Privacy & Data Handling Policy

Effective Date: February 12, 2025  |  Last Updated: February 12, 2025

1. Introduction

ENDUURE ("we," "our," or "us") operates an e-commerce management platform that integrates with third-party marketplaces and services, including Amazon Selling Partner APIs. This policy describes how we collect, process, store, use, share, and dispose of data obtained through these integrations and through general use of our platform.

We are committed to protecting the privacy and security of all data entrusted to us, including Personally Identifiable Information ("PII") of marketplace buyers and the business information of our authorized users.

2. Data Collection

We collect data from the following sources: (a) information provided directly by our authorized users during account setup and platform usage, (b) data retrieved through authorized API connections with marketplace platforms such as Amazon Selling Partner API, and (c) technical data generated through platform usage such as access logs and system events.

Marketplace data collected may include order information, product listings, inventory levels, pricing data, buyer shipping addresses, buyer names, and financial transaction details. We collect only the minimum data necessary to provide the services authorized by our users.

3. Data Processing

We process marketplace data solely to provide our authorized users with inventory management, order fulfillment, shipping label generation, pricing management, financial reporting, and tax compliance services. Personally Identifiable Information about marketplace buyers is processed only for the purpose of merchant-fulfilled shipping and to meet legal and tax requirements.

We do not use buyer PII for marketing, advertising, customer profiling, or any purpose beyond order fulfillment and legal compliance. We do not aggregate buyer data across multiple authorized users.

4. Data Storage

All data is stored using cloud infrastructure providers that maintain industry-standard security certifications. Data at rest is encrypted using AES-256 encryption. Encryption keys are managed through provider-level key management systems with automatic rotation policies.

Databases are deployed within private network environments with no direct public internet access. Encrypted backups are stored in geographically separated locations from the primary data store to ensure disaster recovery capability.

5. Data Use

We use collected data exclusively to provide and improve our platform services for authorized users. Specifically, we use data to manage product listings, synchronize inventory, process and fulfill orders, generate shipping labels, calculate taxes, produce financial reports, and support authorized user operations.

We do not sell, rent, or trade any data. We do not use marketplace buyer data for any purpose other than fulfilling the services authorized by our users, complying with applicable laws, and meeting marketplace policy requirements.

6. Data Sharing

We share data only with third-party service providers that are essential to delivering our platform services, such as cloud infrastructure providers, database providers, and shipping API providers. Each third-party provider receives only the minimum data necessary for their specific function, transmitted via encrypted connections.

We require all third-party providers to maintain data protection standards at least as strict as those described in this policy. We do not share data with advertising networks, data brokers, marketing platforms, or any parties not directly involved in providing our platform services.

We may disclose data if required by law, regulation, legal process, or enforceable government request.

7. Data Retention and Disposal

Personally Identifiable Information related to marketplace orders is retained for no longer than 30 days after order shipment, unless a longer retention period is required by law or tax regulation. Non-PII business data such as inventory records, financial summaries, and aggregated analytics may be retained for the duration of the authorized user's account.

Upon account termination or upon request by an authorized user, all associated data is permanently deleted within 30 days. Deletion includes primary databases, backups, and any cached copies. Disposal is performed using secure deletion methods that render data unrecoverable.

8. Access Controls

Access to data is restricted on a need-to-know basis using role-based access controls. All personnel with access to systems containing marketplace data are individually identified through unique accounts with multi-factor authentication enforced. Access permissions are reviewed quarterly and revoked immediately upon role change or termination.

9. Security Measures

We maintain comprehensive security controls including encryption of data in transit and at rest, network-level protections such as firewalls and private networking, endpoint management for all devices accessing production systems, continuous monitoring and logging of system access and data events, regular vulnerability scanning and annual penetration testing, and incident response procedures with defined roles and notification timelines.

Security logs are retained for a minimum of 12 months and reviewed on a bi-weekly basis to detect anomalies and potential incidents.

10. Incident Response

We maintain a documented incident response plan that is reviewed every six months. In the event of a security incident involving marketplace data, we will contain the incident immediately, assess the scope and impact, notify affected marketplace platforms within 24 hours of detection, notify affected parties as required by applicable law, remediate the root cause, and conduct a post-incident review to update preventive controls.

11. Your Rights

Authorized users may request access to, correction of, or deletion of their data at any time by contacting us at the address below. We will respond to all data requests within 30 days.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, services, or legal requirements. We will post the updated policy on this page and update the "Last Updated" date. Continued use of our platform after changes are posted constitutes acceptance of the updated policy.

13. Contact

For questions about this policy or to report a data-related concern, contact us at:

ENDUURE

Email: contact@enduure.com

Security Incidents: oze@enduure.com