Amazon Information & Data Protection Policy

This policy applies to private Selling Partner API (SP-API) applications developed or operated by ANNAPURNA SRLS for its own publishing business and authorized seller accounts. It does not cover seller accounts belonging to another legal entity or services for third-party sellers.

The controls in this policy are mandatory requirements. Each application must have its controls implemented and verified before receiving production Amazon Information. This policy website does not provide access to Amazon buyer records or accept SP-API credentials. Publication of the policy does not certify the implementation of any particular application.

Permitted functionality includes invoicing, financial reconciliation, SKU margin analysis, listings and pricing, inventory, FBA/MCF logistics, Amazon Shipping, planned AWD integration and eligible business analytics. Every API operation remains subject to Amazon approval, seller authorization and program eligibility.

Depending on the approved operation, information may include SKU and ASIN data, listings, prices, inventory, fulfilment and shipment events, orders, returns, refunds, fees, settlements, sales and eligible business reports. Permitted non-PII data may be combined with internal product costs and other-channel sales totals for our own operational and financial analysis.

Tax Invoicing is the restricted role requested for the invoicing application. Buyer names, billing addresses and tax identifiers may be processed only where necessary to prepare, reconcile, submit or retain invoices, credit notes and other legally required fiscal records. Only the minimum fields needed for the authorized purpose may be collected.

Buyer PII is not needed for routine margin or inventory analysis. Amazon Information must not be sold, licensed for unrelated use, used for advertising, used to profile buyers or enriched with unrelated personal data. Production buyer PII must not be entered into ChatGPT, development assistants, code repositories or test datasets.

Operational buyer PII, raw reports and working copies must be kept only as long as necessary for the permitted purpose and deleted no later than 30 days after order delivery. This deadline is not measured from import, report generation or successful processing. Troubleshooting does not by itself extend the deadline.

Longer retention is permitted only where a specific legal, tax or regulatory obligation requires it. The minimum necessary fiscal record must be held in a separately restricted, encrypted archive. Its legal basis, jurisdiction and retention period must be documented. This exception does not permit retaining entire raw customer datasets or reusing fiscal PII for analytics. Mandatory records must be deleted when their required retention period ends.

Non-PII information may be retained only for a documented, necessary business or legal purpose, reviewed periodically. Security audit records must be kept for at least 12 months and must exclude Amazon buyer PII and secrets.

Deletion must cover active records, temporary files, exports, caches, replicas, object versions and backups within the applicable deadline. Hashing or anonymizing a retained PII record is not a substitute for required deletion. Deletion failures and completed disposal must be recorded without reproducing the deleted information.

Loss or revocation of authorization, termination or an Amazon deletion instruction triggers the applicable deletion process, completed within 30 days unless a specific legal retention obligation applies.

Information must be encrypted in transit using TLS 1.2 or higher; sensitive records and backups must use AES-256 encryption at rest. Key access must be separate from routine data access, restricted, audited and subject to rotation and revocation procedures.

The planned restricted-data architecture uses AWS KMS and AWS Secrets Manager in approved EU regions. Their activation and configuration must be verified before use. SP-API client secrets, refresh tokens and application credentials must never appear in source code, browser bundles, URLs, logs or test data. Authorized backend services retrieve secrets at runtime.

Human passwords must be handled by the approved identity system rather than stored as recoverable plaintext application credentials. API and encryption keys must follow a documented lifecycle, with annual rotation where required and immediate action following suspected compromise.

Every approved person must have a named account, a documented business need and appropriate security training. Shared user accounts are prohibited. MFA is required. Permissions must follow least privilege with separate invoicing, reporting and administrative roles. Access requires approval, quarterly review and removal within 24 hours of termination or role change. Service access must be removed when no longer needed or suspected compromised.

Password controls must require at least 12 characters including uppercase, lowercase, numbers and special characters; exclude the user's name and username; prevent reuse of the last 10 passwords; and enforce a minimum age of one day and maximum age of 365 days. Accounts must lock for at least 30 minutes after no more than 10 unsuccessful attempts; the lock period starts when the failure threshold is reached. Enforcement must be verified in the identity systems concerned.

Systems must use firewalls, access-control rules, network segmentation, intrusion detection and prevention capabilities and application-layer protection for public endpoints. Database and file access must be restricted to authorized identities and approved network paths.

The planned Tax Invoicing backend architecture includes AWS WAF, Network Firewall and GuardDuty; these are not a description of the existing logistics application's hosting. On macOS, Apple XProtect provides built-in antivirus/anti-malware protection. Its current update status and operation must be verified on each device. No Bitdefender GravityZone deployment has been verified. Device management, removable-media restrictions, export controls and alerts require separate implemented and verified controls; the presence of a product or a written policy does not establish that all these protections are active.

Devices accessing Amazon Information must be managed, use disk encryption and lock automatically after no more than 15 minutes. Supported antivirus/anti-malware or equivalent endpoint protection must remain updated, perform regular system scans, resist unauthorized disablement and alert on failures.

Downloads and exports require authorization and audit events. Unmanaged devices, personal storage, unauthorized cloud destinations and removable media must be restricted. DLP policies must monitor relevant device and transfer channels and alert the incident contact to suspicious access or transfers.

Development, staging and production must have separate access policies, credentials and storage. Tests use synthetic data. Changes require a recorded owner, review, tests, approval and a rollback plan. Testing and approval responsibilities must be assigned before release. Production troubleshooting must use restricted, audited access.

Code, dependencies and secrets must be scanned before every release. Vulnerability scans must cover all in-scope systems at least every 30 days and after significant changes. Qualified penetration testing is required at least every 365 days. Automated dependency scans do not replace infrastructure scanning or penetration testing.

Findings must be tracked with severity, affected asset, owner, discovery date, deadline and remediation evidence. Critical findings must be corrected within seven days of discovery and high-risk findings within 30 days. Retesting is required before closure. Releases with unresolved critical or high-risk findings must be blocked.

Audit trails must cover authentication, authorization, administrative changes, API and storage access, exports and security events. Events must identify the authorized actor or service, time, action and outcome. Logs must exclude Amazon buyer PII, invoice contents, raw SP-API payloads, passwords and tokens, including values embedded in object names and error messages.

Records must be centrally collected, access-restricted, protected against tampering and retained for at least 12 months. Automated alerts and documented reviews at least every 14 days must identify suspicious access, unusual download volumes and configuration changes. Investigations and corrective actions must be recorded. Default short-term hosting logs do not on their own meet this requirement.

Backups must be encrypted, access-controlled, monitored and held in a geographically separate approved recovery location. The planned restricted-data deployment uses Frankfurt as its primary AWS region and Ireland for recovery. Initial design targets are RPO no greater than 24 hours and RTO no greater than eight hours; measured restore tests are required before these can be represented as achieved capabilities.

Restore procedures must be tested quarterly and after material changes. Retention rules apply to backups and object versions as well as live records. Restores must not reintroduce data whose deletion deadline has passed. Only mandatory fiscal records may remain in the separately controlled long-term archive for their documented statutory period.

The corporate website and this policy page are hosted on Vercel, with source maintained in a private GitHub repository. The existing Annapurna Logistics application is hosted on ChatGPT Sites, an OpenAI platform, using Cloudflare for application runtime and storage. These providers must be included in the logistics application's data-flow and security assessment. Their use does not establish compliance with the requirements in this policy.

AWS is selected for the planned restricted Tax Invoicing application's data processing, storage and security services. That architecture is not yet verified as active and does not describe the hosting of every Annapurna application. Application access, endpoint management and data-loss prevention require configured controls and recorded verification.

SendPulse is configured as an email provider in the logistics application. Its data-flow assessment must identify recipients, message contents and attachments where used. Security notifications must exclude buyer PII, document contents, credentials and tokens. A configured email service or an accepted send request does not prove receipt: channel activation and successful receipt must be verified and recorded.

Keepa may receive product identifiers such as ASINs for product-level analytics, never buyer PII. Hosting an application on ChatGPT Sites does not authorize entering production buyer PII in ChatGPT conversations or development-assistant prompts. Development assistants and repositories must use synthetic data.

The former Firecrawl integration for retrieving public product pages has been removed from the logistics application, together with its offer-monitoring and competitor-comparison features. Firecrawl is not a current data recipient for this application. Any future reintroduction requires a new data-flow and security assessment before activation.

Before a provider receives Amazon Information, its actual data flow, access, location, retention, contractual safeguards and security responsibilities must be recorded and assessed. Changes must be reported to Amazon where required. Planned services must not be described in registration responses as already processing restricted data.

Fiscal disclosures are limited to Amazon, competent authorities and specifically approved tax or electronic-invoicing providers where necessary for legal obligations. Recipients must be identified before transmission. Any permitted international transfer requires an applicable legal safeguard. An EU database location does not determine the location of every provider or support operation.

Matteo Attianese is the incident-management point of contact (IMPOC), at info@annapurnapublishing.site. The procedure covers preparation, detection, assessment, containment, investigation, eradication, recovery and lessons learned. Notification channels and human availability must support incidents at any time, including outside business hours.

Incidents involving Amazon Information must be reported to security@amazon.com within 24 hours of detection. An initial report must not wait for a completed investigation. Follow-up reports provide findings, containment and recovery updates. Competent authorities and affected individuals must be notified where applicable law requires it.

Actions include isolating affected systems, disabling compromised access, revoking or rotating credentials, preserving protected evidence, identifying affected information, restoring verified backups and documenting corrective work. The incident plan must be reviewed every six months, after significant system changes and after incidents. Contact-channel tests and exercises must be recorded.

Privacy, access, correction, restriction and deletion requests may be sent to info@annapurnapublishing.site. Identity and legal entitlement must be checked before disclosure. Mandatory fiscal records may need to remain for their required period, with access and use restricted to that obligation.

Policy owner: Matteo Attianese for ANNAPURNA SRLS. Review is required at least every six months and whenever roles, applications, providers or applicable requirements change. Operational procedures, access reviews, findings and implementation evidence are maintained separately with restricted access. Registration answers must be supported by that evidence.