Current data handling
Where this site is hosted, what it records, how long each record is kept, and how to report a problem.
Privacy and security notice — demonstration website
What this website does today
This website presents software and reporting services that are in development. The advertising search-term console and the inventory demonstration contain fixed, invented sample records. They do not connect to Amazon Seller Central, the Selling Partner API or the Amazon Ads API, do not accept report uploads or file uploads of any kind, do not create visitor accounts, do not collect buyer personal information, and do not store Amazon authorization tokens. Filtering, row selection and the CSV download read only the fixed sample rows held in the program; nothing you select is written to a profile or kept after the page is served.
Who hosts the site and where
The site is hosted on a Lightweight Application Server operated by Tencent Cloud (Shenzhen Tencent Computer Systems Co., Ltd.) in the Singapore (ap-singapore) region. The selected deployment uses its own service account and directory on a machine shared with other services. This is account-level and process-level separation, not a separate physical machine. A reverse proxy on the same machine terminates TLS and forwards requests to this site. Company email is operated by Tencent Enterprise Email / WeCom; the operator accesses it from mainland China.
What is recorded when you visit
Every web request necessarily reveals the visiting IP address, the browser's user-agent string, the page requested and any filter values in the address bar. Three parties see different amounts of that:
- This application does not keep per-request access logs. It does not copy query-string values, cookies,
Authorizationheaders or request bodies into its request log. Unexpected connection-handler failures produce only a fixed error marker, without a client address or exception details. - The reverse proxy in front of it has access logging disabled for this demonstration site. This does not disable infrastructure operational or error logs: a failed request may appear in those logs with connection or request metadata.
- The hosting and email providers also process operational, security and delivery records under their service terms. We can administer some host logs but cannot control all provider-held records. We do not promise a fixed deletion interval for records outside our control.
This site has no analytics, no advertising pixels, no third-party scripts and no tracking cookies. It sets no cookies at all. Log records are used to keep the site running and to investigate abuse or a reported fault; they are not profiled, sold or combined with anything else.
If you email us
When you write to the address above, your email address, your message, any attachment and the delivery metadata are processed so that we can answer you, handle a privacy or security request, or keep a necessary record of its resolution. We retain correspondence only while needed for these purposes or an applicable legal obligation. After an enquiry or request is resolved, the responsible person reviews the correspondence and deletes copies under our control that are no longer needed. Any continued retention must have a specific reason, such as an unresolved dispute, incident evidence or a legal obligation, and is reviewed when that reason no longer applies. You may request earlier deletion through the contact address above; we will explain any necessary exception.
Moving a message to a deleted-items folder is not the same as erasing every copy. Email-provider backups, recovery copies and delivery logs may follow separate service terms and retention schedules; we have not verified a uniform deletion deadline for those systems. We do not claim that all copies disappear immediately or guarantee recovery of a deleted message. Please do not email Amazon passwords, API keys, refresh tokens, one-time verification codes, identity documents, bank statements or customer reports in order to demonstrate the product; we do not need them. If sensitive material is sent by mistake, we will handle its removal and any required preservation or notification; exposed credentials should be revoked or rotated by their owner.
Processing across borders
Request and log data is processed on the Singapore host described above. The operator is based in Shenzhen, China, and administers that host remotely, so the same data is accessible from mainland China. Company email is accessed and handled by the operator in mainland China; the email provider also processes messages and delivery records under its service terms. The operator's location does not establish the location of every provider system or backup. If you are outside Singapore or mainland China, visiting this site or corresponding with the operator can involve processing outside your country. The operator has not completed a formal cross-border transfer assessment for a live service carrying customer data, and this demonstration is not a substitute for one; that assessment belongs with the separate approvals described below.
Purposes, sharing and third parties
Request records are used to deliver and secure the site. Contact details are used to answer the sender. We do not sell visitor information, do not use anything entered on the demonstration pages for model training, and do not pass visitor data to advertising networks. The hosting provider and the email provider necessarily process the traffic each of them carries; no other processor receives data from this site. No external AI service receives anything from this site.
Retention and deletion
There is no visitor account and no uploaded dataset here to retain. The purposes and retention criteria for log and email records are described above. To ask what we hold about you, to correct it, or to have it deleted, email the contact address above. We verify that the person asking is entitled to the records, identify which records and which provider are involved, track the request to completion, tell you the outcome, and explain any record we are required by law to keep. An automated deletion service is not active; requests are handled by a person. Our response distinguishes actions completed on copies we control from provider-side actions that remain unconfirmed.
Reporting a privacy problem or a security vulnerability
Use the same address — zhaojianhong@zach-hub.com — for either. No account and no prior relationship is needed. Include the page affected, the approximate time, and enough description to reproduce the problem; do not include secrets, and do not run load tests or destructive tests against the site. The process we follow:
- Submission. The address above is monitored for this purpose and is published on every page of this site.
- Acknowledgement. We confirm receipt within 3 business days and give the report a reference.
- Tracking. The report is recorded with its reference, the date received, the affected component and its current state until it is closed.
- Response. We assess severity, restrict any confirmed exposure that is within our control, and send a status update at least every 10 business days while the report is open.
- Resolution. We write to you with what we found, what we changed and when it closed.
Suspected exposure of data or credentials is treated as urgent as soon as it is detected; it does not wait for the ordinary acknowledgement or update interval. Notifications required by law or an Amazon agreement are separate obligations. Where the SP-API Data Protection Policy applies, security incidents involving Amazon information must be reported to security@amazon.com within 24 hours of detection.
Amazon data access is a separate step
Selling Partner API access and Amazon Ads API access each require separate approvals, a separate authorization from each seller or advertiser, and a permitted purpose. Before any live access begins we must state the exact data fields, their source, retention period, processors and processing locations, and verify access control, encryption, tenant isolation, revocation and deletion. Seller operations data and advertising data will not be combined merely because both demonstrations appear on this site, and Amazon data will not be retained beyond what the authorized purpose needs. Nothing on this site should be read as Amazon approval, Amazon endorsement or an existing customer relationship.
This notice describes this demonstration website and the deployment chosen for it. It is not a certification of legal compliance and not evidence of any Amazon approval.