, inventory, pricing, advertising, settlements.
Your Amazon data is never used to train AI models — ours or anyone else's. It is processed to answer your question and is not retained for training or analytics.
We don't build a database of your business. Each question queries Amazon fresh through the Selling Partner API; the answer is returned to your Claude session rather than stockpiled by us.
Disconnect Amazon from your account page and the OAuth grant is severed immediately at Amazon's side. Every write stops and your stored credential is cleared.
We retain credentials and operational records only as long as needed to provide the service. On disconnection or request, your authorization credential is deleted promptly.
The data we touch — and the data we don't.
What we access
- Orders, settlements, and fee data — to report on sales and profitability.
- Inventory and fulfillment data — to forecast stock and flag reorder points.
- Catalog and listing data — to audit listing health and propose fixes.
- Pricing and Buy Box data — to monitor competitiveness.
- Advertising data via the Amazon Ads API — to surface spend anomalies and propose campaign actions.
What we never access
- Buyer names, email addresses, or phone numbers.
- Shipping or billing addresses.
- Payment instruments or financial account details.
- Any personally identifiable information beyond what is strictly required, in line with Amazon's Data Protection Policy.
"The right way to build an assistant with account access isn't to ask for trust — it's to make every action visible, every credential encrypted, and every connection something you can sever in one click." — Mt. Lyra Commerce
Have a security question we didn't answer?
If your team has a specific question about data handling, retention, or scope, we're glad to answer it directly.
Get in touch