Data Protection Policy

1Scope

Applies to information we receive from Amazon's Selling Partner API on a seller's behalf ("Amazon Information").

2Use

Used only to show the seller their own profit, fees, payouts, inventory and reports. Never sold, rented, used for advertising, combined to profile buyers, shared with data brokers, or used to train third-party models.

3What we do not take

Buyer names, addresses, phones and e-mails are not requested or stored.

4Access

Each customer's workspace is separate; every request is checked so a user sees only their own workspace; automated tests try to cross workspaces and must fail. Staff access to a customer's account only with the customer's permission (read-only, time-limited, e-mailed and logged).

5Protection

Encryption in transit (TLS 1.2+) and at rest (encrypted server disk); Amazon access keys and two-step secrets encrypted again inside the application (AES-256-GCM); passwords stored as one-way hashes; secrets kept in a managed secrets store, not in code; logs do not contain passwords or access keys.

6Retention and deletion

• Active account: kept.
• Inactive account: kept 6 months, then deleted.
• On disconnect: access keys deleted immediately.
• On request: deleted within 30 days (write to info@druza.net).
• Backups: daily server snapshots kept 7 days.

7Incidents

We will notify Amazon within 24 hours of detecting an incident affecting Amazon Information, and affected customers without undue delay.

8Testing and assurance

No independent penetration test and no certification yet; we will publish them here when they exist.

9Contact

info@druza.net