Amazon Data Protection and Handling Policy
Effective October 2026. Reviewed at least annually.
Scope
This policy covers all information obtained from Amazon through the Selling Partner API or Seller Central ("Amazon Information"), including personally identifiable information (PII) such as buyer name, shipping address and phone number. It applies to all employees and systems of Hooves and Paws, Inc.
Collection
We collect only the Amazon Information needed to fulfill our own Amazon orders: order number, items, buyer name, shipping address and phone number (where provided), and shipment details. We do not collect payment information or Amazon Information unrelated to fulfillment.
Processing and use
Amazon Information is used only to purchase shipping labels, ship orders, confirm shipment and tracking to Amazon, and handle returns or customer service for that order. It is never used for marketing, profiling, resale, or to contact buyers outside Amazon's messaging channels.
Storage and security
Amazon Information is stored only in approved systems: our application hosted on Cloudflare (D1 database and R2 storage) and Veeqo. PII is never stored on personal devices, removable media, email, or spreadsheets. Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). PII is classified and tagged separately from non-PII data. API credentials are stored only as encrypted secrets in the hosting platform, never in source code or documents, and are rotated at least annually.
Access control
Access is limited to staff who need it for fulfillment, on a least-privilege basis. Every account uses a unique login with multi-factor authentication, and passwords of at least 12 characters with mixed case, numbers and special characters, expiring at least every 365 days. Access is reviewed quarterly and removed within 24 hours of a role change or termination. Access activity is logged and logs are retained for at least 12 months.
Sharing
Amazon Information is shared only with service providers that process it on our behalf to fulfill orders: Cloudflare (hosting), Veeqo (order management) and shipping carriers via Amazon Buy Shipping. We do not sell or otherwise disclose Amazon Information. Service providers are assessed at least annually.
Retention and disposal
PII is retained for no longer than 30 days after order delivery, unless a longer period is required by law (for example, tax records). After that, PII is permanently deleted from our database and label storage by an automated daily job. Non-PII order records (order number, SKU, carrier, cost) may be kept for accounting. Backups containing PII are subject to the same limit.
Incident response
Any suspected security incident involving Amazon Information is investigated immediately, and Amazon is notified at security@amazon.com within 24 hours of detection. The incident response plan is reviewed every six months.
Contact
Questions about this policy: contact@hoovesandpaws.com, Hooves and Paws, Inc., 22748 Hwy 18 S, Suite C1, Apple Valley, CA 92307.
