BB-ERP Privacy Policy
Last updated: October 7, 2026
BB-ERP is operated by Nanyang Xunshuo E-Commerce Co., Ltd.
1. Scope
This Privacy Policy describes how BB-ERP collects, uses, stores, protects, and deletes data accessed through the Amazon Selling Partner API (SP-API) on behalf of Amazon sellers who authorize our application ("customers"). By authorizing BB-ERP through the Amazon OAuth consent flow, you agree to the practices described in this policy.
2. Information We Collect and Purpose
| Data category | Source | Purpose | Retention |
|---|
| Product listings (ASIN, SKU, price, quantity, fulfillment channel) | SP-API Listings / Products APIs | Listing management and automated repricing | While the store is connected |
| Order summary (order ID, status, purchase date, SKU, quantity, price) | SP-API Orders API | Sales analytics and profit calculation | 36 months |
| Competing offers (seller price, shipping, fulfillment channel, Prime status, ship-from country) | SP-API Products API (offers) | Automated repricing decisions | 7 days (transient cache) |
| Store credentials (OAuth refresh token, LWA client secret) | Amazon OAuth authorization flow | Authenticated SP-API calls for that store | Until the store is disconnected or authorization is revoked |
| BB-ERP account information (login name, password hash) | Created by the user | Authentication and access control | Until the account is removed |
3. Buyer Personal Information Is Not Collected
BB-ERP does not request, collect, store, or process any buyer personally identifiable information, including buyer name, shipping address, phone number, or email address. Order synchronization captures order-level business data (order ID, SKU, quantity, price) only. We do not request SP-API roles or restricted data tokens (PII) that are not required for repricing and listing management.
4. How We Use Your Data
- Solely to provide the repricing, listing, monitoring, and reporting features that the customer has configured.
- We never sell, rent, trade, or otherwise disclose seller data to other sellers, data brokers, advertisers, or analytics platforms.
- No aggregated or cross-customer analytics using one customer's data are made available to any other customer.
5. Data Storage and Security
- Database: MySQL 8.0 with the InnoDB storage engine, running on the application server and bound to localhost only. The database is not exposed to the public network and is accessed through one dedicated, least-privilege application account.
- Credential encryption: OAuth refresh tokens and LWA client secrets are encrypted at the application layer using Fernet (AES-128-CBC with HMAC-SHA256). The encryption key is stored in an environment file restricted to the service account, and tokens are decrypted in memory only for the duration of an API call.
- Password protection: BB-ERP user passwords are hashed with bcrypt; plaintext passwords are never stored. Passwords must be at least 10 characters and contain both letters and numbers, and users can change their own password after login.
- Encryption in transit: All connections use HTTPS with TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) enabled.
- Server hardening: Dedicated Virtual Private Server running Ubuntu LTS with automatic security updates, UFW firewall (only SSH, HTTP and HTTPS ports open), SSH key-only authentication, and fail2ban brute-force protection.
6. Access Control and Per-Seller Isolation
- BB-ERP API access requires JWT authentication; sub-accounts use role-based permissions and store-scoped authorization.
- Optional time-based one-time password (TOTP) multi-factor authentication is supported; an administrator can enable it per account, after which login additionally requires a 6-digit code from an authenticator app such as Google Authenticator.
- A sub-account can only access the stores explicitly assigned to it and cannot see another seller's listings, orders, rules, or credentials.
- Each Amazon store has its own encrypted OAuth token; connecting one store never grants access to any other store.
7. Third-Party Services
| Provider | Data involved | Purpose and safeguards |
|---|
| Amazon Web Services (SQS, us-east-1) | Offer-change notification messages only | Triggers repricing; queue encrypted with server-side encryption (SSE-SQS), IAM credentials restricted to queue receive/process, messages deleted after processing |
| Alibaba Cloud OSS | Product images only (public URLs) | Image hosting for published listings; public read-only bucket; no seller business data or credentials stored |
No other third parties receive seller data.
8. Data Retention and Deletion
- Order summaries: retained for 36 months for sales reporting, then deleted.
- Listings and offer data: retained while the store remains connected and deleted 30 days after disconnection.
- OAuth credentials: revoked and deleted immediately when the store is disconnected or the customer revokes authorization.
- Competing-offer cache: automatically purged within 7 days.
- Server and application logs: rotated and retained for 90 days.
Customers may request earlier deletion of their data by email; such requests are completed within 30 days after identity verification.
9. Your Rights and Choices
- Revoke access at any time: you can remove BB-ERP from the authorized applications in Amazon Seller Central. Revocation stops all further data access immediately, and the stored refresh token becomes invalid.
- Access and correction: you may request a summary of the data BB-ERP holds for your store and request correction of inaccurate account information.
- Deletion: you may request deletion of your BB-ERP account and associated store data as described in Section 8.
10. Compliance and Policy Updates
BB-ERP is designed to comply with the Amazon Selling Partner API Data Protection Policy and Acceptable Use Policy. If this policy changes materially, the "Last updated" date will be revised and the updated policy published at this address. Continued use after an update constitutes acceptance of the revised policy.
11. Contact Us
Nanyang Xunshuo E-Commerce Co., Ltd.
Email: GBB112912@163.com
Service sign-in: https://ccwcc.online/