1. Who is responsible
GBNOX LLC, 5005 W Laurel St, Tampa, FL 33607, United States, is the controller of the personal data described here.
Two different relationships apply, and the distinction matters for your rights:
- We are the controller of your account, billing and support data — the data about you as our customer.
- We are a processor for the data you load into your workspaces about your own business and your own clients. You decide what goes in and why; we act on your instructions. The Data Processing Agreement governs that part.
2. What we collect
Data you give us
- Account — first and last name, email address, password (stored only as a bcrypt hash, never in readable form), company or workspace name, role.
- Billing — billing name, billing address, country, contact phone number, plan and billing period. We never see or store your full card number — card details go directly to Stripe.
- Marketplace credentials — the tokens that let us call Amazon Selling Partner and Walmart Marketplace APIs for you, encrypted at rest with AES-256-GCM.
- Workspace content — listings, product copy, categories, identifiers, keywords, cost and fee figures, client and brand names you create.
- Messages — anything you write in the contact form or in support correspondence.
Data we generate
- AI-readiness scores and their breakdowns, and AI-drafted rewrites you requested.
- Buy box, rank, inventory and financial snapshots, alerts, and the reports you generate.
- Activity logs — who did what and when inside a workspace, kept so an account owner can audit their own team.
- Technical records — IP address, timestamps and error details in server logs, used for security, rate limiting and debugging.
- Where a security alert came from — when we email you about a sign-in, a password change or a change of email address, we look the IP address up so the alert can name the city, country and internet provider rather than a number you have no way to judge. The lookup is done by ipwho.is, which receives the address and nothing else: no name, no account, no identifier, no cookie. Private and internal addresses are never sent, and results are cached so the same address is not looked up repeatedly.
Data we do not collect
No advertising identifiers, no cross-site tracking, no third-party analytics or advertising pixels, no special-category data. We do not buy personal data from data brokers. See the Cookie Policy.
3. Why we use it, and our legal basis
| Purpose | Data | Legal basis (UK/EU GDPR) |
|---|---|---|
| Create and run your account | Account, workspace content | Performance of a contract |
| Take payment and prevent fraud | Billing, technical records | Contract; legitimate interests |
| Call marketplace APIs you connected | Marketplace credentials | Performance of a contract |
| Generate scores and AI rewrites you asked for | Listing content | Performance of a contract |
| Service emails — receipts, credentials, alerts | Account, billing | Performance of a contract |
| Keep the service secure and available | Technical records, activity logs | Legitimate interests |
| Answer your messages | Messages, account | Legitimate interests |
| Meet tax and accounting obligations | Billing records | Legal obligation |
| Waitlist and product announcements | Email address | Consent — withdraw at any time |
We do not sell personal data, and we do not share it for cross-context behavioural advertising — as those terms are defined under the CCPA/CPRA and similar US state laws.
4. Who else processes it
We use a small number of sub-processors, each under a written agreement limiting them to our instructions. The current list — who they are, what each receives and where they operate — is on the sub-processors page, which we update before adding anyone new.
We also disclose data where the law requires it, to protect our rights or someone’s safety, and to a buyer if the business is sold — in which case you will be told before your data becomes subject to a different policy.
5. Where your data is stored
Application data is held in a managed PostgreSQL database in the United States (AWS, us-east-2), and the web and API servers are in the United States. Some sub-processors may process data elsewhere.
Where personal data moves from the UK or EEA to a country without an adequacy decision, the transfer relies on the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant), together with the technical measures in the Security page.
6. How long we keep it
| What | Kept for |
|---|---|
| Account and workspace content | While the account is open, then 30 days to allow export |
| Marketplace credentials | Deleted immediately on disconnection or account closure |
| Billing and tax records | 7 years, as tax law requires |
| Server and security logs | Up to 12 months |
| Password reset tokens | 1 hour, then unusable |
| Support messages | 24 months from the last reply |
| Waitlist entries | Until you unsubscribe |
7. Your rights
Depending on where you live, you can ask us to:
- tell you what we hold and give you a copy;
- correct anything inaccurate;
- delete your data, subject to records we must keep by law;
- restrict or object to a use based on legitimate interests;
- export your data in a portable format — most of it you can export from the dashboard yourself;
- withdraw consent where consent is the basis, without affecting past processing.
Ask through the contact form. We reply within 30 days and do not charge, and we will not treat you differently for asking. We may need to verify who you are first. In the UK or EEA you may also complain to your supervisory authority; in California you may appeal a refused request by writing to us again.
If the data is inside a customer’s workspace and you are not that customer, we will pass your request to them — they decide, because it is their data.
8. Children
GBNOX Radar is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children. Tell us if you believe we have, and we will delete it.
9. Security and breach notification
Our technical and organisational measures are described on the Security page. If a breach affects your personal data and is likely to result in a risk to you, we will notify you and the relevant regulator without undue delay, and in any event within the deadlines the law sets.
10. Changes to this policy
We will post any update here with a new effective date. For changes that materially affect your rights we will give at least 30 days’ notice by email or in the dashboard.
Questions about this document
Write to us through the contact form and say which document you are asking about. A person reads every message. Our postal address is 5005 W Laurel St, Tampa, FL 33607, United States.