Amazon

Amazon doesn't sell your data, but it flows freely to third-party sellers when you transact with them, to a large network of service providers, and to ad companies via identifiers.

Amazon provides more controls than most — account access, ad opt-outs, deletion requests — but blocking data collection breaks core shopping features, and retention timelines are not disclosed.

PCI DSS compliance and encryption in transit are meaningful commitments, but no SOC 2 or ISO 27001 is mentioned and policy change notification relies on you checking the website yourself.