Privacy Notice

1. Who we are and what this notice covers

Aruna is an e-commerce retailer selling its own products on Amazon.eg and other sales channels.

This notice covers a single internal application we developed to run our own operations, which connects to the Amazon Selling Partner API and the Amazon Advertising API.

2. Data we access

We retrieve only data belonging to our own Amazon seller accounts:

3. How we use the data

Use is limited to running our own internal business operations:

• Pricing — calculating selling prices and their minimum and maximum bounds from cost, referral fees and fulfilment fees.
• Inventory planning — determining replenishment quantities and preparing shipments.
• Accounting reconciliation — matching sales, fees and bank transfers against our records.
• Advertising analysis — measuring return on ad spend and allocating budget.
• Management reporting — monitoring product and account performance.

There is no other use. We do not use this data for third-party advertising, for training models, or for any purpose outside operating our own business.

4. Sharing with third parties

The only exception is infrastructure providers that host our data on our behalf under data processing terms: Google Workspace (storage and processing) and Amazon Web Services (API connectivity). They do not use the data for their own purposes.

We may disclose data where legally compelled by a competent authority, limited to what is required.

5. Storage and security

• In transit: all communication over HTTPS/TLS only.
• At rest: data stored in Google Workspace on our company domain, encrypted at rest.
• Multi-factor authentication is mandatory on every account with access, without exception.
• Documented password policy: minimum 12 characters, mandatory rotation every 365 days, no sharing between individuals.
• Least privilege: every account holds only the minimum permissions required.
• Endpoint protection: firewall, anti-virus and intrusion detection enabled on every device with access.
• Secrets: access keys and tokens are kept in a secret store excluded from any code repository, and are never written inside scripts.
• Logging: all sign-ins and access are logged and reviewed, and permissions are reviewed every 6 months.

6. Security incident response

We maintain a written, approved incident response plan with defined roles and binding timelines: immediate containment, assessment within 4 hours, full remediation within 72 hours, and a written post-incident review within 7 days.

In the event of any security incident affecting Amazon data, we notify security@amazon.com within 24 hours. This is a binding obligation.

7. Retention and deletion

We retain data only for as long as necessary to operate our business and meet our accounting and legal obligations, after which it is deleted.

We may revoke the application's authorization from within Seller Central at any time, which stops access immediately.

8. Your rights

For any question about the data we handle, or to request access, correction or deletion, contact us at mhnd@arunanet.com and we will respond within a reasonable period.

9. Changes to this notice

If we make a material change, we will update the version number and effective date at the top of this page. The version published here is the version in force.

10. Contact