Understand what Nas Agents accesses, how we use it, and who processes it, so you can connect your business with confidence.
Authorized connections
Tenant-isolated workspaces
Seller-specific Amazon reporting
Data privacy & trust · Last updated 13 October 2026
01 / Our approach
Connected to your business. Used for your business.
Nas Company operates Nas Agents, an AI-assisted marketing operations platform for businesses and their teams. We connect authorized data sources to support analysis, monitoring, reporting and decision-making.
This page explains our handling of connected customer data, including information received through partner applications. Integration-specific restrictions apply alongside your service agreement and applicable platform requirements.
Customer workspaces are tenant-isolated: one customer’s connected data and reports are not made available to another customer. Access is limited to the relevant customer’s authorized users and personnel and service providers who need it to deliver or support the service.
02 / Information we process
Access starts with authorization.
The information we process depends on the sources you connect, the permissions you grant and the features you use.
Connected business data:
relevant advertising, marketing, commerce and operational information from authorized integrations.
Workspace information:
account and team details, configuration, and integration authorization credentials needed to operate your workspace.
Content you provide:
questions, instructions, files and other material submitted for analysis or support.
Service records:
reports, AI outputs and technical records needed for operation, reliability, troubleshooting and security.
We use connected data to provide the requested features, respond to support requests, maintain security and meet applicable obligations. We request only the access needed for the relevant integration. A connection does not authorize unrestricted access to other accounts or systems.
03 / Access & security
Protection at each point of access.
Tenant and role restrictions:
access to customer information is restricted by workspace, job duties and business need.
Encryption at rest and in transit:
customer information is encrypted in databases, backups and stored access tokens, as well as when transmitted between the application and connected services.
Credential protection:
passwords, tokens and keys are stored securely, rather than placed in public repositories or hard-coded into applications.
Authentication and infrastructure:
controls include multi-factor authentication, password requirements, firewalls, intrusion detection or prevention, anti-malware and network segmentation.
Incident response:
our response plan defines responsibilities and escalation procedures and is reviewed every six months. We notify affected customers and relevant authorities as required by applicable law and agreements.
For questions about the safeguards applicable to your service, contact our team. This page does not represent an independent security certification.
04 / How we handle your data
Your data. Used to serve you.
We don’t train on your data.
Your business data is never used to train AI models, ours or anyone else’s. This is contractually enforced with every AI provider we work with.
We don’t sell your data.
Your business data is used solely to deliver the service to you. We do not sell it or share it with other customers. We share it with the service providers below only as needed to deliver and support your service.
It’s encrypted.
Your data is encrypted in transit and at rest, with access limited to the systems and personnel required to operate the service.
Our sub-processors
We use a small number of established infrastructure and AI providers to deliver the service. Each operates under a data processing agreement and is bound by applicable data protection law.
AWS
Application hosting and secure storage.
OpenAI
AI processing for requested analyses and reports.
LangSmith
Execution tracing, debugging and quality monitoring.
MongoDB Atlas
Operational database storage.
ClickHouse Cloud
Data storage and analytics for reporting.
These providers process or store service data in the United States. Processing and retention are governed by the applicable service settings and data processing terms.
Questions about our data practices? Email us at tech@nas.io.
05 / Amazon seller data
Planned integration · Read-only
Your Amazon data.
Your seller insights.
Where Amazon information comes from
Amazon information for this integration comes exclusively from Amazon’s SP-API, with the relevant seller’s authorization. We do not obtain Amazon information for this integration from non-Amazon sources, including seller-uploaded reports, third-party data connectors, scraping services, external Amazon-data vendors or purchased datasets.
Separately connected marketing platforms provide the seller’s separately authorized marketing information; they are not sources of Amazon information for this integration. AWS, OpenAI and the providers above process information for service delivery and are distinct from data-acquisition sources.
What we will analyze
Only the sales, orders, products, inventory, fees, returns and marketplace performance information needed for authorized seller reporting. We will request the minimum necessary permissions and will not request buyer contact information for this analytics use case.
What sellers will receive
Seller-specific dashboards and daily, weekly or monthly reports.
Revenue, units sold, average order value, refund rates, fee analysis and product performance.
Inventory availability, trends, anomalies and inventory-risk insights.
Answers and AI-assisted summaries about the seller’s own performance.
Where permitted by Amazon’s terms, a seller may combine its Amazon performance with its separately authorized marketing sources in its own workspace.
AI-assisted summaries include source and freshness context. They support decisions, may contain errors and should be reviewed before being relied upon.
Strict limits on use
We will not modify listings, prices, orders, inventory, shipments, buyer messages or customer records. The integration will not contact or solicit buyers or take actions in Amazon.
We will not sell Amazon information, pool data across sellers, or use it for cross-seller aggregation, benchmarking or competitor intelligence. Reports will be available only to the relevant seller and its authorized users, with limited service-provider and support access as described above.
Authorization, deletion and incidents
Sellers can revoke authorization through Amazon Seller Central. Revocation ends further authorized retrieval; it does not itself erase copies already stored. Stored data is handled under the deletion commitments below.
Our incident response procedures include notifying Amazon at security@amazon.com within 24 hours of detecting a security incident involving Amazon information.
Pricing and availability
The Amazon integration is included in a paid Nas Agents subscription, with no separate integration fee. Subscription pricing is quoted based on your selected plan and scope, with a fixed subscription fee agreed for that plan and scope. Contact tech@nas.io for a quote and billing terms before subscribing. Integration availability remains subject to Amazon approval.
06 / Retention & deletion
Keep what is needed. Remove what is not.
Connected-data retention depends on the service, its authorized purpose and applicable legal obligations. Contact our team for the retention periods applicable to your workspace, including operational data, logs and backups. Disconnecting a source and deleting previously stored information are separate actions.
Amazon data: deletion within 30 days
Our deletion process permanently and securely deletes Amazon information within 30 days of the earliest applicable trigger: Amazon requires deletion; the seller revokes authorization, terminates or removes access; Nas is no longer authorized to process it; or participation in the service ends. Longer retention is limited to applicable legal, tax or regulatory obligations.
Our deletion process covers stored source information, reports and derived copies, caches, and copies held by our service providers. Copies in backups and retained provider request or trace records are included in the deletion process. Non-personal Amazon data is retained only as strictly necessary for its authorized purpose. If buyer personal information is ever approved and processed, additional Amazon retention restrictions apply.
For deletion requests, contact tech@nas.io and identify the relevant workspace and integration. We will verify your authority and confirm the scope and applicable timeline, including any legally required retention.
07 / Healthcare & HIPAA
HIPAA-compliant.
Nas Agents is HIPAA-compliant. We support healthcare customers in protecting health information within the services and configurations covered by their agreement with Nas Company.
Using a cloud or AI provider that offers HIPAA-eligible services does not, by itself, establish compliance for Nas Agents or authorize PHI processing.
08 / Your choices
Questions and requests have a clear route.
Contact tech@nas.io to request information about processing, correction or deletion of your information, or assistance withdrawing integration access. We may need to verify your identity and authority over the relevant workspace.
If your information was supplied by a business using Nas Agents, contact that business first; we will support it with requests relating to data we process on its behalf. Applicable privacy rights and response requirements depend on your location and our role in processing the information.
We may update this page as our services and practices change. The date above identifies the latest revision.
Nas Agents / Nas Company
Data Privacy & Trust · Updated 13 October 2026