How Cobalt12 treats your Amazon account and your data

You connect through Amazon

You connect a Seller Central account with Login with Amazon, on Amazon’s own consent page, so Cobalt12 never sees your Amazon password. Amazon then gives Cobalt12 a token for that account.

What the connection is used for

Cobalt12 reads your listings and catalog data, and the sales, traffic and search reports Amazon makes available to your account, to audit and draft your listings. It does not use Amazon’s Orders API and never asks for buyer names, addresses or orders.

Nothing changes on Amazon until you press Publish

Drafts, accepted AI suggestions and generated images stay in Cobalt12. Publishing is the only way Cobalt12 writes to your Amazon listings, and only a listing’s owner can publish it.

Every publish goes to Amazon first as a validation preview (VALIDATION_PREVIEW), which Amazon checks without changing the listing. Cobalt12 sends the change itself only if Amazon reports it valid.

Price, quantity and the rest of your offer are taken out of every publish, so publishing never changes them. If Cobalt12 cannot work out which fields belong to the offer for your product type, it does not publish.

What Cobalt12 stores, and how

The token Amazon issues for your account, the refresh token, is encrypted with AES-256-GCM before Cobalt12 stores it, and so is every short-lived access token it stores for reuse. Neither is ever sent to your browser.

Cobalt12’s database and file storage run on Cloudflare, which encrypts them at rest.

Your content does not train AI models

Your photos, your listings and what Cobalt12 makes from them are not used to train models, ours or anyone else’s. They go to Cobalt12’s AI provider, OpenAI, through its API, only to make the listings, images and reports you ask for.

Deleting your data

Write to [email protected] and we delete your photos, listings and generated content within 30 days. Deletion works by request for now: there is no delete button in the app yet.

Taking access back

In Cobalt12, open Account settings and press Disconnect beside the seller account. That deletes, for that account: the stored tokens; the listings Cobalt12 synced from it, with everything attached to them in Cobalt12, such as drafts, generation runs and A+ drafts; and the sales and search reports it downloaded. Products you started in Cobalt12 from a photo stay, and image files already generated stay in storage until you ask us to delete them.

To withdraw Cobalt12’s authorisation on Amazon’s side as well, remove it from the apps authorised on your account in Seller Central (Manage Your Apps).