Our privacy and data handling policy for Amazon information and personally identifiable information (PII): how Masks.Health - Original Medical Masks Made Before COVID-19 collects, processes, stores, uses, shares and disposes of it. The restricted Amazon SP-API role we request is Direct-to-Consumer Shipping. See also our Incident Response Plan and Privacy Policy.
We collect only the order and shipping details we retrieve from Amazon SP-API for Direct-to-Consumer Shipping: the buyer’s name, shipping address and phone number (if provided), together with the order details needed to ship it. We collect no other Amazon information or PII.
This data is processed only to buy and print shipping labels and to fulfill our own orders, in our in-house application. No other processing takes place.
Amazon information and PII are stored on a dedicated host we control, encrypted with AES-256 at rest, and transmitted only over TLS 1.2 or higher.
Amazon customer personal information is used only for order fulfillment and carrier claims. It is never used for marketing or any unrelated purpose.
Amazon information and PII are not shared, sold or disclosed to any outside party. Our only source of Amazon information is Amazon SP-API. We have no other employees: David Zucker is the only person with access to Amazon information and PII.
Amazon customer PII is deleted within 30 days after order shipment, unless the law requires longer, in which case it is stored encrypted. All Amazon data is securely deleted (NIST 800-88) within 30 days of a seller revoking authorization or on Amazon’s request. Non-personal data (order IDs, SKUs, financial reports) is kept only as long as needed for accounting and tax, with the reason documented. Security logs (without personal information) are kept for 12 months.
All data in transit uses TLS 1.2 or higher (HTTPS, SSH-2/SFTP). Databases, backups and devices that store Amazon data are encrypted with AES-256. SP-API credentials are stored encrypted, never in source code or plain text. Encryption keys are rotated annually and revoked immediately if compromise is suspected.
Access is limited to one authorized person, David Zucker, using a unique named account (no shared or default logins), with least privilege and multifactor authentication. Passwords must be at least 12 characters with complexity; reuse of the last 10 is blocked; accounts lock after 10 failed attempts. SP-API client secrets and refresh tokens are rotated annually or immediately on suspected compromise. Access is reviewed quarterly and removed within 24 hours of a role change. Amazon data is never stored on personal devices or removable media.
Servers sit behind a default-deny firewall that exposes only HTTPS publicly. Administrative SSH access is key-based and IP-restricted. Anti-malware runs on all servers and workstations and is updated at least monthly. Vulnerability scans run monthly, with critical issues fixed within 7 days and high-risk issues within 30. A penetration test is performed annually, and patches are applied regularly.
Incident Management Point of Contact and data contact: David Zucker, david.zucker@westnet.ca.
