Privacy Policy

TPUPPY LLC builds internal data and reporting tools for e-commerce businesses. Our applications connect to marketplace and advertising platforms (including Amazon's Selling Partner API and Amazon Ads API) only for accounts whose owners, or their authorized administrators, have granted access through the platform's official authorization process.

What data we access

For each authorizing account, we access only the data covered by the permissions the account approved, which may include: sales and traffic metrics; order and financial event data (excluding buyer personally identifiable information such as names, addresses, and phone numbers, which we do not request); fees, refunds, and settlement records; inventory levels; catalog data; brand analytics; and advertising performance reports (impressions, clicks, spend, and attributed conversions).

How we use the data

Data is used solely for the internal operations of the accounts that authorized access: sales and advertising reporting, profit and loss analysis, and inventory and replenishment planning. We do not use the data for advertising to individuals, profiling, or any purpose unrelated to operating those accounts.

What we never do

• We never sell account data or personal information.
• We never share account data with third parties for their own use.
• We never use the data to contact a platform's customers.

The only other parties that process the data are the infrastructure providers that host the system — currently Supabase (database hosting) and Cloudflare (application hosting) — acting solely as processors.

Storage and security

Connections are encrypted in transit (HTTPS/TLS) and stored data is encrypted at rest by the hosting providers. API credentials and refresh tokens are kept in encrypted, owner-only storage, are never hard-coded, and are rotated regularly. Access is limited to the authorized operator and protected by strong passwords and multi-factor authentication.

Retention and deletion

We keep data only while the account's authorization is active and the data remains useful for the purposes above. When an account revokes access or asks us to delete its data, we delete that account's stored data within 30 days, except where a longer retention is required by law. An account can revoke access at any time through the platform's app management settings.

Contact

Questions about this policy: teddy@tpuppyllc.com