Data & Privacy
Privacy Policy
Last updated: 2026-08-24 · Version 2026-08-D
Who we are
Ringo Analytics is a deal profitability tool for brands selling through Amazon Vendor Central. The service is operated by Montalvo Enterprises Ltd, a company registered in England and Wales (company number 17397350), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, trading as Ringo Analytics.
For the purposes of the UK GDPR and the EU GDPR, we are the data controller for the personal data described in this notice.
You can reach us about anything in this notice at admin@ringoanalytics.com. We do not have a statutory Data Protection Officer (we are not required to appoint one), but that address reaches a person who can act on your request.
We are registered with the UK Information Commissioner's Office, registration number ZC222304.
The short version
What we hold depends entirely on how you use the tool. There are three states, and they are genuinely different:
| How you're using it | What happens to your deal numbers |
|---|---|
| Not signed in: the open calculator | Nothing is stored. The calculation runs in your browser. Your prices, costs and volumes are never sent to us at all. Close the tab and they are gone. |
| Signed in: you have an account and chose to save something | Only what you explicitly save (an ASIN, or a whole deal) is stored, in an encrypted database in Frankfurt, visible only to you. Everything else still runs in your browser and is never sent to us. You can view, export and delete any of it at any time, and delete the whole account in one action. |
| Every visit | If, and only if, you agree to analytics cookies, we record which pages you visited and which steps you completed, so we can see where the product is confusing. You can decline, and declining costs you nothing. |
We do not sell personal data. We do not share it with advertisers. We do not run advertising pixels of any kind.
A note on whose data this is
Most of what you type into Ringo Analytics (invoice prices, cost structures, discount terms) is commercial information about a company, not about a person. Data protection law protects people, not companies, so strictly speaking much of it falls outside this notice altogether.
We do not think that is a good enough answer. Deal economics are among the most sensitive numbers a commercial team holds, and the fact that the law is indifferent to them is not a reason for us to be. So anything you save while signed in is linked to your account, which makes it personal data in law as well as in practice, and everything in this notice applies to it.
Everything you save is also covered by a confidentiality obligation in our Terms & Conditions, which is what actually protects your company's numbers. That contract, not this notice, is the load-bearing protection for your margins.
What we collect, why, and on what legal basis
| What | Why we have it | Legal basis |
|---|---|---|
| Your email address, if you create an account | It is how you sign in. We use a magic link, so there is no password, which also means we hold no password for anyone to steal. | Performance of a contract (UK/EU GDPR Art. 6(1)(b)): the Terms & Conditions you accept when you create the account |
| Product economics you choose to save: ASIN, market, category, invoice price, list cost, baseline units, your cost structure percentages | So you do not retype twelve fields every time you evaluate a deal. This is the feature you signed up for. Nothing is saved unless you press Save. | Performance of a contract (Art. 6(1)(b)) |
| Whole deals you choose to save: the deal name, market and category, plus each ASIN in it with its discount, expected uplift and duration | None of this is stored unless you click Save deal. While you are just calculating, it stays in your browser and is never sent to us, exactly as before. If you do save, we keep the deal so you can pick a negotiation back up next week instead of losing it when you close the tab, and each save keeps a separate snapshot, so a deal worked over several rounds keeps every round. You can export or delete any of it at any time. | Performance of a contract (Art. 6(1)(b)) |
| Analytics: pages viewed, which calculator steps you completed or abandoned, approximate country, browser and device type | To find out where the product is confusing. If most people abandon at the same field, that field is badly designed and we want to know. | Your consent (Art. 6(1)(a)), given through the cookie banner. Nothing is collected until you agree, and you can withdraw at any time. |
| Security and error logs: IP address, timestamp, request path, error traces | To keep the service up and to investigate abuse. These are generated automatically by our hosting. | Our legitimate interests (Art. 6(1)(f)) in keeping the service secure and working. We have weighed this against your interests and consider it proportionate; you can object using the contact address above. |
| A record that you accepted our terms: your email, the date, and which version | So that if there is ever a dispute about what was agreed, both of us can see what you actually signed up to. | Performance of a contract (Art. 6(1)(b)) to collect it, and our legitimate interests (Art. 6(1)(f)) in being able to establish or defend a legal claim, to keep it. See "Your rights" below. This is the one thing that outlives account deletion. |
| A record of your cookie choice: what you chose, when, and which version of the banner you saw | The law requires us to be able to show that consent was properly given, so we have to keep a record of you giving it, or refusing. | Legal obligation (Art. 6(1)(c)) and Art. 7(1), which requires us to be able to demonstrate consent |
We never ask for, and have no use for, special category data: health, race, religion, politics, biometrics, sexual orientation, trade union membership. Please do not put any into a deal name.
Where your data is held, and who else touches it
Everything is hosted in the European Union. Your account sits in Frankfurt. We use a small number of service providers, each of which processes data only on our written instructions under a data processing agreement.
| Provider | What they do for us | Where |
|---|---|---|
| Vercel | Hosts the website and its server functions | Frankfurt (fra1) |
| Supabase | Database, sign-in, and delivery of sign-in emails | Frankfurt (eu-central-1) |
| PostHog | Product analytics: only with your consent | Frankfurt (PostHog Cloud EU) |
| Stripe | Subscription payments and invoices: we never see your card details | Ireland (Stripe Payments Europe) |
Transfers outside the UK and EEA.Where a provider processes data outside the UK or EEA, we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for details of any specific transfer.
If the business is ever sold. If Ringo Analytics is acquired, merges, or transfers its business, your data may pass to the buyer so the service can carry on running. Any buyer would be bound by this notice, or by one no less protective. We would tell account holders before it happened, not after.
Nobody else. Beyond the providers above and that one scenario, we do not share your personal data with anyone, except where the law compels us to, in which case we will tell you unless we are legally prevented from doing so.
How long we keep things
| What | How long |
|---|---|
| Your account | Until you delete it. Delete your account and it goes immediately, and disappears from encrypted backups within 30 days. |
| Saved data after a trial ends or a subscription is cancelled | Locked but kept for 30 days, so you can pick up where you left off. Then permanently deleted. We email you when it starts and again before it expires, and you can export throughout. |
| Inactive accounts | We review inactive accounts periodically and email you before deleting anything. |
| Record that you accepted our terms: your email, the date, and which version | 6 years, and this one is kept even if you delete your account. See below. |
| Analytics | 12 months, then deleted |
| Security and error logs | 30 days |
| Record of your cookie choice | 12 months, then we ask again |
Pooled data: how we will use it to improve the tool
We intend to learn from the data our customers save, for a single purpose: making the tool more accurate for everyone who uses it. In practice that will mean replacing our estimated default cost rates and uplift benchmarks with figures observed across many deals, and flagging when an input looks unusual for its market and category.
Before anything is used this way it will be stripped and coarsened so it can no longer be connected to you, your account or your company: identifiers removed rather than hashed, product codes deleted, and figures converted into bands and ratios rather than exact values. Nothing will ever be surfaced from which a single business could be identified. We will hold a minimum cohort size before any figure is used at all.
That purpose is the whole of it. Your data makes the engine more accurate; it will not be used for anything else. That limit is written into our Terms & Conditions, so it binds us contractually rather than being a promise on a web page.
One consequence worth stating plainly rather than burying: because the pooled figures are genuinely anonymous, they are no longer personal data and this notice no longer applies to them, which is why they would survive the deletion of your account. We could not unpick them, because by design nothing connects them to you.
Automated decision-making
The calculator produces a verdict on a deal using fixed, published arithmetic. It is a decision-support tool: it evaluates a commercial proposition, never a person. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on any individual within the meaning of Article 22.
Your rights
Under the UK and EU GDPR you can ask us to:
- Give you a copy of the personal data we hold about you, in a portable format (Art. 15 and 20)
- Correct anything inaccurate (Art. 16)
- Delete it (Art. 17): for your account and saved economics you do not need to ask us at all; there is a button on your account page. You can also delete individual saved entries without deleting the account.
- Restrict or object to how we use it (Art. 18 and 21)
- Withdraw consent for analytics at any time, without affecting anything done before you withdrew (Art. 7(3)): the Cookie preferences link in the footer does this on any page
One thing we keep after you delete your account, and why. When you signed up you ticked a box accepting our terms. We keep a record of that (your email address, the date, and which version you agreed to) for 6 years, which is how long a contract claim can be brought in England. It survives deletion of everything else.
We keep it because if a dispute ever arose about what was agreed, that record is the only evidence either of us would have. The law expressly allows retaining personal data where it is needed to establish or defend legal claims (Art. 17(3)(e)). We keep the minimum that does the job and nothing more: no deal data, no usage history. We would rather tell you about this openly than have you find it in a database.
Email admin@ringoanalytics.com and we will respond within one month. It is free. We may ask you to confirm your identity, only so that we do not hand your data to someone else.
If we get it wrong, you can complain to the UK Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113) or to the data protection authority in your own country. We would rather you came to us first, but you do not have to.
Security
All traffic is encrypted in transit; the database is encrypted at rest. Access to your data is enforced at the database level by row-level security, so one account cannot read another's rows even if the application has a bug. There are no passwords to steal, because sign-in uses a one-time link. Our production database keys are never exposed to the browser.
No system is perfect. If a breach ever puts your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
Children
Ringo Analytics is a business tool and is not intended for anyone under 18. We do not knowingly collect data about children.
Changes to this notice
When we change how we handle data we update this page and change the date at the top. If a change is significant (a new category of data, a new purpose) we will email account holders at least 30 days before it takes effect, rather than relying on you to re-read the page.