PRIVACY POLICY
Version updated on November 1, 2026
Introduction
This Privacy Policy describes how HOLDEN INTERNATIONAL LLC (hereinafter the “Controller” or “Provider”), as Data Controller, collects, uses, stores and protects the personal data of Users who access and use the Royaltify platform (hereinafter the “Platform”) available at royaltify.com, including the Browser Extension and the related Services.
This Privacy Policy is provided in accordance with Regulation (EU) 2016/679 (GDPR), and with all applicable laws and regulations, including the U.S. COPPA.
Art. 1 – Data Controller
HOLDEN INTERNATIONAL LLC 8 The Green, Suite R, Dover, DE 19901, United States E-mail: [email protected]
For any communication relating to privacy: [email protected]
Contact page: https://royaltify.com/contact
Art. 2 – Types of Data Processed
2.1 Data provided directly by the User at registration: First and last name (or company name, if a legal person); Email address; Payment data (managed through a PCI-DSS certified third-party provider; the Provider does not store credit card numbers or complete banking details); Personal and tax details, where required for issuing invoices.
2.2 Browsing and technical data
Automatically collected through the Platform’s IT systems: IP address (anonymized at the end of the session); Date and time of access; Browser type and version; Operating system; Referring URL; Data in server log files (stored in anonymized form).
2.3 Data relating to the User’s Amazon KDP account (Sales Data)
Through the Browser Extension, with the User’s express and active consent at the time of synchronization: Sales data: date and time, marketplace, ASIN, book title, author name, paid units sold, units distributed free of charge; Royalties earned; Pages read (KENP – Kindle Edition Normalized Pages); Catalog data (published titles, covers, series); New reviews and related metrics.
To retrieve this data, the Browser Extension, with the User’s consent, sends the session cookies of the User’s Amazon KDP account to our servers, and our servers use them to connect to that account on the User’s behalf. While valid, these cookies give access to the User’s Amazon KDP account, including areas that may contain tax and banking information. We use them only to retrieve the User’s Sales Data, and we do not use them to access other data or to make changes to the account. The User can stop new synchronizations at any time by disconnecting the integration or uninstalling the Extension, and can ask us to remove this data at any time by writing to [email protected].
This data belongs to the User and is collected exclusively to provide the analytics Services requested by the User.
Royaltify is not affiliated with, endorsed by or sponsored by Amazon.com, Inc.
2.4 Data relating to the User’s Amazon Ads campaigns
Through the official Amazon Advertising APIs, with the User’s explicit OAuth authorization: Advertising campaign configurations (budgets, bids, targeting, keywords); Advertising performance metrics (impressions, clicks, spend, ACOS, ROAS); Ad and ad group data.
Art. 3 – Data We Do NOT Collect
The Provider never collects, stores or processes: the password of the User’s Amazon KDP account or of any other third-party service; username and password for Amazon or other external services; complete banking information (e.g. bank account number, sort code, full credit card number): such data is managed exclusively by the certified payment provider; the User’s personal address (except where required for invoicing); the User’s telephone number (unless voluntarily provided for support and contractual purposes); biometric data, health data, geolocation data.
Art. 4 – Purposes and Legal Bases of Processing
Purpose — Legal basis (Art. 6 GDPR)
• Provision of the Sales and Catalog Analytics Service — Performance of the contract (Art. 6(1)(b))
• Provision of the Advertising Management Service through the Amazon Ads API — Performance of the contract (Art. 6(1)(b))
• Access to Sales Data through the Browser Extension — User’s express consent
(Art. 6(1)(a))
• Access to the Amazon Ads account through the OAuth API — User’s express consent
(Art. 6(1)(a))
• Management of the contractual relationship (invoicing, support) — Performance of the contract / legal obligation (Art. 6(1)(b) and (c))
• Compliance with legal obligations — Legal obligation (Art. 6(1)(c))
• Improvement of the Services and anonymized aggregate analysis — Legitimate interest of the Controller (Art. 6(1)(f))
• Marketing and promotional communications — User’s express consent (Art. 6(1)(a))
• Fraud prevention and Platform security — Legitimate interest of the Controller (Art. 6(1)(f))
The Controller does not carry out profiling on the data processed within the meaning of Article 22 GDPR.
We do not use the User’s Sales Data or Advertising Data to train general-purpose AI models.
Art. 5 – Methods of Processing
Personal data is processed with electronic and IT tools, with the adoption of appropriate technical and organizational security measures (including 256-bit AES encryption for stored data, communications exclusively via HTTPS, and access control for authorized personnel). Information systems are configured according to the principle of data minimization (Article 5(1)(c) GDPR), processing only the data strictly necessary to achieve the stated purposes.
Art. 6 – Security Measures
The Provider adopts the following security measures:
• Encryption of data in transit (HTTPS/TLS) and at rest (AES-256);
• Secure authentication for access to the Platform;
• Access to data restricted to authorized personnel trained in data protection;
• Continuous monitoring to detect unauthorized access;
• Personal data breach management procedures pursuant to Article 33 GDPR;
• Platform support will never ask the User for the User’s password.
In the event of a personal data breach that may pose risks to the rights and freedoms of data subjects, the Controller will make the mandatory notifications to the competent Supervisory Authority and, where necessary, to the data subjects, within the time limits provided by the GDPR.
Art. 7 – Recipients of the Data
The User’s personal data may be disclosed exclusively to the following parties, for the purposes indicated:
Data processors (Article 28 GDPR):
• Cloud infrastructure and hosting providers (e.g. the servers on which the Platform is hosted);
• Payment service providers (e.g. Stripe, Whop), which process payment data as independent controllers or processors;
• Providers of transactional email and customer support services;
• Any legal, tax and accounting advisors of the Controller;
All data processors are bound by specific agreements under Article 28 GDPR and process data exclusively according to the Controller’s instructions.
Independent data controllers:
• Amazon.com, Inc. / Amazon Advertising, limited to the data transmitted through its official APIs within the scope of the authorizations granted by the User; the processing of such data by Amazon is governed by Amazon’s Privacy Policy;
• Judicial and administrative authorities, upon request in accordance with applicable law.
The Controller does not sell, transfer or share Users’ personal data with third parties for its own or others’ marketing purposes, except with express consent.
The use of information received through the Browser Extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. This data is used only to provide the Services, and is not sold or used for advertising purposes.
Art. 8 – Transfer of Data Abroad
8.1 Transfer to the United States
The User’s personal data may be transferred to the United States (a country outside the EU/EEA), as certain cloud infrastructure providers are based in that country. Transfers to the United States are currently covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), provided that the recipient is certified under that framework. If this legal basis is not available for a specific recipient, the transfer will take place on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, together with any supplementary measures where necessary.
8.2 Transfer to other third countries
If data is transferred to other third countries without an adequacy decision, the Controller will adopt the appropriate safeguards provided by Article 46 GDPR (Standard Contractual Clauses or another equivalent instrument) and will give notice by updating this Policy.
8.3 Transfer within the EU/EEA
Personal data may be transferred to other countries in the European Union or the European Economic Area, without the need for further safeguards, to enable the Controller’s authorized personnel to carry out their work.
Art. 9 – Nature of Consent and How It Is Given
Consent to access Sales Data through the Browser Extension
Consent to the collection of Sales Data through the Browser Extension is:
• Specific: it concerns exclusively the collection of the data of the User’s Amazon KDP account for the analytics purposes described;
• Informed: it is given after reading this Policy and the T&C;
• Free: refusing consent still allows access to the Platform features that do not depend on KDP synchronization;
• Revocable: the User may withdraw consent at any time by uninstalling the Extension or disconnecting the integration from the User’s reserved area, without affecting the lawfulness of processing based on consent given before its withdrawal;
Consent to access the Amazon Ads account through the API
The OAuth authorization to access the Amazon Ads account constitutes the legal basis for the related processing; the User may revoke this authorization at any time from the application management panel of the User’s Amazon account or from the User’s reserved area on the Platform.
Art. 10 – Data Retention Period
Data category — Retention period
• Account data and contractual data — For the entire duration of the contract and for 10 years after its termination, for accounting/tax obligations
• Sales Data and analytics — For the entire duration of the contract; deleted within 30 days of account deletion
• Advertising Data — For the entire duration of the contract; deleted within 30 days of account deletion
• Email (for fraud prevention and single-account purposes) — Kept even after account deletion, for the time strictly necessary for the stated purposes and in any case no longer than 3 years
• Marketing data (with consent) — Until consent is withdrawn
Art. 11 – Rights of the Data Subject
As a data subject, the User may exercise the following rights at any time, pursuant to Articles 15-22 GDPR:
• Right of access (Art. 15): to obtain confirmation that personal data is being processed and to receive a copy of it;
• Right to rectification (Art. 16): to obtain the correction of inaccurate data or the completion of incomplete data;
• Right to erasure / right to be forgotten (Art. 17): to obtain the erasure of data in the cases provided by law;
• Right to restriction of processing (Art. 18): in the specific cases provided by law;
• Right to data portability (Art. 20): to receive the data provided to the Controller in a structured, commonly used format;
• Right to object (Art. 21): to object to processing on legitimate grounds, in particular for direct marketing purposes;
• Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of processing based on consent given before its withdrawal;
• Right to lodge a complaint with the competent Supervisory Authority.
Requests to exercise the above rights must be sent by email to: [email protected]
The Controller will respond within 30 days of receipt of the request (a period that may be extended by a further 60 days in complex cases).
Art. 12 – Cookies and Tracking Technologies
The Platform uses technical cookies necessary for the operation of the service and, subject to consent, analytics and profiling cookies.
Art. 13 – Minors
The Platform and the Services are not intended for children. They are intended only for adults aged 18 and older. We do not knowingly collect, use or disclose personal information from children under 13, as required by the Children’s Online Privacy Protection Act (COPPA) where applicable, and we do not knowingly sell or share the personal information of anyone under 16. If we discover that we have inadvertently collected information from anyone under the age of 18, we will delete it promptly. If you are a parent or guardian and believe your child has given us personal information, please contact us at [email protected].
Art. 14 – Rights for Certain U.S. Residents
California disclosures (CCPA/CPRA): In the past 12 months we have collected these categories of personal information: identifiers (name, email, IP address); customer records and commercial information (purchase history, Sales Data and Advertising Data); internet or other network activity. We collect them from Users, User’s devices, and our service providers. We use them for the purposes in Art. 4. We disclosed identifiers, commercial information and internet activity to service providers for business purposes. We do not knowingly sell or share the personal information of consumers under 16.
Shine the Light: California Civil Code § 1798.83 lets California residents request information about the personal information we disclosed to third parties for their direct marketing purposes in the prior calendar year. We do not disclose personal information to third parties for their direct marketing purposes. To make a request, email [email protected] or write to Holden International LLC, 8 The Green, Suite R, Dover, DE 19901, United States. We respond to one request per customer per year.
Nevada: Nevada residents may submit a request to opt out of the “sale” of covered information. We do not sell covered information as defined under Nevada law, but you may contact [email protected] with questions.
Art. 15 – Changes to this Policy
The Controller reserves the right to amend this Policy at any time by publishing the updated version on the Platform. Material changes will be notified to registered Users by email with reasonable notice. Continued use of the Platform after the changes are published constitutes acceptance of the updated Policy.