Data Handling Policy

Effective date: April 28, 2026 * Last updated: August 8, 2026

This Data Handling Policy describes the technical, organizational, and contractual measures that Solara Interactive LLC (dba Launitec) ("Launitec") applies to data retrieved from the Amazon Selling Partner API ("SP-API") and the Amazon Ads API on behalf of Launitec Seller Insights clients (each a "Client"). It is published as part of our compliance with Amazon's Acceptable Use Policy ("AUP"), Data Protection Policy ("DPP"), and Solution Provider Agreement.

1. The data we access through SP-API

For each authorizing Client, and only with respect to that Client's account, Launitec Seller Insights accesses the following categories of data:

Where a Client has contracted catalog or shipment management, Launitec also performs write operations through SP-API on that Client's behalf -- creating or updating listings, A+ Content, and FBA inbound shipment plans. These operations run only under the Client's OAuth authorization, only on the Client's own account, and every action is recorded in an audit log.

2. Data we never request or store

• No shopper PII. We do not request the Restricted Roles that grant access to Personally Identifiable Information about Amazon shoppers (names, addresses, phone numbers, emails). The Brand Analytics role does not grant such PII, and we do not need or want it.
• No Seller Central credentials. We never ask for, store, or use a Client's Seller Central username or password. All access is granted through Amazon's official OAuth authorization flow.
• No payment card data. Payment card details are handled directly by our payment processor (Whop); no card numbers ever touch Launitec systems.

3. AUP Section 4.4 -- No aggregation across clients

Launitec does not aggregate data across our Clients' businesses or customers obtained through the Amazon Selling Partner API to provide or sell to any party, including competing Clients, market-research firms, advertising networks, data brokers, or any other third party. Each Client's data is processed and stored in a logically isolated workspace, accessible only by personnel assigned to that Client's account. We do not produce or distribute "industry benchmarks", "market reports", "competitive intelligence", or similar products derived from cross-client SP-API data.

4. AUP Section 4.5 -- No insights about Amazon's business

Launitec does not promote, publish, or share insights about Amazon's business, and we do not use insights about Amazon's business for our own business purposes. Our analyses are limited to the contracted Client's own performance and account, and the deliverables we produce are licensed to that Client for their internal business use only.

5. Data flow

1. Client authorizes Launitec Seller Insights through the OAuth consent screen in Seller Central.
2. Amazon issues a refresh token to Launitec scoped to the roles the Client has granted (Brand Analytics + any other agreed roles).
3. Launitec's data-ingestion service, hosted on Hetzner Online GmbH in Hillsboro, Oregon, USA, exchanges the refresh token for short-lived access tokens and calls the Selling Partner API on a fixed schedule (typically once per 24 hours).
4. Retrieved reports are written to a PostgreSQL database with per-client logical segregation -- data is keyed and isolated by each Client account and never co-mingled.
5. An ETL pipeline transforms the raw reports into the dashboards and weekly action lists that the Client receives. The dashboards are served from a separate, per-client database schema.
6. Deliverables (PDF reports, dashboard links, in-account changes) are sent to the Client's authorized contacts only.

6. Security controls

• Transport encryption: TLS 1.2 or higher for all SP-API, Amazon Ads API, dashboard, and email traffic.
• Data residency: All Client data is stored and processed in the United States (Oregon). We do not transfer Client SP-API or Ads data to any other location, other than the calls made directly to Amazon's own APIs.
• At-rest encryption: SP-API refresh tokens, Amazon Ads API tokens, and other credentials are encrypted with AES-256-GCM at the application layer before storage. Automated daily database backups are encrypted with AES-256 and retained for 30 days.
• Secrets management: SP-API refresh tokens, Amazon Ads tokens, and other credentials are stored as encrypted secrets in our deployment platform with strict access controls. Tokens are rotated on the cadence required by Amazon.
• Identity and access: Single sign-on with mandatory multi-factor authentication for all employee access to production systems. Production access is provisioned per Client and revoked within 24 hours of an analyst leaving the engagement.
• Network isolation: The production database is not publicly accessible -- it runs on a private internal network reachable only from the application host, with no public ingress to the data store. All web traffic is served behind a TLS reverse proxy.
• Logging and monitoring: Application and infrastructure access logs are retained, and platform availability is monitored continuously. Anomalies trigger alerts to the on-call engineer.
• Vulnerability management: Dependency and container scans on every deployment; high-severity findings remediated within the SLAs required by Amazon.
• Background checks and training: All personnel with production access undergo background checks consistent with their jurisdiction and complete annual security and AUP/DPP training.
• Web application firewall. All internet-facing endpoints are served behind a web application firewall (Cloudflare managed ruleset) that filters web application exploits, API abuse, bot traffic and denial-of-service attempts before requests reach the origin. The origin server address is not publicly exposed.
• Account lockout. Ten failed sign-in attempts lock further attempts from that source for 30 minutes.
• Endpoint protection. Devices used to access client data have full-disk encryption enabled and lock automatically after 15 minutes of inactivity.

7. Retention and deletion

Launitec retains Client SP-API and Ads API data only for the duration of the Client engagement, plus a 30-day grace period intended solely to support continuity of service in the event of accidental disconnection. After the grace period, all production and backup copies of the Client's SP-API data are securely destroyed using NIST-aligned procedures.

A Client may request immediate deletion at any time by emailing comunicaciones@launitec.com. Launitec will confirm completion within 7 business days.

8. Sub-processors

Launitec engages a small number of vetted sub-processors who may process data on our behalf:

• Hetzner Online GmbH -- server hosting and storage (United States, Oregon).
• Whop, Inc. -- payment processing.
• Google LLC (Google Workspace) -- business email and document storage.

Each sub-processor is bound by a written data-processing agreement that requires AUP/DPP-compatible safeguards. We will provide 30 days' notice before adding a new sub-processor that processes SP-API data.

9. Incident response

Launitec maintains a written security-incident response plan covering detection, triage, containment, eradication, recovery, and post-incident review. In the event of a confirmed security incident affecting Client SP-API data, Launitec will:

• Notify the affected Client by email and phone as soon as possible and no later than 24 hours after detection.
• Notify Amazon as required under the Solution Provider Agreement and Data Protection Policy.
• Provide a written post-incident report including root cause, scope, mitigations, and remediation steps within 30 days of containment.

Incident Management Point of Contact. The following named individuals are responsible for receiving, coordinating and reporting security incidents, including notification to Amazon within 24 hours of a confirmed incident:

• Galo Lara — Director — galo@launitec.com
• Tito Lara — Operations Director — tito@launitec.com

10. Right to audit

Upon reasonable written request and no more than once per twelve-month period, a Client may request an attestation of the controls described in this policy. Launitec will respond with documented evidence within 30 days, subject to confidentiality obligations.

11. Contact

For data-handling, security, or privacy inquiries, contact comunicaciones@launitec.com.