Data Use, Retention and Deletion
Effective Date: October 15, 2026 Version: 1.0 Applies to: All Developers and partners who receive, store, or process Platform or End User data through the application programming interface.
Article 1: Introduction and Scope
1.1 This document states the data licence terms for data obtained through the API: the permitted use, the prohibited use, the retention periods, and the deletion and certification duties. Data obtained through the API is licensed for the Application's stated function and for no other purpose.
1.2 If a provision of this document conflicts with the Terms of Use, this document controls for data obtained through the API. If a provision of this document conflicts with the Developer Agreement, this document controls for that data. The Privacy Policy governs the Company's own data practices; where that document and this document both state a duty of the Developer for the same data, the stricter duty applies. Policies and help pages explain this document; they do not amend it.
Article 2: Definitions
2.1 In this document, terms defined in the Developer Agreement have the same meaning, and the Developer shall classify every field the Application touches into one of the following classes. A field that falls in two classes takes the stricter class Aggregate Data: counts, sums, rates, and results computed from Personal Data or Order Data with no reasonable means of identifying an individual, as Article 7 further requires.
Credential Data: a session token, an API key, a token issued under a Grant, a webhook signing secret, and equivalent secret material.
Order Data: an Order identifier, a line item, a quantity, a price, a fulfilment state, a carrier and tracking record, a return and refund record, and a payment record.
Personal Data: a Buyer name, a shipping address, a billing address, an email address, a telephone number, a pet name, and any field from which an individual can be identified, alone or combined with data the Developer already holds.
Article 3: The Data Licence
3.1 Data obtained through the API is licensed, not sold or transferred. The Developer receives only the rights necessary to operate the Application's stated function for the End User who authorized the Application.
3.2 Permitted use is: operating the Application for the authorizing End User, and the administrative functions necessary to that operation, including security monitoring, correction of errors, and billing of that End User.
3.3 The Developer shall not, without exception: (a) sell, rent, license, or otherwise transfer Platform data or End User data to a third party; (b) use Buyer data for advertising, profiling, or marketing unrelated to the Application's function; (c) combine Platform data with third-party data to identify an individual; (d) use Platform data, including Personal Data and Order Data, to train a model of any kind, or provide Platform data to another party for model training; or (e) disclose data to a party not bound by duties at least as protective as this document. Clause 3.3(d) applies to Platform data generally and is not limited to Personal Data.
3.4 Authorization ends when the End User disconnects the Application, when the session or Grant ends or is revoked, when the Developer account is suspended, or when the Application is terminated under the Partner Suspension, Termination and Appeals. The licence in this article ends with the authorization.
Article 4: Live Use and Caching
4.1 The Developer shall obtain the following live on each use and shall not rely on a stored copy: a payment state, an Order fulfilment state, an inventory quantity, a price, and any data on which an End User acts, including a refund, a cancellation, and a shipping label.
4.2 The Developer may store the following for no longer than twenty-four (24) hours: product catalog data, including a title, a description, an image reference, and a category assignment; a shipping rate table; and a tax-rate result. The storage period for catalog data shall appear in the retention statement required by Article 5.
4.3 The Developer shall not retain Credential Data beyond the session or authorization the Credential Data serves. A session for a Seller who has ended the relationship is a breach of this document if retained.
4.4 Event data received under the Webhook Obligations is subject to this document in full.
Article 5: Minimization and the Retention Statement
5.1 The Developer shall request and store only the fields the Application requires. Requesting a full object where a subset suffices is a violation of this document.
5.2 The Developer shall not record a full API response or a full webhook payload in a log. A log shall exclude Credential Data and Personal Data. An Order identifier in a log entry is permitted; an address block is not.
5.3 Each production Application shall file a data-retention statement, as part of registration under the OAuth App Registration and Review or, where that registration does not apply, in writing to support@aapawz.com. The statement shall state, by class in Article 2: what data is stored, where it is stored (region and provider), for how long, and the deletion method. A material change to the statement: a new data class, a new region, or a longer retention: requires re-review before deployment. The Developer shall keep the statement current.
Article 6: Retention Periods
6.1 Personal Data: the Developer shall delete Personal Data within thirty (30) days after the purpose for which it was collected ends, measured from the last legitimate business need and not from collection. Completion of an Order together with the return period, resolution of a support case, and closure of a dispute each mark the end of a purpose, as applicable.
6.2 Order Data: the Developer may retain Order Data required for accounting, tax, or dispute evidence for a maximum of twenty-four (24) months from the transaction date, and shall then delete it or render it irreversibly anonymous.
6.3 Credential Data: the Developer shall destroy Credential Data at the end of the session or authorization it serves, immediately. No retention is permitted.
6.4 Security logs containing Personal Data: maximum twelve (12) months from the time of writing, after which the Developer shall remove the logs by rotation. The Developer shall prefer a log form that contains no Personal Data.
6.5 Aggregate Data: no time limit applies, provided the anonymization method is documented, the Personal Data and Order Data from which the Aggregate Data was derived is deleted in accordance with clauses 6.1 and 6.2, and no reasonable means of identifying an individual remains. An aggregate drawn from fewer than five (5) individuals, or drawn from the Buyers of a single Seller in a manner that permits identification, is not Aggregate Data and remains Personal Data or Order Data, as applicable.
Article 7: Deletion
7.1 Deletion means irreversible removal: from live databases, from search indexes, from caches within their purge periods, from logs within the twelve (12) month rotation in clause 6.4, and from backups within the backup rotation in clause 7.4. A flag on a retained row does not satisfy this article; deletion is a state of the data, not a mark on a record.
7.2 The default method is complete removal of the row, the object, or the key, as applicable to the store concerned.
7.3 A retained evidence record: a record that data once existed, kept only for fraud, abuse, or legal-hold evidence: is permitted only where every condition is met: (a) the record contains no Personal Data and contains identifiers only, namely an Order identifier, a time, and a reason code; (b) access is restricted to the Developer's security and legal roles; (c) the record itself is deleted or rendered anonymous no later than twenty-four (24) months after creation; and (d) the reason is documented in the retention statement.
7.4 Backups are removed by rotation and are not edited individually. The Developer shall: (a) keep backup retention at or under ninety (90) days; (b) document that deleted Personal Data ceases to exist as rotation proceeds; (c) not restore deleted Personal Data into a live system from a backup: a restoration that returns data the Company or a Buyer required to be deleted is a new violation; and (d) on any restoration, re-apply the deletion queue to every record the restoration returned. Destruction of the encryption key for an encrypted backup satisfies this clause where direct deletion is impractical, provided the destruction is recorded and is irreversible.
7.5 If Personal Data enters a log contrary to clause 5.2, the log entry takes the twelve (12) month period in clause 6.4, and the Developer shall correct the logging procedure within thirty (30) days of discovery.
7.6 Deletion of source rows does not delete Aggregate Data derived from those rows. The Developer shall document, for each aggregate, whether deletion of source rows requires recomputation or suppression. An aggregate that reveals a deleted individual's data on examination in detail shall be recomputed without that individual within the same thirty (30) day period as clause 6.1.
7.7 The Developer shall impose Articles 2–6 of this document on every subprocessor in writing, shall keep a current subprocessor list, and remains fully responsible for a subprocessor's compliance. A subprocessor breach is the Developer's breach for notice purposes under the Breach Notification Requirements.
Article 8: Deletion Triggers and Certification
8.1 Disconnection. When an End User disconnects the Application or a session or token is revoked, the Developer shall delete that End User's Personal Data within thirty (30) days. Data the Developer is required by law to retain shall be isolated, access-restricted, and kept no longer than the legal requirement.
8.2 Buyer request. A Buyer who asks an Application to delete the Buyer's data exercises a right that concerns Platform data as well. The Developer shall: (a) forward the request to the Company at support@aapawz.com within five (5) business days, with the Buyer identifier and the scope of the request; (b) complete the Developer's own deletion within thirty (30) days; and (c) certify completion to the Buyer and to the Company. The Developer shall not delay a request pending internal legal review; delay is the violation.
8.3 Suspension or termination. On suspension or termination under the Partner Suspension, Termination and Appeals: the Developer shall delete all Platform-sourced Personal Data and Order Data within thirty (30) days and all Credential Data immediately, and shall deliver a written deletion certification within forty-five (45) days. The certification shall state what was deleted, by what method, what remains under legal hold with the basis and expiry of the hold, and the backup rotation date by which the last copies cease to exist. The certification shall be signed by an officer or equivalent representative of the Developer. A false certification is fraud. A missing or evasive certification is a continuing violation.
8.4 Data obtained in violation of the Scraping Prohibition is subject to deletion under that document in addition to this article, and later deletion does not cure the violation by which the data was obtained.
Article 9: Audit
9.1 The Company may audit the Developer's data practices on fifteen (15) days' notice, or immediately on evidence of misuse. The Developer shall produce within the notice period: the retention statement, deletion logs, the subprocessor list, evidence of certifications under Article 8, and the anonymization documentation required by clause 6.5. The Developer shall keep the records that make an audit possible: what was collected, from which Calls, under which Grant, and when deletion occurred. An audit that finds no records is itself a finding.
9.2 Refusal to cooperate with an audit, or production of records the Developer knows to be incomplete, is a material breach independent of the underlying data practice.
9.3 A finding of retention beyond a period in Article 6 carries a cure period of fifteen (15) days for a first finding, and escalates on repetition, in accordance with Article 12.
Article 10: Liability
10.1 Exclusion of certain damages. To the fullest extent permitted by law, neither party is liable to the other for indirect, incidental, special, punitive, or consequential damages, or for lost profits, lost revenue, or loss of goodwill, arising out of or relating to this document, even if the party has been advised of the possibility of those damages.
10.2 Cap. To the fullest extent permitted by law, the Company's total liability arising out of or relating to this document shall not exceed the greater of (a) the amounts the Developer paid to the Company under this document in the twelve months before the event giving rise to the claim, or (b) one hundred dollars ($100).
10.3 Carve-outs. This article does not limit (a) a party's indemnification obligations under this document; (b) liability for fraud or willful misconduct; (c) amounts the Developer owes for Orders, fees, chargebacks, or refunds under this document; or (d) liability that cannot be limited under applicable law.
10.4 Essential purpose. The parties agree that this article allocates risk between them, that it is an essential part of the basis of their bargain, and that it applies even if a limited remedy fails of its essential purpose.
Article 11: Indemnification
11.1 Duty. The Developer shall indemnify, defend, and hold harmless the Company and its members, managers, employees, and agents from and against every claim, demand, action, loss, liability, judgment, settlement, cost, and expense (including reasonable attorneys' fees) arising out of or relating to: (a) the Developer's breach of this document, including sale, disclosure, or retention of data in violation of this document; (b) the Developer's Applications and content; (c) the Developer's violation of any law or of the rights of any person, including a data-subject right; and (d) taxes for which the Developer is responsible under this document.
11.2 Procedure. The Company shall give prompt written notice of a claim under this article. The Developer shall control the defense with counsel reasonably acceptable to the Company. The Company may participate in the defense at its own expense. The Developer shall not settle a claim in a manner that imposes any obligation or restriction on the Company, or that does not release the Company fully, without the Company's prior written consent.
11.3 Survival. This article survives the termination of this document.
Article 12: Enforcement and Appeals
12.1 Investigation. The Company may investigate any suspected violation of this document, including by audit under Article 9. The Developer shall cooperate with an investigation and shall produce the records this document requires the Developer to keep.
12.2 Notice. If the Company determines that the Developer has violated this document, the Company shall give written notice stating the provision violated and the facts relied on, except where notice would compromise an investigation of fraud, a safety risk, or a legal obligation.
12.3 Opportunity to cure. Where a violation is capable of cure, the Developer has ten (10) business days from notice to cure it and to confirm the cure in writing, except that a retention finding under clause 9.3 has the fifteen (15) day cure period stated there. No cure period applies to sale of data, to use in violation of clause 3.3, to disclosure of Credential Data, to knowing retention after termination, to fraud, or to a violation that by its nature cannot be cured.
12.4 Measures. If a violation is established and is not cured within the period allowed, the Company may, proportionate to the violation: (a) issue a written warning; (b) suspend or revoke a Credential or a Grant; (c) suspend the Application, the Account, or a program participation, in whole or in part, with immediate suspension available for a violation described in clause 12.3 for which no cure period applies; (d) terminate this document and the Account; and (e) exercise any other right or remedy available under this document or at law. Procedure is further governed by the Partner Suspension, Termination and Appeals.
12.5 Appeal. The Developer may appeal a measure under this article by written notice to legal@aapawz.com within thirty (30) days of the measure, stating the grounds and attaching the records relied on. The appeal is decided by a person who did not make the original decision. The Company's decision on appeal is final. A measure remains in effect during an appeal unless the Company directs otherwise in writing.
12.6 No waiver by delay. The Company's delay in acting on a violation is not a waiver of the violation or of any later violation of the same kind.
Article 13: Term and Termination
13.1 Term. This document takes effect when the Developer first obtains data through the API and continues until terminated under this article or until the Developer Agreement terminates, whichever occurs first. The deletion and certification duties in Articles 7 and 8 continue after the Term until satisfied.
13.2 Termination by the Company. The Company may terminate this document on thirty (30) days' written notice for any reason, and immediately on written notice if the Developer materially breaches this document, engages in fraud, or becomes ineligible to participate.
13.3 Termination by the Developer. The Developer may terminate this document on thirty (30) days' written notice to support@aapawz.com, provided the Developer has no investigation outstanding and has completed the deletion and certification duties that termination triggers.
13.4 Effect of termination. On termination: (a) the data licence in Article 3 ends; (b) the Developer shall delete data and certify deletion in accordance with clause 8.3; (c) obligations that arose before termination survive until satisfied; and (d) the Company shall pay amounts owed, less amounts the Company may set off under this document, within thirty (30) days, except amounts held in connection with an open investigation or dispute.
13.5 Survival. The Definitions, Liability, Indemnification, Enforcement and Appeals (for measures taken before termination), Dispute Resolution, and General Provisions articles survive termination, together with Articles 6, 7, and 8 until the duties stated there are satisfied.
Article 14: Dispute Resolution
14.1 Any dispute arising out of or relating to this document, or to the relationship it governs, is governed by the Dispute Resolution Policy, which is incorporated into this document by reference.
Article 15: General Provisions
15.1 Amendments. The Company may amend this document by posting the amended document in the Document Center and giving notice to the Developer at the email address in the Account. An amendment that materially increases the Developer's fees or obligations takes effect thirty (30) days after notice; other amendments take effect on posting. Continued use of the Platform after the effective date of an amendment is acceptance of it. If the Developer does not accept an amendment, the Developer's remedy is to terminate under Article 13 before the amendment takes effect.
15.2 Notices. Legal notices under this document shall be sent to legal@aapawz.com. Operational notices, including a forwarded Buyer request under clause 8.2 and a retention statement under clause 5.3, and all other communications shall be sent to support@aapawz.com. A notice to the Company is effective when the Company acknowledges receipt or, for email, one business day after sending, whichever is earlier. Notices to the Developer are effective when sent to the email address in the Account or posted to the Account's notice facility in the portal, whichever occurs first. The Developer shall keep the email address in the Account current. DMCA notices are given as provided in the DMCA and Copyright Policy, to the designated agent at legal@aapawz.com.
15.3 Governing law. This document is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws rules. Subject to the Dispute Resolution Policy, any proceeding arising out of this document shall be brought in the state or federal courts located in Shelby County, Tennessee, and the parties consent to personal jurisdiction there.
15.4 Severability. If any provision of this document is held unenforceable, the provision shall be enforced to the fullest extent permitted, and the remaining provisions continue in full effect.
15.5 Entire agreement. This document, together with the documents it incorporates by reference, is the entire agreement between the Company and the Developer for the subject it governs and supersedes every prior or contemporaneous statement, communication, or agreement on that subject, whether written or oral.
15.6 Assignment. The Developer shall not assign this document or any right or obligation under it without the Company's prior written consent, and an assignment without consent is void. The Company may assign this document to an affiliate or in connection with a sale of all or part of its business, on notice to the Developer.
15.7 Waiver. A waiver of any provision of this document is effective only in writing and only for the instance stated. No waiver is a waiver of any other provision or instance.
15.8 Interpretation. Headings are for convenience only. "Including" means "including without limitation." This document shall not be construed against a party on the ground that the party prepared it. The English-language text controls over any translation.