Privacy Policy

This Privacy Policy describes the current status and intended data practices of Foshan Dajiao Riji Bags & Clothing Co., Ltd. ("we", "us", or "our"), operator of XYJG (汐雅橘光). Our software currently supports internal business operations. The public Amazon seller service (the "Service") and its Selling Partner API ("SP-API") integration are in preparation; external seller authorization is not yet available. The Amazon-specific practices below describe the planned service and the controls to be completed before external seller access is enabled.

1. Information We Collect

After the required approvals and implementation, each selling account will grant separate Amazon OAuth authorization. We intend to access only:

• Order information — non-PII order identifiers, item SKUs, quantities, order status, and fulfillment channel, within approved non-restricted SP-API roles.
• Inventory information — FBA inventory summaries (fulfillable, inbound, reserved, unfulfillable quantities).
• Authorization artifacts — Amazon OAuth refresh tokens. Secure encrypted storage and independent key management must be implemented and verified before these tokens are accepted for external sellers.
• Account information — the seller account identifiers and marketplace IDs needed to maintain the connection.

The planned initial SP-API service excludes Restricted Data. It will not access buyer names, shipping addresses, phone numbers, shipping labels, or other restricted-data functionality. Any later change in scope requires an updated disclosure, appropriate Amazon approval, and verified controls before activation. This statement concerns the planned Amazon integration, not every data field in the existing internal management system.

2. How We Use Information

• Providing order-tracking and FBA inventory dashboards solely for the authorizing seller. Synchronization intervals will be defined and disclosed before launch.
• Maintaining per-store authorization and synchronization status for operational troubleshooting, with credentials excluded from logs.
• Providing customer support and ensuring the security of the Service.

Amazon Information will be used solely to provide the authorized Service. We do not sell Amazon Information or use it for advertising, marketing, or unrelated internal business purposes.

3. Data Sharing and Disclosure

Our identified hosting provider is Rainyun, with business-system servers in Shenzhen, China. The planned SP-API service will store and process information on this infrastructure. Provider access, confidentiality terms, and required safeguards must be verified before external seller information is processed. Other intended disclosure is limited to:

• Additional hosting, backup, or support providers identified and reviewed before use, with access limited to their service duties and required confidentiality obligations;
• When required by law, regulation, or valid legal process.

4. Data Security

Role-based access permissions are used in the current business system. Business-system HTTPS/TLS, the Amazon OAuth integration, and the complete security incident response process are not yet fully deployed. The marketing website's HTTPS connection does not by itself protect all business-system connections. Before enabling external seller access, we will complete and verify:

• Encrypted transmission across applicable external endpoints and network boundaries, using TLS 1.2 or higher.
• Secure encrypted storage and independent key management for Amazon authorization credentials.
• Company and selling-account access isolation, authorization revocation, and appropriate audit records.
• Applicable network protection, credential controls, incident response, and retention requirements.

5. Data Retention and Deletion

• The automated Amazon-specific deletion workflow is not yet implemented and must be validated before external seller onboarding.
• For the planned service, non-PII information will be retained only as long as necessary for the authorized purpose or applicable legal, tax, or regulatory obligations.
• On revocation or loss of authorization, synchronization will stop. Information and credentials will be securely deleted within 30 days of the earliest applicable Amazon deletion notice, customer revocation or termination, loss of processing authorization, or termination of our participation in the service, except where legally required retention applies.
• Implementation must cover live data, credentials, exports, logs, backups, and re-deletion after restoration. A documented workflow and validation record are required before these practices can be described as operational.

6. Your Rights

For privacy inquiries or requests concerning information you have provided to us, contact +86 158 2067 3070. We aim to respond to verified requests within five business days. Once the Amazon service is launched, sellers may revoke authorization through Amazon or contact us for access, correction, and deletion requests.

7. Processing Location and Transfers

The business system is hosted by Rainyun in Shenzhen, China. The planned SP-API service is intended to use this infrastructure. The marketing website's hosting location is separate and does not establish where seller information is processed. Any additional processing location or international transfer will be assessed and disclosed before use, with the required safeguards in place.

8. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced on this page with an updated effective date before they take effect.

9. Contact Us

For privacy questions, data access, or deletion requests, contact:
Foshan Dajiao Riji Bags & Clothing Co., Ltd. — +86 158 2067 3070