Privacy Policy & Amazon DPP Compliance

1. Introduction & Overview

This Privacy Policy outlines how SunCroix ("we", "us", or "our") collects, protects, processes, and disposes of information accessed from Amazon Selling Partners ("Sellers") when connecting to our software platform. This policy applies to all merchants, independent brands (including enterprise FBA operators, high-growth direct-to-consumer brands, and multi-entity cross-border merchant organizations) utilizing SunCroix.

2. Amazon Information We Access & Collect

SunCroix accesses data strictly required to deliver automated financial ledger reconciliation, FBA reimbursement auditing, and inventory analytics under the principle of least privilege:

• Seller Identity & Store Metadata: Seller ID (Merchant ID), Marketplace IDs, store nickname, and tokenized credentials granted via official OAuth 2.0 authorization.
• Financial & Settlement Data: Settlement Reports, transaction line items, FBA fulfillment fees, storage fees, commission rates, and refund transactions obtained through the Amazon Finances API and Reports API.
• Inventory & Fulfillment Records: FBA warehouse inventory ledgers, received vs. shipped units, damaged/lost inventory status, and shipment reconciliation reports.
• Advertising & Performance Metrics: PPC campaign costs and impressions necessary for SKU-level net margin calculations.

3. Purpose of Processing & Multi-Tenant Isolation

We process Amazon Information exclusively to provide the software features authorized by the Seller:

• Automating daily reconciliation of Amazon fees, ad spend, and net disbursements.
• Detecting FBA warehouse discrepancies (lost/damaged items) eligible for reimbursement claims.
• Forecasting SKU-level net profitability after deductions of all marketplace costs.

No Cross-Seller Data Aggregation: In full compliance with Amazon AUP, SunCroix enforces strict tenant isolation using PostgreSQL Row-Level Security (RLS). Information from one enterprise merchant is never commingled, shared, or aggregated with another merchant organization for competitive benchmarking, advertising optimization, or algorithmic pricing.

4. Data Security Standards (Amazon DPP Compliance)

SunCroix implements bank-grade security controls to safeguard all marketplace information:

• Encryption at Rest: All data stored in databases, block storage, and backups is encrypted using industry-standard AES-256.
• Encryption in Transit: All communications between Sellers, SunCroix, and Amazon SP-API endpoints enforce modern TLS 1.2 or higher with strong cipher suites.
• Envelope Encryption & Credential Vault: OAuth Refresh Tokens are encrypted with unique per-tenant data keys managed via an isolated HashiCorp Vault instance. Tokens are never exposed in log files or diagnostics.
• Access Control & MFA: Administrative access to production infrastructure strictly enforces Multi-Factor Authentication (MFA) and least-privilege role boundaries.
• Vulnerability Management: Continuous dependency scanning, regular penetration testing, and zero public exposure of database ports.

5. Data Retention & The 30-Day Purge Mandate

SunCroix retains Amazon Information only as long as an active commercial relationship exists. In compliance with Amazon DPP:

• Upon Authorization Revocation or Account Termination: When a Seller disconnects SunCroix in Amazon Seller Central (Appstore manage apps) or submits an account termination request, the automated data deletion workflow is initiated immediately.
• 30-Day Permanent Erasure: All Amazon Information, raw payloads, cached responses, and derived financial records are permanently deleted within 30 calendar days across all live databases and automated backups, except where preservation is required by applicable tax or legal reporting regulations.

6. Zero Third-Party Monetization

We believe your business numbers belong solely to you. SunCroix does NOT sell, rent, license, or monetize Seller data or Amazon Information to data brokers, third-party advertisers, market intelligence platforms, or financial institutions.

7. Incident Response & Breach Notification

In the event of a verified or suspected security incident involving Amazon Information, SunCroix will notify Amazon Security (via 3p-security@amazon.com) and affected Sellers within 24 hours of confirmation, providing detailed incident analysis and mitigation actions.

8. Contact & Data Protection Officer

For questions regarding this policy, data deletion requests, or security audits, please contact our compliance team directly:

• Email: security@suncroix.com / support@suncroix.com
• Mailing Address: SunCroix Platform Compliance Division
• Turnaround: All privacy inquiries are answered within 24 business hours.