Effective Date: October 15, 2026 Version: 1.0 Applies to: All Sellers who hold an Account on the Platform, and each person the Seller authorizes to use the Account.
Article 1: Introduction and Scope
1.1 This document states the Seller's duties for the security of the Seller's Account: the credentials the Seller shall maintain, the access the Seller may grant to other persons, the handling of API credentials, the audit record of activity on the Account, and the action the Seller shall take on a suspected compromise. The Seller is liable for activity conducted through the Account as provided in Article 4.
1.2 If a provision of this document conflicts with the Terms of Use, this document controls for the subject it governs. If a provision of this document conflicts with the terms of a program in which the Seller participates, the program terms control for that program. Policies and help pages explain this document; they do not amend it, and in any conflict this document prevails.
Article 2: Definitions
2.1 The definitions in the Selling Terms of Service apply to this document. In addition, in this document 2.2 Authorized User: a person the Seller has authorized to use the Account through a separate user record under Article 4, with an assigned role and an active status.
2.3 Credentials: the passwords, authentication factors, API keys, and other secrets by which access to the Account is obtained.
2.4 Primary Account: the Seller's principal user record for the Account, which carries the authority to change disbursement details, add and remove Authorized Users, and accept policy changes.
2.5 Two-Factor Authentication: authentication requiring, in addition to a password, a second factor from an authenticator application or a hardware key, or, where neither is available, a code sent by text message.
Article 3: Credential Duties
3.1 The Seller shall use a unique, strong password for the Account: unique, in that it is used for no other service; and strong, in that it is not guessable and has not previously been exposed in a breach. Reuse of one password across the Seller's email, banking, and Account makes a single breach a breach of all three.
3.2 Two-Factor Authentication is required on the Primary Account. It is a condition of holding the Account, not a recommendation. The Primary Account can change disbursement details, add Authorized Users, and accept policy changes, and a password alone does not protect it. Two-Factor Authentication shall be by authenticator application or hardware key; text-message codes may be used only where nothing stronger is available, and a Seller that chooses text-message codes accepts the known risk of SIM substitution that attends that method.
3.3 The Credentials of the Primary Account shall not be shared with any person. Every person who operates the Account shall do so as an Authorized User under Article 4. A shared login makes it impossible to establish which person acted, and is prohibited for that reason.
Article 4: Authorized Users; Liability for Account Activity
4.1 Each Authorized User record ties one person to the Account with a role and a status. Roles follow least privilege: each person is granted the minimum access the person's work requires. The roles are (a) Fulfilment: view and update Orders, print labels, and mark Orders shipped; no access to pricing, disbursements, or user management;
(b) Listing: create and edit listings and manage inventory; no access to Order refunds or disbursements;
(c) Finance: view statements, balances, and disbursements, and manage disbursement details; no access to listing changes;
(d) Messaging: Buyer communications only; no access to Orders or to the movement of money; and
(e) Admin: all functions, including adding and removing Authorized Users. The Admin role shall be held by as few persons as possible, and by one person where the Seller's operation permits.
4.2 The Seller shall review Authorized User access quarterly. For each active Authorized User, the Seller shall determine whether that person still requires the assigned role. Access for a person whose engagement has ended shall be removed within twenty-four (24) hours of the change in personnel.
4.3 The Seller is responsible for all actions taken through the Seller's Credentials and through Authorized User records, including actions by former personnel whose access the Seller did not revoke. That a former employee performed an act is not a defense where the Seller left the access in place; the audit record under Article 7 shows whose Credentials acted.
Article 5: API Credentials
5.1 API credentials are secrets of the same standing as passwords. The Seller shall store them in a secrets manager and shall not place them in a code repository, in a log, in a client-side application, or in a chat or ticket message. A credential committed to a public repository is compromised at the moment it is published, and the Seller shall rotate it immediately.
5.2 The Seller shall rotate API credentials on the departure of any person who could have seen them and on any suspected exposure. Rotation means the old credential is revoked and a new one issued. The Seller shall keep an inventory of where each credential is used, so that rotation reaches every integration.
5.3 API access follows the least-privilege roles in Article 4. An integration that reads Orders is given a credential limited to reading Orders, not an Admin credential. An over-scoped credential is the means by which a compromised listing tool becomes a compromised Account.
Article 6: Sessions and Devices
6.1 The Seller shall sign out of shared or public devices, shall review the Account's active sessions periodically, and shall treat an unrecognized session as an indicator of compromise under Article 8, rotating the Credentials first and investigating second.
6.2 The Seller shall keep the devices used to access the Account updated and free of malware. A compromised device defeats the controls in Articles 3 through 5, and the duty to maintain the Seller's own devices rests on the Seller.
Article 7: Audit Record
7.1 Privileged actions on the Account are recorded in an audit record stating: who acted: the Seller, an Authorized User, or the Company; the action taken; the record affected; the state before and the state after; and the network address from which the action was taken. Changes to disbursement details, additions of Authorized Users, role changes, and policy acceptances are recorded. The audit record is append-only; no entry in it is edited.
7.2 The Seller may request the audit record for the Seller's Account. The audit record is the first source in a compromise or fraud review, including the review of loss allocation under the Payment Fraud Prevention Policy: it shows whether Credentials were shared, whether Two-Factor Authentication was in place, and whether the activity attributed to a compromise is consistent with access by an insider.
7.3 The Company's own access to a Seller's Account is recorded in the same manner, with Company personnel identified as such. Company personnel access a Seller's Account through recorded tooling, not through the Seller's Credentials.
Article 8: Incident Response
8.1 On a suspected compromise of the Account, the Seller shall notify the Company without delay at support@aapawz.com and shall rotate the Account Credentials. Delay extends the attacker's access and the losses that follow from it.
8.2 On notice of a suspected compromise, the Company may suspend the Account pending investigation: listings pause, disbursements are frozen, and sessions are terminated. Suspension during an investigation is protective; it stops further loss while control of the Account is re-established.
8.3 The Seller shall cooperate with the investigation, including by providing access records from the Seller's own systems where relevant, such as email login history, office network records, and the device records of the Seller's personnel and contractors.
8.4 Phishing. The Company does not ask for a password or a Two-Factor Authentication code by email or by message, for verification, for a security check, or on any other ground. A Seller that receives such a request shall not comply with it and shall report it to support@aapawz.com. A disclosure of Credentials in response to such a request is treated as a compromise under clause 8.1: the Seller shall rotate the Credentials, the Company shall investigate, and the Account's recent actions shall be reviewed against the audit record.
8.5 After an incident, re-verification precedes full restoration of the Account: identity re-confirmed, the Designated Payment Account re-confirmed, the Authorized User roster audited, and API credentials rotated. Trading resumes when the Company is satisfied the attacker no longer has access.
Article 9: Two-Factor Authentication Reset
9.1 A reset of Two-Factor Authentication requires identity re-verification under the Business Verification Policy. The Company shall not reset Two-Factor Authentication on the basis of an email request alone.
9.2 The Seller shall keep backup codes or a second enrolled device, so that the loss of a telephone is an inconvenience rather than a loss of access. A Seller with no backup access method waits for full re-verification under clause 9.1.
Article 10: Liability
10.1 Exclusion of certain damages. To the fullest extent permitted by law, neither party is liable to the other for indirect, incidental, special, punitive, or consequential damages, or for lost profits, lost revenue, or loss of goodwill, arising out of or relating to this document, even if the party has been advised of the possibility of those damages.
10.2 Cap. To the fullest extent permitted by law, the Company's total liability arising out of or relating to this document shall not exceed the greater of (a) the amounts the Seller paid to the Company under this document in the twelve months before the event giving rise to the claim, or (b) one hundred dollars ($100).
10.3 Carve-outs. This Article does not limit (a) a party's indemnification obligations under this document; (b) liability for fraud or willful misconduct; (c) amounts the Seller owes for Orders, fees, chargebacks, or refunds under this document; or (d) liability that cannot be limited under applicable law.
10.4 Essential purpose. The parties agree that this Article allocates risk between them, that it is an essential part of the basis of their bargain, and that it applies even if a limited remedy fails of its essential purpose.
Article 11: Indemnification
11.1 Duty. The Seller shall indemnify, defend, and hold harmless the Company and its members, managers, employees, and agents from and against every claim, demand, action, loss, liability, judgment, settlement, cost, and expense (including reasonable attorneys' fees) arising out of or relating to: (a) the Seller's breach of this document; (b) the Seller's Products, Services, listings, or User Content; (c) the Seller's violation of any law or of the rights of any person; and (d) taxes for which the Seller is responsible under this document.
11.2 Procedure. The Company shall give prompt written notice of a claim under this Article. The Seller shall control the defense with counsel reasonably acceptable to the Company. The Company may participate in the defense at its own expense. The Seller shall not settle a claim in a manner that imposes any obligation or restriction on the Company, or that does not release the Company fully, without the Company's prior written consent.
11.3 Survival. This Article survives the termination of this document.
Article 12: Enforcement and Appeals
12.1 Investigation. The Company may investigate any suspected violation of this document. The Seller shall cooperate with an investigation and shall produce the records this document requires the Seller to keep.
12.2 Notice. If the Company determines that the Seller has violated this document, the Company shall give written notice stating the provision violated and the facts relied on, except where notice would compromise an investigation of fraud, a safety risk, or a legal obligation.
12.3 Opportunity to cure. Where a violation is capable of cure, the Seller has ten (10) business days from notice to cure it and to confirm the cure in writing. No cure period applies to fraud, counterfeiting, a risk to the safety of a person or an animal, unlawful conduct, or a violation that by its nature cannot be cured.
12.4 Measures. If a violation is established and is not cured within the period allowed, the Company may, proportionate to the violation: (a) issue a written warning; (b) remove or suppress a listing or content; (c) cancel an Order or a booking; (d) suspend the Account or a program participation, in whole or in part; (e) terminate this document and the Account; and (f) exercise any other right or remedy available under this document or at law.
12.5 Disbursement hold. The Company may hold disbursements to the Seller while an investigation under this Article is pending, and shall release amounts not required to satisfy the Seller's obligations when the investigation closes.
12.6 Appeal. The Seller may appeal a measure under this Article by written notice to legal@aapawz.com within thirty (30) days of the measure, stating the grounds and attaching the records relied on. The appeal is decided by a person who did not make the original decision. The Company's decision on appeal is final. A measure remains in effect during an appeal unless the Company directs otherwise in writing.
12.7 No waiver by delay. The Company's delay in acting on a violation is not a waiver of the violation or of any later violation of the same kind.
Article 13: Term and Termination
13.1 Term. This document takes effect when the Seller accepts it and continues until terminated under this Article.
13.2 Termination by the Company. The Company may terminate this document and the Account on thirty (30) days' written notice for any reason, and immediately on written notice if the Seller materially breaches this document, engages in fraud, or becomes ineligible to participate.
13.3 Termination by the Seller. The Seller may terminate this document on thirty (30) days' written notice to support@aapawz.com, provided the Seller has no Order, booking, or investigation outstanding.
13.4 Effect of termination. On termination: (a) the rights granted under this document end; (b) obligations that arose before termination: including payment, refund, chargeback, record-keeping, and indemnification obligations: survive until satisfied; and (c) the Company shall disburse amounts owed, less amounts the Company may set off under this document, within thirty (30) days, except amounts held in connection with an open investigation or dispute.
13.5 Survival. The Definitions, Liability, Indemnification, Enforcement and Appeals (for measures taken before termination), Dispute Resolution, and General Provisions Articles survive termination.
Article 14: Dispute Resolution
14.1 Any dispute arising out of or relating to this document, or to the relationship it governs, is governed by the Dispute Resolution Policy, which is incorporated into this document by reference.
Article 15: General Provisions
15.1 Amendments. The Company may amend this document by posting the amended document in the Document Center and giving notice to the Seller at the email address in the Account. An amendment that materially increases the Seller's fees or obligations takes effect thirty (30) days after notice; other amendments take effect on posting. Continued use of the Platform after the effective date of an amendment is acceptance of it. If the Seller does not accept an amendment, the Seller's remedy is to terminate under Article 13 before the amendment takes effect.
15.2 Notices. (a) Legal notices under this document shall be sent to legal@aapawz.com. Operational notices and all other communications shall be sent to support@aapawz.com. A notice to the Company is effective when the Company acknowledges receipt or, for email, one business day after sending, whichever is earlier. (b) Notices to the Seller are effective when sent to the email address in the Account or posted to the Account's notice facility in the portal, whichever occurs first. The Seller shall keep the email address in the Account current. (c) DMCA notices are given as provided in the DMCA and Copyright Policy, to the designated agent at legal@aapawz.com.
15.3 Governing law. This document is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws rules. Subject to the Dispute Resolution Policy, any proceeding arising out of this document shall be brought in the state or federal courts located in Shelby County, Tennessee, and the parties consent to personal jurisdiction there.
15.4 Severability. If any provision of this document is held unenforceable, the provision shall be enforced to the fullest extent permitted, and the remaining provisions continue in full effect.
15.5 Entire agreement. This document, together with the documents it incorporates by reference, is the entire agreement between the Company and the Seller for the subject it governs and supersedes every prior or contemporaneous statement, communication, or agreement on that subject, whether written or oral.
15.6 Assignment. The Seller shall not assign this document or any right or obligation under it without the Company's prior written consent, and an assignment without consent is void. The Company may assign this document to an affiliate or in connection with a sale of all or part of its business, on notice to the Seller.
15.7 Waiver. A waiver of any provision of this document is effective only in writing and only for the instance stated. No waiver is a waiver of any other provision or instance.
15.8 Interpretation. Headings are for convenience only. "Including" means "including without limitation." This document shall not be construed against a party as its drafter. The English-language text controls over any translation.
Related articles