Last updated 20 September 2026
The short version
- We collect only what you hand us — your name, your email, and a little context about your Amazon account.
- This site sets no cookies. No analytics, no advertising pixels, no cross-site tracking.
- We don’t sell your data. Ever.
- Contact form submissions are emailed to us and aren’t stored in a database on this site.
- If you’re a client, your Amazon advertising data is used to do your work and nothing else.
- Email imran@ppcexpand.com to see, correct, or delete anything we hold.
Who we are
PPC Expand is an Amazon PPC and retail media consultancy operating from Sheridan, Wyoming, United States. In this policy, “we”, “us” and “our” mean PPC Expand. “You” means anyone visiting this website or engaging us for services.
We handle personal information in line with applicable United States privacy law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act where it applies, and the consumer privacy laws of other US states where they apply. Where we work with clients or visitors in the United Kingdom or the European Economic Area, we also apply the standards of the UK GDPR and EU GDPR to that information.
This policy covers this website and our client engagements. It does not cover third-party sites we link to, or the Amazon platforms themselves, which have their own privacy terms.
What we collect
Information you give us directly
When you use the contact form on this site, we ask for:
- Your name (required)
- Your email address (required)
- Your brand or company name (optional)
- Your approximate monthly ad spend, as a range (optional)
- A message describing what you need (optional)
That submission is emailed to us so we can reply. We do not store contact form submissions in a database on this website. Once the email reaches us, it lives in our inbox like any other email.
If you email us directly, we hold whatever you choose to put in that email.
Information collected automatically
Our hosting provider records standard server logs when a page is served — IP address, browser and device type, the page requested, and a timestamp. These are used to keep the site running, diagnose faults, and detect abuse. We do not use them to build a profile of you.
Our site remembers whether you chose the light or dark colour scheme. That preference is saved in your browser’s local storage and never leaves your device. It is not a cookie, and we never see it.
What we deliberately don’t collect
We do not ask for, and have no use for, sensitive personal information — health data, biometric data, racial or ethnic origin, political or religious views, sexual orientation, or criminal history. Please don’t send it to us.
We never ask for your Amazon password. Account access is granted through Amazon’s own permission systems, described in “Client account data” below.
How we use it
We use personal information to:
- Reply to your enquiry and quote for work
- Deliver and support the services you’ve engaged us for
- Meet our tax, accounting, and other legal obligations
- Keep this website secure and working
For visitors covered by the GDPR, our legal bases are: performance of a contract (delivering services you’ve engaged), consent (where you’ve asked us to do something specific), legitimate interests (replying to enquiries, securing the site), and legal obligation (record-keeping).
We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.
Third parties
We keep the number of third parties deliberately small.
- Our hosting provider serves this website and generates the server logs described above. It may also provide the email hosting where your enquiry lands.
- YouTube and Vimeo — where a client has agreed to a video testimonial, the video is embedded from one of these platforms. Nothing loads until you press play. If you never play a video, neither platform is contacted. When you do, that platform receives your IP address and the fact that you requested the video, under its own privacy terms.
- Amazon Ads and Amazon Seller Central for client work, along with standard business tools for email, invoicing, and file storage.
This site loads no external fonts, no content delivery network, and no third-party scripts in its default configuration. All typography uses fonts already installed on your device.
We do not run Google Analytics or any equivalent analytics product, and we do not embed advertising pixels, session recording, heatmaps, or social media widgets.
Cookies & tracking
This website does not set cookies. Not for analytics, not for preferences, not for anything.
The only two things stored on your device are:
- Local storage — your light/dark preference, so the site doesn’t flip back on the next page
- Session storage — only for logged-in editors, to remember whether the on-page editing toolbar is open. Visitors never trigger this.
Because we set no cookies and run no tracking, there is nothing to opt out of and no cookie banner to dismiss. You can still block or delete cookies through your browser settings at any time; nothing on this site depends on them.
This site does not currently respond to Do Not Track signals, because there is nothing here to opt out of. If that ever changes, this section changes with it.
Client account data
Client engagements are different from casual browsing, so they deserve their own section.
To manage advertising, we typically need delegated access to your Amazon Ads and, where relevant, Amazon Seller Central accounts. That access is always granted by you through Amazon’s own user-permission systems, at the permission level required for the work, and it can be revoked by you at any time without our involvement.
Through that access we see campaign structures, keyword and search-term data, bids, spend, sales and conversion figures, and related advertising reporting. We use this only to plan, run, optimise, and report on your advertising.
We treat your account data as confidential. Specifically, we will not:
- Use your data to benefit a competitor
- Sell, licence, or share it with data brokers
- Publish it, or identify you in a case study, without your written permission
Where we reference results publicly, figures are aggregated or anonymised unless you have specifically agreed to be named.
When an engagement ends, ask us to step back from your accounts — or revoke access yourself — and we’ll confirm it’s done.
Who we share with
We do not sell personal information, and we do not trade or rent it. We also do not share it for cross-context behavioural advertising.
We disclose it only in these situations:
- Service providers who help us operate — hosting, email, accounting — and only what they need to do their job
- Professional advisers such as accountants or lawyers, where genuinely necessary
- Legal requirement — where we’re compelled by law, a court, or a regulator
- Protecting rights — where disclosure is reasonably necessary to prevent fraud, security threats, or harm
- With your consent — for anything else
Where your information is processed
We’re based in Wyoming, in the United States, and the providers we use are primarily US-based. Amazon processes advertising data in the regions where you sell.
If you’re in the UK or EEA, this means your information may be processed outside your home country. Where the GDPR applies, we rely on appropriate safeguards for those transfers, such as standard contractual clauses or an equivalent mechanism.
Security
We take practical, proportionate measures to protect personal information: encrypted connections (HTTPS) across the site, multi-factor authentication on business-critical accounts, least-privilege access to client platforms, and a deliberately small number of systems holding data.
No method of transmission or storage is completely secure, and we can’t guarantee absolute security. If we become aware of a breach affecting your personal information, we’ll notify you and the relevant regulators where the law requires it.
How long we keep it
We keep personal information only as long as we have a reason to:
- Enquiries that don’t become engagements — up to 24 months, then deleted
- Client records — for the engagement, then as long as required for tax and legal purposes
- Server logs — a short rolling window set by our host
When information is no longer needed, we delete it or de-identify it.
Your rights
You can ask us to:
- Access the personal information we hold about you
- Correct anything inaccurate or out of date
- Delete it, where we don’t have a legal reason to keep it
- Stop using it for a particular purpose, including marketing
If you’re a California resident, you also have the right to know what we collect and why, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Residents of Colorado, Virginia, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights, including a right to appeal if we decline a request.
If the GDPR applies to you, you also have the right to data portability, to restrict processing, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting processing already carried out.
Email imran@ppcexpand.com and we’ll respond within 30 days. There’s no charge. We may need to verify your identity first, which protects you as much as us.
Complaints
If you think we’ve mishandled your personal information, tell us first — email imran@ppcexpand.com with the details. We’ll investigate and respond within 30 days. Most issues are a misunderstanding and get resolved quickly.
If you’re not satisfied with our response, you can escalate:
- California residents — the California Privacy Protection Agency, or the California Attorney General
- Other US states — your state Attorney General
- UK or EEA — your local supervisory authority, or the UK Information Commissioner’s Office
Children
Our services are built for businesses, and this site isn’t directed at children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we’ll delete it.
Changes to this policy
We’ll update this policy when our practices change — for example, if we add analytics or a new tool. The “last updated” date at the top always reflects the current version.
If a change materially affects how we handle your information, we’ll take reasonable steps to tell you directly rather than relying on you to re-read this page.
Contact us
Questions about this policy, or about anything we hold on you:
PPC Expand
Attn: Privacy – Imran Khan
Sheridan, Wyoming, United States