Data handling policy

  1. Scope. Amazon Information that Stay Smart Way gets through its private SP-API app BCP, and from Sellerboard.
  2. Classification.
    • Buyer PII: the Recipient (ship-to name and address) of an FBM Order. Strictest rules: encrypted, short-lived, never exported.
    • Confidential: everything else about our account (orders without PII, stock, finances, listings, account health).
    • Secrets: SP-API credentials and keys (encrypted, write-only).
  3. Collection. Only what a role in use needs. For buyers: the ship-to name and address only, never email or phone.
  4. Use. Running our own business: FBM fulfillment, replacements and carrier claims, bookkeeping, stock planning, listings. Never marketing, profiling, resale, or combining with other data to identify buyers.
  5. Storage. One access-restricted server in the US; Buyer PII and secrets encrypted with AES-256; backups encrypted with AES-256 in a second region.
  6. Sharing. None. No outgoing integrations, no mail, no export.
  7. Access. The owner only, with MFA; every view of Buyer PII is logged.
  8. Disposal. Buyer PII: deleted 23 days after shipment, 30 days after the order date if never shipped; daily backups kept 7 days, longer backups without Buyer PII. All Amazon Information: deleted within 30 days of app deauthorization, Amazon's request, or the end of our participation, with written confirmation on request. Printed packing slips are shredded once the order ships.
  9. Data rights. Buyer requests reach us through Amazon. We act on them within 30 days, or sooner if the law requires.
  10. Review. Yearly, and after any change in what we collect.