Privacy and data protection
How JBSCC handles seller operations data.
JBSCC processes seller-authorized marketplace data only for order fulfillment, after-sales review, inventory reconciliation, read-only advertising performance reporting, and support.
1. Data categories
- Shop authorization data: seller and shop identifiers, callback context, and connection status.
- Order data: order numbers, item identifiers, SKU, quantity, fulfillment status, cancellation, return, and refund status.
- Inventory data: SKU, warehouse mapping, available quantity, reserved quantity, reconciliation result, and stock update status.
- Advertising performance data: campaign identifiers, aggregate spend and performance metrics, product/SKU references, attribution availability, and related order references.
- Event and audit data: webhook event identifiers, delivery result, retry result, review action, and technical request metadata.
- Support data: information voluntarily provided when an operator contacts support about access, deletion, or integration issues.
2. Purpose and data minimization
Orders support fulfillment and internal sales orders. Returns and refunds support after-sales review. Inventory and SKU data support warehouse reconciliation. Advertising performance data supports campaign reporting, cost reconciliation, and product-level operational analysis. Event metadata supports delivery troubleshooting and duplicate protection.
3. Authorization and access
A seller must authorize the application and must have authority to connect the relevant shop. Authorization callbacks are handled by the server-side API boundary. Production tokens and secrets must remain in protected server-side storage and must not be placed in browser storage. Production dashboard access must be restricted through authenticated roles.
4. Security controls
- Public website, dashboard, and API endpoints are served over HTTPS.
- Webhook payloads are bounded by a request-size limit.
- Event identifiers are used as the basis for idempotency and replay protection in production.
- Operational access is limited to authorized personnel and service accounts.
5. Retention and deletion
Records are retained only while needed for seller operations, dispute handling, troubleshooting, audit, or legal obligations. A seller may request disconnection, access, correction, or deletion by emailing support. We will verify the requester's authority before taking action and will explain any record that must be retained for a legal or security reason.
6. Service providers and transfers
The application may use hosting, networking, monitoring, and email infrastructure needed to operate the service. Access is limited to the purpose of providing or protecting the service. The operator is responsible for selecting and configuring providers appropriate to the seller data involved.
7. Incident contact
Report suspected unauthorized access, data exposure, or account connection issues immediately to support@jbscc.shop. Include the shop reference and a description of the issue, but do not email passwords, access tokens, or private keys.
8. Scope of this public demo
The public dashboard uses synthetic records. It demonstrates the review workflow and does not claim that production token exchange, persistent ERP synchronization, live advertising synchronization, or live webhook signature validation has been completed.