Manchu ApS provides Amazon marketplace consulting services to brands and sellers on Amazon.

    Privacy Policy

    Last updated: 2 October 2026 · CVR DK42942588

    This Privacy Policy describes how Manchu ApS ("Manchu", "we", "us") collects, uses, and protects information when you visit manchuconsulting.com or engage us as a client. We are based in Denmark and our data practices are governed by the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

    1. Who we are

    Manchu ApS

    CVR: DK42942588

    Strandboulevarden 162, 4. tv., 2100 København Ø, Denmark

    Email: contact@manchuconsulting.com

    2. Information we collect

    Website visitors

    • Basic server logs (IP address, timestamp, user agent, pages visited) for security and performance monitoring.
    • Website usage data — the site sets no cookies and runs no analytics or tracking. See Section 9.

    Prospective clients / contact form

    • Name, email address, company name, and message content submitted via contact forms or direct email.

    Active clients

    • Business contact details (name, role, email, phone).
    • Information necessary to deliver our consulting services, including the access you grant us through Amazon's own authorization tools (service provider authorization in Seller Central, Amazon Ads account access and app authorization). We never ask for your Amazon account passwords.

    Client advertising data (as processor)

    As an Amazon Ads partner, we process advertising data on behalf of our clients. This includes:

    • Campaign performance metrics (spend, impressions, clicks, sales, ACoS, ROAS).
    • Keyword and search term data.
    • Product listing and catalog information.

    For this category, we act as a data processor — the client is the data controller. We only process this data to deliver services the client has engaged us for.

    3. Purposes and legal bases

    Delivering consulting services under a client contractContract (Art. 6(1)(b))
    Responding to contact inquiriesLegitimate interest (Art. 6(1)(f))
    Complying with tax, accounting, and legal obligationsLegal obligation (Art. 6(1)(c))
    Website security and operational analyticsLegitimate interest (Art. 6(1)(f))
    Non-essential cookies or analytics, if ever introducedConsent (Art. 6(1)(a))
    Processing advertiser client data via Amazon Ads APIProcessor under Art. 28 — acting on documented instructions of the client

    4. How we handle Amazon Ads data

    Manchu ApS is an Amazon Ads partner, registered on the Amazon Ads Partner Network. Our Amazon Ads app is called Manchuconsulting. For this data:

    • How access is granted: each client approves the app itself, from its own Amazon login, on Amazon's Login with Amazon consent page (permission advertising::campaign_management). We never ask for Amazon passwords. The client can withdraw the approval at any time under Your Account → Login with Amazon (amazon.com/ap/adam), and we ask for a fresh approval at least every 365 days.
    • What we access: the client's advertising accounts and profiles, campaign structure, bids, budgets, targeting, performance reports and search terms. With the client's agreement, also Amazon Marketing Stream (hourly performance data) and Amazon Marketing Cloud (aggregated analyses and audiences). We do not request buyer personal information.
    • Why: only to run and improve the client's own advertising, as agreed with the client.
    • AI and automated decisions: AI agents (Claude, by Anthropic) analyse the client's data and make bid and campaign changes within limits agreed with the client. Before a change is made, automatic guards and a dry run check it; every change is logged with its purpose and expected effect, and is reviewed against the result once the data has settled (attributed sales settle after about 14 days). We tell the client how accurate these decisions have proved and how fresh the data behind them is.
    • Per client, never shared: one client's data is used only for that client and is never disclosed, individually or aggregated, to other clients or outside parties. Learning across clients is limited to general methods that contain no client data. We do not sell data, and we do not use services that scrape Amazon or sell Amazon data.
    • Where it is stored: the long-lived access token stays in AWS Secrets Manager in the EU (Ireland), encrypted with a dedicated AWS KMS key; our agents only receive access tokens that expire within 60 minutes. Reporting data is stored in Google BigQuery in the EU. All traffic is encrypted in transit (TLS 1.2 or higher).
    • Retention and deletion: kept only while the client's approval and engagement are active. Deleted no later than 90 days after the approval is withdrawn or the engagement ends, and within 72 hours if Amazon requests it.
    • Incidents: reported to Amazon at 3p-security@amazon.com within 24 hours of detection, and to the affected client.
    • We comply with the Amazon Ads API License Agreement, the Amazon Ads Data Protection Policy and the Acceptable Use Policy.

    5. Amazon Selling Partner API data (Manchu Listing Manager)

    Clients can authorize our internal tool, Manchu Listing Manager, to maintain their product listings through the Amazon Selling Partner API. For this data:

    • What we access: listing and catalog data for the authorizing seller's own products (Product Listing role only). We do not request or store buyer personal information.
    • Why: only to perform the listing work the seller has engaged us for. The data is never sold, never shared with third parties and never combined across sellers.
    • AI: data from the tool is not processed by AI tools and is not used to train any model.
    • Where and how it is stored: Amazon Web Services in the EU (Stockholm). Encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access credentials are kept in AWS Secrets Manager, encrypted with AWS Key Management Service.
    • Who can access it: authorized Manchu staff only, on a need-to-know basis, with multi-factor authentication. Access rights are reviewed every quarter.
    • Retention and deletion: kept only while the seller's authorization is active. Deleted within 30 days after the seller revokes access or the engagement ends, including backups.
    • Logging: access and changes are logged; logs are kept for 90 days and contain no buyer personal information.
    • Incidents: reported to Amazon at security@amazon.com within 24 hours, and to the affected seller.
    • Revoking access: the seller can revoke the authorization at any time in Seller Central (Apps and Services → Manage Your Apps).

    6. Sub-processors and data sharing

    We use the following categories of sub-processors to deliver our services:

    • Infrastructure / hosting — Vercel Inc. (site hosting and edge delivery).
    • Contact form processing — Formspree (contact form submissions).
    • Email and productivity — Microsoft 365.
    • Accounting — Dinero.
    • Cloud storage for client deliverables — Microsoft OneDrive.
    • Code hosting — GitHub (private repositories for code).
    • Secrets management — Doppler (encrypted storage of access credentials).
    • Hosting of Manchu Listing Manager — Amazon Web Services EMEA SARL (EU region, Stockholm).
    • Amazon Ads login page and token service — Amazon Web Services EMEA SARL (EU region, Ireland).
    • AI processing — Anthropic (Claude), which runs the AI agents that analyse client advertising data and carry out agreed changes; the agents' network traffic passes through Anthropic's infrastructure.
    • Client reporting — Weld (data pipelines that the client authorizes), Google Cloud (BigQuery) and Metabase (dashboards).
    • Amazon — as a data source and, for advertising operations, a data recipient as permitted under the client's own Amazon terms.

    We do not sell personal data. We do not share your information with third parties for marketing purposes.

    7. International transfers

    Some of our sub-processors (notably Amazon, Microsoft, GitHub, Vercel and Anthropic) process data outside the European Economic Area, primarily in the United States. Where this occurs, we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs) as safeguards.

    8. Data retention

    • Website logs: 30 days.
    • Contact form submissions: 24 months (in case you re-engage).
    • Active client records and deliverables: for the duration of the engagement plus up to 5 years afterwards to satisfy Danish accounting obligations (Bogføringsloven).
    • Client ads data processed via the Amazon Ads API: only while the client's approval and engagement are active; deleted no later than 90 days after the approval is withdrawn or the engagement ends, and within 72 hours if Amazon requests it.
    • Amazon Selling Partner API data processed by Manchu Listing Manager: only while the seller's authorization is active; deleted within 30 days after the seller revokes access or the engagement ends, including backups.

    9. Cookies and local storage

    • No cookies. The site sets no cookies of any kind and runs no analytics, tracking or advertising code.
    • Your language choice — when you switch between English and Danish, the site stores your choice in your browser's local storage (key manchu-lang), so the pages open in that language on later visits. It never leaves your browser, and you can clear it in your browser settings.
    • Fonts are served from our own host, so loading a page does not contact third-party font services.

    If we ever add analytics or other non-essential cookies, we will ask for your consent first and update this policy before they are used.

    10. Your rights under GDPR

    You have the right to:

    • Access the personal data we hold about you.
    • Rectify inaccurate data.
    • Request deletion ("right to be forgotten") subject to legal retention obligations.
    • Restrict or object to processing.
    • Receive your data in a portable format.
    • Withdraw consent at any time (where consent is the legal basis).
    • Lodge a complaint with the Danish Data Protection Authority (Datatilsynet).

    To exercise any of these rights, email contact@manchuconsulting.com. We aim to respond within 30 days.

    11. Security

    We apply commercially reasonable technical and organisational measures to protect information, including:

    • HTTPS/TLS encryption for all data in transit.
    • Access controls restricting who can view client data on a need-to-know basis.
    • Multi-factor authentication on all accounts that can access client data.
    • Strong password and credential storage practices (no credentials in public repositories, no hard-coded secrets).
    • An incident response process covering detection, containment, and notification of security incidents.

    12. Changes to this policy

    We may update this policy. The "Last updated" date above reflects the latest version. Material changes will be communicated to active clients directly.

    13. Contact

    Manchu ApS

    Magnus Mailand

    Email: contact@manchuconsulting.com