Aggro

Privacy Policy

Last updated 23 September 2026

Aggro is an internal e-commerce operations and reporting application operated by Rize Brands. It brings sales, inventory, advertising and accounting data from the platforms a business connects into one place for that business's own team. This policy explains what data the application reads, how it is used and stored, and the choices you have.

Information we collect

  • Account information. The email address and password you sign in with. Passwords are stored hashed by our authentication provider and are never visible to us. The hashes of your last ten passwords are kept so that a new password cannot repeat one of them.
  • Security log. Sign-ins, failed sign-in attempts, account lockouts, password changes and reset requests, and accepted team invitations, each with the time, the email address involved, and the IP address and browser it came from. It is used only to protect accounts and investigate security incidents.
  • Team invitations. When a brand owner invites a teammate, the address they enter, who sent the invitation, and when it was accepted or revoked. It is kept with the brand's records until the brand is deleted, and is used only to send that invitation.
  • Data from platforms you connect. Only when an authorized person connects a platform, and only read-only:
    • Amazon Selling Partner API — your listings, prices, FBA inventory, order line items (SKU, quantity, price, date) and settlement reports (fees and refunds).
    • Shopify — your products and variants, inventory levels, locations, and order line items and refunds.
    • Meta (Facebook) Ads — your ad accounts, campaigns and ads, and their spend and performance metrics.
    • Google Ads — your ad accounts, campaigns and ads, and their spend and performance metrics.
    • QuickBooks Online — your chart of accounts, profit and loss reports and transactions.
  • Information you enter. Product costs, supplier details, inventory shipments, notes and similar planning data you type or import.
  • Technical data. Error reports needed to keep the application working, with credentials, cookies and request contents removed.

The application does not retrieve or store the personal information of your customers (such as buyer names, email or postal addresses). Order data is kept only as product-level quantities, prices, fees and refunds.

How we use it

Solely to provide the application to the business that connected the data: calculating revenue, margins, inventory cover, reorder points and advertising performance, categorizing accounting transactions, and answering questions its team asks about its own metrics. We do not sell data, use it for advertising, or share it with anyone for their own purposes.

Google user data

When you connect Google Ads, the application requests read-only access to the Google Ads accounts you choose, and uses it only to read campaign and ad performance and spend for display in your own reports. Aggro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train general-purpose AI models, is not transferred to others except as needed to provide the application or to comply with law, and is not read by people except with your consent, for security purposes, or as required by law.

Service providers

Data is stored and processed only by the application and these providers acting on our behalf:

  • Vercel Inc. (United States) — application hosting.
  • Supabase Inc. (United States) — database hosting and user sign-in.
  • Anthropic PBC (United States) — AI models used to categorize accounting transactions and to answer questions about your own aggregated business metrics.
  • Functional Software Inc. d/b/a Sentry (United States) — error monitoring, with credentials, cookies, request bodies and query parameters removed before sending.
  • Stripe Inc. (United States) — subscription billing, when enabled.
  • Resend Inc. (United States) — sending transactional email: team invitations and password reset links.
  • Feeble — builds and maintains the application under contract.

Storage and security

Data is held in an access-controlled PostgreSQL database. Every business's data is isolated at the database level, so a signed-in user can read only the data of businesses they own. Platform access tokens are stored server-side and are never sent to the browser. All traffic is encrypted in transit with TLS.

Retention and deletion

Data is kept while the business uses the application. Daily inventory snapshots older than 90 days are reduced to one per week. Sales, inventory and listing data retrieved from Amazon is deleted once it is more than 18 months old. The security log is kept for 13 months and then deleted. Disconnecting a platform stops all further reads from it, and you can revoke access at any time from that platform's own settings. Deleting a business in Settings deletes its data. To delete your account, contact us and we will remove it and all data it owns, except the security log, which is kept for its 13 months.

Changes

We will update the date at the top of this page when this policy changes.