1. Data Collection & Purpose Limitation

VVPod collects marketplace data solely for the purposes of order fulfillment, inventory synchronization, and shipping management. We do not collect or process data beyond what is strictly necessary to provide our print-on-demand fulfillment services.

Data received through the Amazon Selling Partner API is used exclusively for processing and fulfilling orders placed by Amazon customers through our merchants' stores. We do not use this data for marketing, advertising, profiling, or any purpose unrelated to order fulfillment.

2. Data Retention & Minimization

VVPod follows a strict data minimization policy. Personally Identifiable Information (PII) from integrated marketplaces is retained only as long as necessary for order fulfillment and legal compliance:

• Customer PII (names, addresses, phone numbers): Retained for a maximum of 31 days post-shipment, after which it is systematically purged from active databases.
• Order transaction data: Retained for the period required by applicable tax and accounting regulations.
• API tokens and credentials: Stored only while the merchant's integration is active; deleted immediately upon disconnection or authorization revocation.

3. Encryption Standards

At Rest: All sensitive data, including PII and API credentials, is stored using AES-256 encryption. We utilize AWS Key Management Service (KMS) for centralized key management with automatic key rotation.

In Transit: All communication between VVPod systems, merchants, end users, and third-party APIs (including Amazon SP-API) is encrypted using TLS 1.2 or higher. Unencrypted connections are rejected.

4. Security & Access Control

Access to the VVPod production environment and any database containing marketplace information is protected by mandatory Multi-Factor Authentication (MFA). We enforce Role-Based Access Control (RBAC), ensuring only authorized fulfillment and technical personnel have access to sensitive data on a need-to-know basis.

All access to systems containing Amazon Information is logged and monitored. Access logs are retained for a minimum of 12 months for audit purposes.

5. Network Security

VVPod infrastructure is hosted within AWS Virtual Private Cloud (VPC) with network segmentation, security groups, and firewall rules restricting access to authorized traffic only. Regular vulnerability scans and penetration testing are conducted to identify and remediate security risks.

6. Incident Response & Notification

VVPod maintains a documented incident response plan. In the event of a suspected or confirmed security incident involving marketplace data:

• Investigation is initiated immediately upon detection.
• Affected platforms (including Amazon) and merchants are notified within 24 hours of confirmed breach detection.
• Remediation actions are documented and implemented to prevent recurrence.
• A post-incident report is provided to affected parties upon request.

7. Third-Party Data Sharing

VVPod does not sell, rent, lease, or share customer data with third parties for marketing, advertising, or any purpose unrelated to order fulfillment. Data is shared only with:

• Shipping carriers: Limited to name and address required for delivery.
• Payment processors: Limited to transaction data required for payment processing.

All sub-processors are contractually bound to equivalent data protection standards and are prohibited from using data for any other purpose.

8. Data Subject Rights

Users and merchants may exercise the following rights regarding their personal data:

• Right to Access: Request a copy of the personal data we hold.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of personal data no longer necessary for fulfillment.
• Right to Restrict Processing: Request limitation of processing under certain circumstances.
• Right to Data Portability: Request data in a structured, machine-readable format.

To exercise any of these rights, contact us at contact@vvpod.com. We will respond within 30 days of receiving a verified request.

9. Data Deletion Procedures

Personal data is permanently deleted from all active systems upon:

• Expiration of the 31-day post-shipment retention period.
• Receipt of a verified deletion request from a data subject.
• Revocation of API authorization by the merchant or marketplace platform.
• Request from Amazon or any integrated marketplace platform.

Backup copies are purged within 90 days following standard backup rotation cycles. Deletion is verified through automated audit processes.

10. Amazon Selling Partner API Compliance

VVPod specifically adheres to Amazon's Data Protection Policy (DPP) and Acceptable Use Policy (AUP). All information received through the Amazon Selling Partner API ("Amazon Information") is:

• Used exclusively for fulfilling orders and providing services as authorized by the selling partner.
• Never sold, shared, or disclosed to unauthorized third parties.
• Stored in encrypted form with access restricted to authorized personnel only.
• Deleted immediately upon authorization revocation or upon request from Amazon or the selling partner.
• Protected by security controls that meet or exceed Amazon's requirements, including encryption, access logging, and network isolation.

11. Audit & Compliance Monitoring

VVPod conducts periodic internal reviews to ensure ongoing compliance with marketplace data protection requirements. Security controls, access permissions, and data handling procedures are audited regularly.

Last updated: May 2026

12. Policy Updates

This Marketplace Data Protection section is reviewed and updated regularly to reflect changes in platform requirements, applicable regulations, and our security practices. Material changes will be communicated to affected merchants via email notification.