Amazon Data Handling Policy

Effective 10.16.2026 · Nest Tile ("we", "us")

This policy describes how Nest Tile handles information received from Amazon through the Amazon Selling Partner API ("Amazon Information"), including personal information about Amazon customers. It applies to our internal order-management application and to every employee with access to it. It supplements our general Privacy Policy. Where the two differ, this policy governs Amazon Information.

1. What we collect

We collect only what we need to ship orders sold on our own Amazon seller account:

• Order data: Amazon order ID, items, quantities, prices, order status and ship-by dates.
• Shipping data: the recipient's name, delivery address and phone number, needed to create the shipping label and arrange delivery.

We do not collect buyer email addresses, payment information or tax information.

2. How we use it

Amazon Information is used only to fulfil and ship the Amazon order, confirm the shipment and tracking number to Amazon, and handle that order's delivery problems or returns. We do not use it for marketing, advertising, profiling, analytics or any other purpose. We do not add Amazon customers to mailing lists or create customer accounts for them. We contact Amazon customers only through Amazon's Buyer-Seller Messaging.

3. Where it is stored and how it is protected

• Stored in our own database on servers in the United States (DigitalOcean), [encrypted at rest].
• All transfers use encrypted connections (TLS 1.2 or higher).
• Servers are protected by default-deny firewalls. Databases are not reachable from the internet. Server access requires individual SSH keys.
• Each employee signs in with their own account. Access to Amazon Information is granted only to employees who fulfil Amazon orders, by an administrator, and is removed when no longer needed.
• Every sign-in, permission change and access to Amazon Information is recorded in an audit log. The log is kept for at least 12 months and reviewed at least every two weeks.

4. Who we share it with

Only with the parties needed to deliver the order:

• Shopify, our order-management system, where the order is prepared for shipping.
• Shipping carriers ([UPS, FedEx, USPS, freight carriers]), which receive the name, address and phone number on the shipping label.
• DigitalOcean, which hosts our servers.

We never sell, rent or otherwise disclose Amazon Information, except where required by law.

5. Retention and disposal

• Customer name, street address, postal code and phone number are deleted automatically within 30 days after the order ships: from our database and from the order in Shopify. An order that never ships is deleted within 60 days of being placed.
• Only non-personal order details (order ID, items, amounts, city/state/country) are kept, for accounting.
• Server backups are overwritten automatically within [7 / 28] days.
• Audit logs are kept for at least 12 months, then deleted.

6. Security incidents

If we suspect unauthorized access to Amazon Information, we contain the incident, investigate it, and notify Amazon at security@amazon.com within 24 hours of detection, as required by Amazon's Data Protection Policy.

7. Review

This policy is reviewed at least once a year and whenever our systems change.

Contact: nesttile@nesttile.com