Pricelyzer
Sign inSign up

LEGAL

Privacy Policy

Last updated: July 20, 2026

1. Who we are

Pricelyzer is operated by Lookfar Analytics Inc., a British Columbia corporation headquartered in Port Coquitlam, BC, Canada, the data controller for the purposes of this Privacy Policy. Contact: privacy@pricelyzer.com.

2. What this policy covers

This Privacy Policy applies to the Pricelyzer marketing site and cockpit (pricelyzer.com) and the Pricelyzer Browser Extension distributed via the Chrome Web Store. It explains what data we collect, why we collect it, how we protect it, where it is processed, how long we keep it, and the rights you can exercise over it.

3. Data we collect and why

  • Account data. Email address, password (hashed by Supabase Auth using industry-standard algorithms; Pricelyzer never sees your plaintext password), display name, subscription tier, and — if you subscribe — your Stripe customer identifier. Purpose: authenticate your session, deliver the service, process payments. PIPEDA principles: identifying purposes, limiting collection, accuracy. GDPR Art. 6(1)(b): contract performance. CCPA category: identifiers, commercial information.
  • Amazon Selling Partner API data (Pro only). Read-only data accessed on your behalf via the Amazon Selling Partner API after you grant OAuth authorisation. Scope is limited to fee estimation, pricing and current-offer data, listing-restrictions checks, and catalog data required to operate the tools you enable. Purpose: deliver the Pro features you signed up for. GDPR Art. 6(1)(b): contract performance. PIPEDA: consent + identified purposes. CCPA category: commercial information.
  • Browser-extension page-read data.On supported store product pages only, the extension reads the page URL, product title, and identifiers (such as an ASIN, UPC, or the page's product handle) when parseable from the page. This data is transmitted to Pricelyzer servers to perform a catalog lookup and is not retained beyond the API request. Purpose: deliver the lookup feature. GDPR Art. 6(1)(b): contract performance. CCPA category: internet activity, limited to the active page.
  • AI assistant conversations. Messages you send to the Pricelyzer AI assistant, together with the product context needed to answer them. Assistant messages are processed to answer your request and are sent to our AI model provider for that purpose; see our Sub-processors page. Purpose: deliver the assistant features you use. GDPR Art. 6(1)(b): contract performance. CCPA category: internet activity.
  • Usage and telemetry data. Pages viewed, tools run, query counts, latency measurements, error traces, and session timestamps. Purpose: service reliability, capacity planning, abuse detection, feature development. GDPR Art. 6(1)(f): legitimate interest. PIPEDA: legitimate business purpose. CCPA category: internet activity. Not sold.
  • Session replay and product analytics.Only if you grant the “analytics” cookie category, we record anonymized reconstructions of on-page interactions (clicks, scrolls, navigation) together with aggregate product-usage events. Recordings are masked so they never capture typed text, form values, prices, or personal data, and are suppressed entirely on authentication, billing, account, administrator, and Amazon-seller pages. Purpose: diagnose errors, measure performance, and improve usability. Processed by our sub-processor PostHog (see the Sub-processors page). GDPR Art. 6(1)(a): consent. CCPA category: internet activity. Not sold. You can withdraw consent at any time via the cookie banner on our marketing pages.
  • Billing data. Billing email, name, billing address (if provided), Stripe customer identifier, invoice history. Card details are collected and stored by Stripe (PCI-DSS Level 1) and never touch Pricelyzer infrastructure in raw form. Purpose: process payments, comply with tax and accounting law. GDPR Art. 6(1)(b) and 6(1)(c): contract performance and legal obligation.
  • Support correspondence. Email content and metadata when you contact us. Purpose: provide support. GDPR Art. 6(1)(b) or 6(1)(f).

4. Amazon Selling Partner API — dedicated disclosure

Pricelyzer accesses your Amazon Seller Central account via the Amazon Selling Partner API (SP-API) solely to provide the features you authorise. Pricelyzer is not affiliated with, endorsed by, or sponsored by Amazon.com, Inc.

  • Read-only authorisation. You grant Pricelyzer read-only OAuth access to the SP-API scopes required by the tools you enable. Pricelyzer never writes to your listings, repricing, orders, or customer data, and will not expand scopes without your explicit in-session action.
  • Data use restriction.SP-API data is used exclusively to deliver the Pricelyzer service to your account. It is not aggregated across accounts, sold, transferred to third parties, or used for advertising targeting. SP-API data is never merged into Pricelyzer's public price-comparison catalog, which is built from non-Amazon retailer sources.
  • Storage and encryption. SP-API access and refresh tokens are stored in a dedicated column in our managed Postgres database (Supabase), encrypted at rest with AES-256. All SP-API traffic is encrypted in transit with TLS 1.2 or higher. Tokens are never written to application logs.
  • Data use limits.We access your account within Amazon's per-account limits and do not share access across customers.
  • Revoking access.You can revoke Pricelyzer's SP-API access at any time from Seller Central → Apps & Services → Manage Your Apps → Pricelyzer → Disconnect. Revocation takes effect within 24 hours.
  • Deletion on cancellation. When you cancel your subscription, SP-API tokens are invalidated immediately and any SP-API data derived from your account is deleted within 30 days of the end of your grace period.

5. Browser extension — dedicated disclosure

The Pricelyzer Browser Extension is published on the Chrome Web Store and complies with Google's Limited Use Policy and User Data Policy. The extension is supported on Google Chrome.

  • Where it activates. Retail and product pages across the web (all https sites), so it can compare prices on any of the 50,000+ stores it supports. It reads a page only when a product is detectable on it.
  • What it reads.Only when a product is detectable on the page: the page URL, product title, and identifiers (such as an ASIN, UPC, or the page's product handle) when parseable. It does not read form fields, cart contents, addresses, payment details, or login state, and it reads nothing to transmit on pages where no product is found.
  • What it sends. Extracted identifiers are sent to Pricelyzer API servers over TLS to perform a catalog lookup. No raw page HTML is transmitted.
  • Retention. The identifying request payload is not retained beyond the response. Aggregate per-domain usage counts are retained for capacity planning.
  • No general browsing collection. Although the extension can run on any site to detect products, it only collects or transmits data when a product is found on the page. It does not record your browsing history, does not build a profile of the sites you visit, and transmits nothing from pages without a detectable product.
  • No third-party sharing. Extension-derived browsing data is never sold, transferred to ad networks, or used for behavioural advertising.
  • Free to use. Cross-store price comparison is available without an account. Saving products to a watchlist and receiving price-drop alerts requires a free Pricelyzer account.

6. Cookies

We use a small set of first-party cookies for authentication, your consent choice, and minor UI preferences. We do not load third-party client-side analytics scripts. Full detail is in our Cookie Policy.

7. Sub-processors

We engage sub-processors for cloud compute, managed database and authentication, edge / DNS / WAF, application hosting, payments, transactional email, and error monitoring, plus the Amazon Selling Partner API for Pro features. The current list, including regions and transfer mechanisms, is on our Sub-processors page. We notify customers at least 14 days before any new sub-processor is added.

8. Lawful bases for processing

Under GDPR Art. 6, we rely on:

  • Contract performance (Art. 6(1)(b)). Account data, SP-API data, browser-extension page-read data, billing data.
  • Legitimate interest (Art. 6(1)(f)). Usage telemetry, error monitoring, abuse detection. We have conducted balancing tests confirming these interests do not override user rights given the data minimisation applied.
  • Legal obligation (Art. 6(1)(c)). Billing records retained to comply with applicable tax and accounting law.
  • Consent (Art. 6(1)(a)). Non-essential cookies and any future marketing communications. You may withdraw consent at any time.

Under PIPEDA, we rely on meaningful consent and the identified-purposes principle. We collect only what is required to deliver the tools you use and the legal obligations we are subject to.

9. International data transfers

Personal data may be transferred to Canada and the United States for processing by our sub-processors. EU→Canada transfers rely on the European Commission's adequacy decision for Canada's commercial sector under PIPEDA. EU→US transfers rely on the EU Standard Contractual Clauses (Commission Decision 2021/914). A copy of the applicable SCCs is available on request at privacy@pricelyzer.com.

10. Data retention

  • Active account data. Retained for the life of your account.
  • SP-API tokens and any SP-API data we hold. Tokens invalidated immediately on cancellation; data deleted within 30 days of the end of your grace period.
  • Usage telemetry. Aggregated after 90 days; raw event logs deleted after 180 days.
  • Billing records. Retained for 7 years to comply with Canadian and applicable US tax and accounting law.
  • Browser-extension lookup data. Not retained beyond the API request.

11. Your rights — CCPA / CPRA (California)

California residents have the following rights under the California Consumer Privacy Act, as amended by the CPRA:

  • Right to know the categories and specific pieces of personal data we have collected about you.
  • Right to delete your personal data, subject to legal retention requirements.
  • Right to correct inaccurate personal data.
  • Right to opt out of sale or sharing. Pricelyzer does not sell personal data and does not share personal data with third parties for cross-context behavioural advertising. To exercise this right, email privacy@pricelyzer.com with subject "Do Not Sell or Share" or "CCPA Request."
  • Right to limit use of sensitive personal data. We do not use sensitive personal data for purposes beyond operating the service.
  • Non-discrimination. We will not deny service, charge different prices, or provide lower-quality service because you exercised a CCPA or CPRA right.

Email privacy@pricelyzer.com from the address associated with your account. We will verify your identity before processing requests and respond within 15 business days. You may designate an authorised agent by providing written authorisation.

12. Your rights — GDPR / UK GDPR

If you are located in the EEA, UK, or Switzerland, you have the following rights:

  • Access (Art. 15) — a copy of the personal data we hold about you.
  • Erasure (Art. 17) — deletion where no legal basis for retention exists.
  • Rectification (Art. 16) — correction of inaccurate or incomplete data.
  • Portability (Art. 20) — a structured, machine-readable export.
  • Restriction (Art. 18) — pause processing while a dispute is resolved.
  • Objection (Art. 21) — object to processing based on legitimate interest.
  • Withdrawal of consent (Art. 7(3)) — withdraw consent at any time without affecting prior processing.
  • Supervisory authority complaint — lodge a complaint with your local data protection authority (e.g. the UK ICO at ico.org.uk).

Email privacy@pricelyzer.com. We respond within 30 days; complex requests may be extended by a further two months with notice.

13. Your rights — PIPEDA (Canada)

Canadian residents have the right to access the personal data we hold about you, request correction of inaccurate data, and withdraw previously given consent. Email privacy@pricelyzer.com. We respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada.

14. Children's privacy

The service is not directed to minors and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, email privacy@pricelyzer.com and we will delete it promptly.

15. Security

We apply technical and organisational security measures appropriate to the risk, including TLS in transit, AES-256 encryption at rest via our managed database provider, access-controlled credential storage, rate limiting, and active error monitoring. See our Security page for the full posture. No transmission over the internet is guaranteed to be 100% secure.

16. Government data requests

We disclose personal data to government or law-enforcement authorities only where legally required (for example, in response to a valid subpoena, warrant, or court order under Canadian or applicable law). We do not voluntarily provide mass disclosures. Where we are legally permitted to do so, we will notify the affected user before disclosure so that they may seek a protective order or other relief.

17. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email and an in-app banner at least 14 days before taking effect. Continued use after the effective date constitutes acceptance of the updated policy.

18. Contact

Privacy and data-protection inquiries: privacy@pricelyzer.com. A mailing address is available on request from the same email.

Pricelyzer is not affiliated with, endorsed by, or sponsored by Amazon.com, Inc. Amazon, Amazon Seller Central, Fulfillment by Amazon (FBA), and related marks are trademarks of Amazon.com, Inc. All fee estimates displayed in Pricelyzer are approximations and may not reflect current Amazon fee schedules.