Privacy Policy

This file describes the personal data the service handles. It is updated in the same pull request as any change that stores, sends or receives personal data. The published version is at https://bulletwright.com/privacy.

Who is responsible

Northgate Enterprises LLC, a Virginia limited liability company, is the controller of the personal data described here. For support, privacy questions and data requests, write to legal@northgate-enterprises.com. We reply within 5 business days.

What the service collects

The service stores five categories of data: order details, submitted product facts, generated copy, your email address and Stripe identifiers. The list below also describes server logs, which are not counted in those five.

• Submitted product facts: the product details you submit in the order form, called the intake facts below (for example product name, brand, category, materials, dimensions, features, target buyer, keywords, optional competitor ASINs, tone and marketplace). Please do not enter personal data about other people in these fields.
• Email address: the address you give in the order form, used to send the order link and to reply to you about your order.
• Order details: the order status, the price and currency, the dates of each step, the private token in your delivery link, the clarification and revision requests you submit, and the refund reason and the note you write with it if you request a refund. If we refuse an order because its billing country is not one we sell to, we also keep that billing country (as its two-letter code, or the word "missing" if Stripe sent none) in the refund reason of that order, with a mark that it was not fulfilled.
• Generated copy: the listing copy written for your order, including earlier versions after a clarification or a revision.
• Stripe identifiers: the ids of the Stripe checkout session and of the payment for your order, and the id of the refund if one is issued.
• Server logs: the service writes log lines about what happened to an order or intake, identified by its id. They do not contain your email address, the facts you submit, your delivery link or the text of a refund note. The service reads your IP address only to limit how often one address can send requests. It does not store the address. It keeps a count of requests per window of 60 seconds in its database, under a one-way hash of the address and the window, and removes each count about 60 seconds after its window ends (the database may take longer to delete it, up to a few days). A hash of an IP address can be reversed by someone who tries every address, so we treat it as personal data. The count is shared by all copies of the service, so the limit holds per address and not per copy. If the count cannot be read or written, the request is refused rather than let through. The API access log in front of the service records the request id, time, route, status, response size and latency of each request, and any integration error message. It holds no IP address. Logs are written to AWS CloudWatch Logs and expire after 30 days. The service uses no advertising or analytics trackers.

What the service does not collect

Your full card number and CVC are entered on Stripe's pages and handled only by Stripe. They never reach this service's servers. Stripe shows us the card brand, last four digits and billing country. The service does not read or store a name or billing address that Stripe collects, except that it reads the billing country in the payment event to check it against the countries we sell to, and keeps it only for an order it refuses on that ground, as listed under order details above. The service does not ask for, and never uses, an Amazon account login, API access or seller credentials.

Who else processes data

• Stripe processes payments and may send payment receipts. It is the seller of record for your order. When you pay, we send it the price, the product name and our order id and intake id, so we can match the payment to your order. We do not send it your email address or the facts you submit. Stripe collects your email address itself, on its own payment page, and may send a payment receipt to that address. Its handling of your data is described in its own privacy policy.
• Anthropic (the AI model provider) processes the product facts you submit so the copy can be generated. We send it the product name, brand, category, materials, dimensions, features, target buyer, keywords, tone and marketplace, with our fixed writing instructions. When you use your clarification or your revision, we also send it the text you wrote and, for a revision, the listing copy you already have. We do not send it your email address, your payment data, your order id or the competitor ASINs. Its handling of the facts is described in its own privacy policy. The model provider is a setting of the service: it is either Anthropic or Amazon Bedrock (below), never both for one order, and the service refuses to take real payments with any other.
• Amazon Web Services (AWS), through Amazon Bedrock, can be the model provider. Bedrock runs a Claude model on the same product facts, writing instructions and (for a clarification or a revision) text, and the same exclusions, as described for Anthropic above. It is used in the United States: the service calls it in a United States AWS region, through an inference profile that keeps the request in AWS regions in the United States, and the service refuses to start with any other kind. The service reaches it with its own AWS account role and holds no AWS access key. Its handling of the data is described in AWS's own privacy documentation.
• Resend (the email provider) sends you the private link to your listing copy. We send it your email address and the message, which contains that link. Its handling of the data is described in its own privacy policy. The email provider is a setting of the service: it is either Resend or Amazon SES (next), never both for one order, and the service refuses to take real payments without one.
• Amazon Web Services (AWS), through Amazon Simple Email Service (Amazon SES), can be the email provider. SES sends you the private link to your listing copy. We send it your email address and the message, which contains that link. It is used in the United States: the service sends from a United States AWS region and refuses to start with any other, with its own AWS account role and no AWS access key. The service sends you no other email: it sends no refund notice, and any payment receipt or refund email comes from Stripe. It also sends an alert to ops@northgate-enterprises.com when an order is held or an error needs a person; the alert holds an order id and a short error code, never your email address, your facts or your link. Replies to your requests are sent from legal@northgate-enterprises.com, not through SES. Its handling of the data is described in AWS's own privacy documentation.
• Amazon Web Services (AWS) (the hosting provider) hosts the Bulletwright web application, its queue and its database (Amazon DynamoDB) in the us-east-2 (Ohio) region in the United States. It stores the order details and email address you give us on our behalf, under its data processing agreement. The database has point-in-time backups covering the last 7 days.

The service does not sell personal data.

AI-written copy

The listing copy you receive is written by an AI model from the facts you provide, and is labelled as such.

Retention, access and deletion

You can ask for a copy of your data, a correction, or deletion by emailing legal@northgate-enterprises.com with your order id. We reply within 5 business days and carry out a deletion within 30 days of your request.

Deletion removes your intake facts and your email address from the service, and the listing copy written for your order with them, including earlier versions and the text of your clarification and revision requests. It also removes the private token in your delivery link, so the link no longer opens your copy, and the record of emailing it to you. Payment records are retained after deletion. We keep the minimum record of the payment, filed under your order id: the amount and currency, the order status, the refund reason if there is one, the dates, and the Stripe checkout session id, payment id and refund id if one was issued. We keep it because the law and Stripe's rules require payment records to be kept, and because we need it to handle a refund or a dispute. It holds no intake facts and no email address. Stripe keeps its own records under its own privacy policy.

The note you write with a refund request is free text, so a deletion erases it too. The reason you chose from the list, the request's status and its dates stay in the payment record, because a refund or a dispute may need them.

We carry out a deletion on the order id you send us, through an owner-only step on the service. If your order is being written at that moment, we run the deletion a second time once it has finished, so that copy is erased too. After a deletion, the database's point-in-time backups still hold the earlier versions of the records for up to 7 days, and then drop them. Server logs expire after 30 days. Apart from those logs and backups, nothing is deleted automatically. Your intake facts, your email address, the listing copy, your clarification and revision requests and your refund note stay until you ask for deletion, and the payment record stays after it. The service sets no end date for either; the payment record is kept until we set a retention period, and we will update this page when we do.

Changes

Changes to this policy are made in this file and published at the URL above.