1. Data Collection
- Scope: We only collect data that is strictly necessary for order fulfillment and logistics tracking via the Amazon Selling Partner API (SP-API). This includes order details, SKU information, and limited customer Personally Identifiable Information (PII) such as recipient name, shipping address, and phone number.
- Mechanism: Data is collected exclusively through secure, authenticated SP-API endpoints utilizing official OAuth tokens. No data is collected through scraping or unauthorized methods.
2. Data Processing
- Purpose: Data is processed solely to facilitate merchant-fulfilled order processing, generate shipping labels, and calculate shipping fees.
- Logic: Data processing happens strictly on our secure application servers. No multi-tenant data bleed occurs; all data streams are isolated by account tokens.
3. Data Storage & Security
- Security at Rest: All stored Amazon Information, especially customer PII, is encrypted using industry-standard AES-256 encryption algorithms.
- Access Control: We implement a strict Principle of Least Privilege (PoLP). Access to databases containing Amazon Information is restricted to authorized internal system processes and key technical personnel via multi-factor authentication (MFA) and secure Access Control Lists (ACLs). No local or unencrypted copies are permitted.
4. Data Usage
- Permitted Use: Amazon Information is used exclusively for internal operations related to the specific orders fetched.
- Prohibited Use: We do not use Amazon Information for marketing, re-targeting, customer profiling, or any other peripheral commercial activities.
5. Data Sharing
- Authorized Parties: To complete order fulfillment, limited shipping details (recipient name, shipping address, and phone number) are shared with verified, official logistics partners, specifically FedEx and certified courier networks.
- Mechanism: Data sharing is executed through secure, encrypted API connections (utilizing TLS 1.2 or TLS 1.3 protocols) directly to the carriers' official shipping systems.
- Restrictions: No data is ever sold, rented, or shared with unrelated third parties, data brokers, or marketing analytics firms.
6. Data Disposal
- Retention Period: In strict compliance with Amazon DPP, all customer PII (names, phone numbers, detailed addresses) is retained for a maximum of 30 days following order delivery.
- Automated Purging: We deploy an automated background script (cron job) that executes daily. Once an order exceeds the 30-day post-delivery threshold, the script permanently purges all customer PII from our active databases, or irreversibly anonymizes the records (retaining only non-PII metrics such as City/State/Zip Code for accounting, tax compliance, and financial auditing).
- Backup Disposal: Any temporary logs or backup snapshots containing PII are rotated and overwritten within the same 30-day compliance window.