Last updated: May 14, 2026
Alexandria AI LLC ("Alexandria", "we", "us", "our") operates the Alexandria AI sourcing platform at thealexandria.ai. We are a Michigan, USA limited liability company registered at 2780 Denton Rd, Canton MI 48188, USA. This Privacy Policy explains what data we collect, how we use it, and the rights you have over your information.
Questions or requests? Email moe@thealexandria.ai, or write to: Alexandria AI LLC, 2780 Denton Rd, Canton MI 48188, USA.
For privacy-specific requests (GDPR / CCPA rights, subprocessor disclosures, breach notifications), email moe@thealexandria.ai. That alias forwards to the founder; a backup contact at moe@thealexandria.ai is monitored daily. Alexandria does not currently have a designated Data Protection Officer — under GDPR Article 37 a DPO is only required for large-scale systematic monitoring or processing of special-category data, neither of which applies at our current size. We will appoint one if and when the thresholds are met.
Account data: email address, name, password hash, and any profile details you provide when signing up.
Billing data: we use Stripe for payments. Stripe collects and stores your payment card details — we never see or store full card numbers. We retain billing metadata such as subscription status, plan, and invoice history.
Usage data: product searches, deal analyses, chat messages, clicks, and other interactions with the Platform. We use this to operate and improve the service.
Connected account data: if you choose to connect third-party accounts (for example, Amazon SP-API), we access only the data needed to deliver Alexandria features to you.
Device and log data: IP address, browser type, device identifiers, and pages visited, collected automatically when you use the Platform.
We use your data to: (a) deliver and operate the Platform, (b) authenticate you and secure your account, (c) process payments and manage subscriptions, (d) provide customer support, (e) generate product analytics so we can understand and improve the Platform, (f) send transactional and account email, and (g) comply with legal obligations. We do not sell your personal data.
Below is the complete list of third-party services Alexandria uses. We've split them into two categories: services that may process data derived from your Amazon Selling Partner account ("Amazon Information"), and services that operate exclusively on publicly available data or your explicit input.
Each sub-processor is bound by contractual obligations consistent with Amazon's Data Protection Policy, including encryption, access controls, and breach notification requirements. This list will be updated when material changes occur.
These are platforms Alexandria reads from on your behalf (rather than third-party services we forward your data to). They are governed by the linked owner's own privacy policy:
We may add or replace subprocessors as the product grows. Material changes will be reflected in this list and the "Last updated" date above. A current Data Processing Agreement (DPA) is available from moe@thealexandria.ai on request.
Alexandria connects to your Amazon Seller account via Amazon's Selling Partner API (SP-API). To provide the service, we read data from your account and, when you authorize specific actions, write data back. This section describes exactly what we collect, how we secure it, how long we keep it, and what we do if something goes wrong.
When you connect your Amazon Seller account, we receive and store:
When you use Alexandria's features, we read the following SP-API data on demand:
We do not collect, store, or process any Personally Identifiable Information about your Amazon buyers. The "Restricted" SP-API roles that grant access to buyer PII (names, addresses, phone numbers, email addresses) are not requested by Alexandria and are not used by any feature in the service.
/dashboard/integrations, or within 24 hours of account closure.You may request deletion of any operational data at any time by emailing moe@thealexandria.ai. We will confirm deletion within 7 days.
Amazon Information is shared only with the Category A subprocessors listed in Section 4 (Anthropic, Supabase, Render, Vercel, and Resend), each of which is contractually bound to use it solely to deliver the Alexandria service to you. We do not share or sell Amazon Information for any other purpose. We do not share it with advertising networks, data brokers, retargeting platforms, or any third party for commercial purposes. The Category B subprocessors listed in Section 4 never receive Amazon Information.
Operational role of each Category A recipient:
Each Category A subprocessor is bound by contract to use Amazon Information only to provide the listed service.
In the event of a confirmed security incident affecting your Amazon Selling Partner data:
To report a suspected security incident or vulnerability: moe@thealexandria.ai. We commit to a first response within 24 hours.
You can, at any time:
/dashboard/integrations, which deletes the refresh token within 24 hoursWe keep your account data for as long as your account is active. When you close your account, we delete or anonymize your personal data within 90 days, except where we are required to retain it for legal, tax, or accounting purposes (for example, billing records). Backups containing your data may persist for up to 30 additional days before being overwritten.
Depending on where you live, you may have the right to:
You can exercise the deletion and export rights yourself from Dashboard → Settings → Privacy & Data. The Delete Account button calls POST /api/account/delete and the Request Data Export button calls POST /api/account/export — both are authenticated routes scoped to your own user record. For any other request, email moe@thealexandria.ai. We will respond within 30 days. We will not discriminate against you for exercising these rights.
If you are located in the European Union, the United Kingdom, or the European Economic Area, you have the rights granted by Articles 15 through 22 of the General Data Protection Regulation (GDPR):
POST /api/account/export.POST /api/account/delete.You also have the right to lodge a complaint with your local supervisory authority. Our lawful bases for processing are: (a) performance of our contract with you (GDPR Art. 6(1)(b)), (b) our legitimate interests in operating and improving the service (Art. 6(1)(f)), and (c) your consent for non-essential analytics and marketing cookies (Art. 6(1)(a)).
If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code §§ 1798.100 through 1798.135), gives you the following rights:
POST /api/account/delete.POST /api/account/export.To exercise any of these rights, use the in-app controls or email moe@thealexandria.ai. We will respond within 45 days as required by § 1798.130(a)(2).
Alexandria AI does not sell your personal information to third parties for money or other valuable consideration, and we do not share it for cross-context behavioral advertising. We do not run third-party ad-network pixels, retargeting cookies, or data-broker exports. We have no advertising business model — our revenue comes exclusively from subscription payments processed by Stripe.
We do disclose limited personal information to the subprocessors listed in Section 4 strictly for the purpose of providing the Alexandria service (for example, Supabase hosts your account record, Resend delivers transactional email, Anthropic generates agent responses). Under CCPA § 1798.140(ad)(2), these service-provider disclosures are not a "sale" because each subprocessor is contractually restricted to using the data only to provide its specific service to Alexandria.
Because we do not sell or share personal information, there is no opt-out to action. If your interpretation of CCPA differs and you wish to formally exercise your § 1798.120 right against any disclosure we make, email moe@thealexandria.ai with the subject line "Do Not Sell or Share" and we will confirm receipt within 15 business days and act on it within 45 days.
We use a small number of cookies — including essential cookies for authentication, analytics cookies for understanding product usage, and a referral cookie. See our Cookie Policy for details and how to opt out.
Alexandria is not directed to children. We do not knowingly collect personal information from anyone under 13 years of age, and our service is intended for users aged 18 and older. If we learn we have collected data from a child under 13, we will delete it. If you believe a child has provided us data, contact moe@thealexandria.ai.
Alexandria is operated from the United States, and our primary data stores are located in the US. If you access the service from outside the US, you understand that your data will be transferred to, stored, and processed in the United States. By using Alexandria, you consent to that transfer. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border data transfers.
We use industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, encryption at rest for sensitive credentials, scoped access controls, and regular review of our subprocessors. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur, but we work hard to minimize risk and respond promptly to incidents.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you by email or in-app notice. Continued use of the Platform after changes take effect means you accept the updated policy.
Privacy questions, complaints, and rights requests: moe@thealexandria.ai (primary).
Backup contact (monitored daily): moe@thealexandria.ai. Postal mail: Alexandria AI LLC, 2780 Denton Rd, Canton MI 48188, USA.
Alexandria does not currently have a designated Data Protection Officer. Under GDPR Article 37(1), appointing a DPO is mandatory only when an organization conducts large-scale systematic monitoring of data subjects or large-scale processing of special-category data — neither of which describes our current operations. We will appoint a DPO if and when those thresholds are met, and we will update this policy accordingly.