Version 4 · Last updated October 30, 2026 · effective November 1, 2026
PL Signature Holding LLC, doing business as P&L Consultings (“P&L Consultings,” “we,” “us,” or “our”), is a California limited liability company that provides business-to-business services. This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with our consulting services and our website at pnlconsultings.com (the “Site”).
Our consulting services are Amazon marketplace services for businesses that sell on Amazon, including listing audits and listing optimization for search and for Amazon’s AI shopping assistant, advertising and pay-per-click management, seller-account management, seller-account setup, and account-health support. For clients of our ongoing Partnership service, they also include access to our analytics workspace, which displays the client’s own Amazon business figures and reports (together, the “Consulting Services”).
This Privacy Policy applies to our business customers and the individuals they authorize, our vendors, and visitors to the Site. When we access or process personal data on behalf of a business customer, we act under that customer’s instructions and our agreement with that customer. The customer remains responsible for its own privacy practices. A separately branded product with its own privacy policy is governed by that policy.
We may collect the following categories of personal data about the business contacts, authorized users, vendors, and personnel we work with:
Amazon buyer data. A client may give us access to its Amazon Seller Central account as a secondary user. Order pages there can display buyer details to any user holding that permission. We do not download, export, or store buyer personal data, except where a client expressly instructs us to do so for a specific task concerning the client’s own orders. In that case we process it solely on the client’s behalf, only for that task, and delete it when the task is complete. Our analytics workspace does not receive or store buyer personal data.
Public Amazon data. For Quick-Scores and audits, we read publicly visible Amazon product pages and the answers of Amazon’s AI shopping assistants, using our own Amazon buyer accounts. In doing so, we do not collect or store personal data of Amazon buyers: we use customer reviews only in summarized form, without reviewer names.
The sensitive personal data we handle is limited to account login credentials used to secure access to the analytics workspace. Account passwords are stored in hashed form. We use this information solely to provide and secure the Consulting Services and not to infer characteristics about any individual. We do not process health, biometric, genetic, or precise-location data, or information about race, ethnicity, religion, sexual orientation, citizenship, criminal history, or union membership.
We collect personal data directly from you through business communications, the Quick-Score request form, bookings, purchases, and contracts; from business customers that designate authorized users; and automatically when you visit the Site or use the analytics workspace. Information we access through Amazon’s portals or interfaces may include personal and non-personal information and is subject to applicable Amazon requirements.
The Site is a static website. It has no user accounts and no newsletter sign-up. Its only form is the Quick-Score request form described below. It does not use cookies, analytics tools, advertising pixels, social-media plug-ins, or session-recording tools, and it does not load fonts, scripts, or other content from third parties.
When you visit the Site, our hosting provider automatically records web server access logs: your IP address, the date and time of the request, the page or file requested, the response status, and your browser user agent. We use these logs only to operate, secure, and troubleshoot the Site and delete them after 14 days.
Quick-Score request form. You can request a free Quick-Score of an Amazon listing through the form on the Site. The form asks for your name, company or brand, business email address, marketplace, ASIN or product URL, your role, and the report language; your telephone number is optional. We use this information only to prepare and send you the Quick-Score and to propose times for a call. Where the GDPR applies, the legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) or, where you make the request on behalf of a company, Article 6(1)(f) GDPR (our legitimate interest in answering business inquiries). The form does not ask for marketing consent, and we do not add you to any email sequence or use your request for marketing.
How the form is processed. The form sends your entries to our own form server, which our hosting provider operates for us in a data center in the United States. The form server does not store the entries; it forwards your request by email to our business mailbox with our office and email provider. To protect the form against spam, we do not use third-party services such as Google reCAPTCHA. Instead, we use a hidden field, a timing check, and a limit on the number of requests per IP address and per email address. For this limit, your IP address is processed only briefly. Like the Site, the form server keeps the access logs described above for 14 days; these logs do not contain your form entries.
The Site links to our scheduling provider for booking calls and to our payment provider’s hosted payment pages for purchases and subscriptions. When you follow such a link, you leave the Site. The scheduling provider processes the details you enter on our behalf, as described in Section 6. On its hosted payment pages, our payment provider also processes payment information for its own legal, security, and fraud-prevention purposes under its own privacy policy.
Call booking. When you book a call, our scheduling provider processes your name, email address, the appointment you choose, any optional details you enter, and any documents you upload, for example the Amazon notification for the free initial review of an account-health case. We use this information to arrange and prepare the call. Where the GDPR applies, the legal basis is Article 6(1)(b) GDPR.
Payments. We sell fixed-price services through our payment provider’s hosted checkout and payment links and bill recurring services as subscriptions through the same provider. The payment provider acts as our service provider for processing the payment and, for its own legal, security, and fraud-prevention purposes, as an independent controller. You enter your payment details directly with the payment provider; we do not receive full payment-card numbers. We receive the billing and VAT details you provide, the amount, and the order details. In the checkout, you accept our Service Terms, and that acceptance forms part of your order. Business clients in the EU can also pay ongoing services by bank transfer against an invoice; in that case the account holder and account details of the payment are processed by our money-transfer provider, which is named on our sub-processors page.
Do Not Track and Global Privacy Control. We do not track your activities over time or across third-party websites, and we do not permit third parties to do so through the Site. Our practices therefore do not change in response to Do Not Track or Global Privacy Control signals.
The Site does not set any cookies. Our analytics workspace uses only strictly necessary cookies: a session cookie that keeps a signed-in user’s session active until sign-out or until the browser is closed, and a short-lived cookie limited to the sign-in page that carries a user through the sign-in steps. Language and help-panel settings are stored in the user’s browser and are not sent to us. Because we use only strictly necessary technologies, we do not display a cookie consent banner. Should we introduce non-essential technologies in the future, we will update this Policy and, where consent is legally required, obtain it first.
We use personal data to provide and administer the Consulting Services and the analytics workspace; to prepare and send Quick-Scores, schedule calls, and respond to inquiries; to process payments and invoices; to provide support; to send service-related communications; to send marketing communications to business contacts where permitted; to operate and secure the Site and the analytics workspace and to prevent fraud; and to comply with our legal obligations.
We limit our collection, use, retention, and sharing of personal data to what is reasonably necessary and proportionate for these purposes, and we do not use personal data for new, incompatible purposes without providing further notice where required.
Deidentified and aggregate data. Where permitted by applicable law, our customer agreements, and applicable Amazon requirements, we may create and use deidentified or aggregate information to analyze and improve our own services. We do not combine one client’s Amazon information with another client’s information, and we do not use it to create statistics or benchmarks across clients. We maintain deidentified information in that form and do not attempt to reidentify it. Pseudonymised information remains personal data where an individual can still be identified.
We share personal data with service providers that support our operations, limited to what each provider needs to perform its function. Every service provider that receives personal data is bound by a written data processing agreement, and our contractors by a signed confidentiality and data protection agreement. We require our service providers to protect data to a standard at least equivalent to ours.
The categories of service providers we use, and the personal data each receives, are:
| Category | Personal data received or accessed |
|---|---|
| Hosting and infrastructure | Site server access logs; Quick-Score form entries in transit through our form server, which does not store them; analytics-workspace user accounts, activity logs, and the client business data hosted for the workspace. |
| Office, email, and files | Emails, contact details, Quick-Score requests and analyses, report content, working files, invoices, and accounting records. |
| AI text and analysis | Client business figures and work content; business contact details through the provider’s connection to our office and email account (see Section 8). |
| AI image generation | Product and listing information only; no personal data and no cost or margin figures. |
| Payment processing | Name, email address, billing address, VAT details, payment amount, order details, and payment-account information. |
| Call scheduling | Name, email address, the appointment, the details you enter, and documents you upload when booking a call. |
| Contractor engagement and payment | Contractor identity and payment information; no client data. |
| Market research tools | No personal data and no client data; no client account is connected to them. |
The current list of named service providers, with their locations, is published at pnlconsultings.com/subprocessors. We post changes there at least 30 days before they take effect.
Our authorized contractors may access client information only as needed to perform their assigned tasks, from devices or environments that meet our security requirements. We also disclose personal data where required by law, to establish, exercise, or defend legal rights, to Amazon and its authorized assessors where necessary for compliance reviews, security investigations, and audits, and in connection with a corporate transaction. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not provide it to another company for that company’s independent marketing.
Personal data may be processed in the United States, the European Economic Area, the United Kingdom, and the Philippines, and on our own encrypted company device in the United States. Section 14 describes international transfers.
Where we send marketing email to business contacts, each message identifies itself as such where required, includes a clear way to opt out, and includes a valid postal address. If you ask us to stop, we will honor that request. To opt out, use the link in the message or write to privacy@pnlconsultings.com. We do not send marketing text messages.
We use artificial intelligence (AI) as our own work tool in the Consulting Services. A text-and-analysis provider assists with analyzing business figures and drafting listing text and reports; image-generation providers assist with product images.
Our text-and-analysis provider receives client business figures, including revenue and margin, and work content. Because it is connected to our own office and email account, it may also process business contact details contained in email, calendar entries, files, and chat messages. Image-generation providers receive product and listing information only, without personal data or cost or margin figures. We send no Amazon buyer personal data to any AI provider. We use the providers’ business interfaces, and none of our data is used to train their models. We do not use client information to train AI models of our own.
We do not use AI to make decisions about individuals that produce legal or similarly significant effects. Because AI outputs may be inaccurate, we review and verify AI-assisted work before relying on it or delivering it.
The Site and the Consulting Services are directed to businesses, not to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have done so, we will delete it.
We maintain administrative, technical, and physical safeguards appropriate to the personal data we handle, including encryption in transit and at rest, multi-factor authentication, role-based and limited access, and security monitoring. In the analytics workspace, each client can access only its own account and data.
We maintain procedures to investigate and respond to actual or suspected security incidents. We notify the affected business customer within 24 hours of becoming aware of an incident affecting its data and, where Amazon’s requirements apply, notify Amazon within 24 hours, in addition to any notice required by law. We maintain a named incident contact and a named deputy.
Our processing of personal data on a business customer’s behalf is also governed by the data processing terms in that customer’s agreement with us.
We retain personal data for the periods below. A request to delete information does not require us to delete records we must or may lawfully retain.
| Information | Retention period |
|---|---|
| Client data for the Consulting Services, including analytics-workspace accounts and working files | During the engagement, then 30 days of continued access after it ends, then deletion, subject to the separate periods below. |
| Information governed by Amazon’s data protection requirements | Only while strictly necessary for an authorized purpose. Permanently and securely deleted within 30 days after the client revokes authorization or ends our access, or Amazon directs deletion, whichever is earliest. |
| Amazon compliance records | During the applicable Amazon agreement and for 12 months afterwards. |
| Analytics-workspace activity logs | Up to 24 months. |
| Security alert records | 90 days. |
| Server backups | 7 days, then overwritten by the next backup cycle. |
| Site server access logs | 14 days. |
| Tax and accounting records, including invoices and payment records | 7 years. |
| Quick-Score requests and analyses | Deleted no later than 30 days after receipt unless an engagement follows. Remaining copies in the recycle bin of our cloud storage are permanently removed no later than 93 days after that. If an engagement follows, the periods for client data above apply. |
| Quick-Score brand record (brand, marketplace, ASIN, and date; no personal data) | Kept permanently to enforce one Quick-Score per brand. |
| Call bookings and inquiries not kept as client records, including documents uploaded with a booking | No longer than needed to arrange the call, answer the inquiry, and complete related follow-up. |
| Marketing contacts and opt-out records | While needed for permitted marketing; limited suppression data to honor an opt-out. |
After the applicable period, we delete the information unless continued retention is required by law. Deidentification does not replace required secure deletion. Payment providers may retain information they control under their own policies.
You can request access to your personal data, correction of inaccurate data, deletion, and a portable copy. Additional rights depend on your location, our role, and the applicable law, as described in Sections 13 and 14.
How to exercise your rights. Email privacy@pnlconsultings.com, describe your request, and give enough information for us to identify the information involved. We respond within the period required by law. Where verification is required, we take reasonable steps to verify your identity and authority and do not request more information than necessary. Where permitted by law, an authorized agent may submit a request on your behalf; we may require evidence of the agent’s authority.
Information controlled by a business customer. Where we process personal data on a business customer’s behalf, that customer controls the information. Please direct requests about it to the customer; we will reasonably assist the customer as required by law and our agreement.
Amazon authorization. You may withdraw your authorization for our access to your Amazon account at any time. When access ends, we stop the processing that depends on it and delete the affected information as described in Section 11.
We will not discriminate against you for exercising a privacy right.
Where the California Consumer Privacy Act applies, you may request to know and access personal information, correct inaccuracies, delete information subject to exceptions, and receive a portable copy. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that would give rise to a right to limit; separate opt-out and limitation links are therefore not provided. Where another U.S. state privacy law applies, you may have similar rights, subject to that law’s coverage requirements and exceptions. Exercise your rights as described in Section 12.
Our role. The business customer is the controller of personal data it provides or authorizes us to process for the Consulting Services; we act as its processor under its instructions and the data processing terms in its agreement with us. We act as controller for personal data we use for our own account administration, billing, business communications, marketing, and the operation and security of the Site and the analytics workspace.
Legal bases. Where we act as controller, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing our services and communicating with business contacts, or consent where required. We rely on legitimate interests only where they are not overridden by your interests or fundamental rights.
| Processing activity | Data | Lawful basis | Retention |
|---|---|---|---|
| Delivery of the Consulting Services | Client business data, to the extent it is personal data | Determined by the business customer (we act as processor) | Section 11 |
| Analytics-workspace accounts | Name and email designated by the client; activity logs | Customer’s basis; for our own administration, legitimate interests or contract | Section 11; logs up to 24 months |
| Site operation and security | Server access logs | Legitimate interests | 14 days |
| Quick-Score requests | Form entries; Quick-Score analysis | Pre-contractual steps at your request; legitimate interests where you act for a company | Section 11 |
| Form spam protection | IP address | Legitimate interests | Briefly, for the request limit only |
| Call scheduling and inquiries | Name, email, appointment, optional details, uploaded documents | Pre-contractual steps; legitimate interests | As needed for the inquiry |
| Payments and billing | Billing name, email, address, VAT details, amount, payment details | Contract; legal obligations | 7 years |
| Business communications and files | Contact details, emails, files, invoices | Legitimate interests; contract | Section 11 |
| AI text and analysis | Business figures, work content, business contact details | Legitimate interests in efficient service delivery; customer’s basis where we act as processor | Section 11 |
| Marketing | Business contact name, email, preferences | Consent where required; otherwise legitimate interests | Until opt-out |
Your rights. Subject to applicable conditions, you have the right to information and access, rectification, erasure, restriction, data portability, and objection — including objection at any time to direct marketing — and to withdraw consent without affecting earlier processing. We do not make decisions based solely on automated processing that produce legal or similarly significant effects. We respond without undue delay and generally within one month; where permitted for complex requests, we may extend this by two months and will tell you within the first month.
International transfers. We are established in the United States, and our service providers and contractors may process personal data in other countries, as described in Section 6. Where the GDPR requires safeguards for a transfer, we use appropriate safeguards such as the European Commission’s standard contractual clauses, with supplementary measures where needed. You may contact privacy@pnlconsultings.com for information about these safeguards and to request a copy.
Complaints. You may lodge a complaint with a competent supervisory authority, in particular in the EEA country of your habitual residence, place of work, or the alleged infringement. You do not need to contact us first.
PL Signature Holding LLC (doing business as P&L Consultings), 1807 Alpha Rd, Glendale, CA 91208, USA · privacy@pnlconsultings.com
We may update this Policy from time to time. We will post the updated version with a revised “Last updated” date and, where required, provide additional notice.