Privacy Policy

Last updated: 2026-10-01

This Privacy Policy describes how YoiYee (operated by Shenzhenshi Canhuan Xinxijishu Youxiangongsi, hereafter “we”, “us”, “our”) collects, processes, stores, uses, shares, and disposes of data obtained through the Amazon Selling Partner API (“SP-API”), and personal data collected through our website, www.yoiyee.com (see section 10).

1. Who We Are

YoiYee is a UK-focused Amazon brand owned and operated by Shenzhenshi Canhuan Xinxijishu Youxiangongsi, a limited company registered in China. Sections 1 to 9 of this Privacy Policy apply to data accessed via SP-API for the purpose of managing our own Amazon seller operations. Our SP-API integration is an internal operations system used only by us; we do not offer services to other Amazon sellers and have no public API or multi-tenant architecture.

2. Information We Collect

Through SP-API, we retrieve the following categories of information:

Product and listing data: SKUs, ASINs, titles, prices, images, inventory levels
Order data: Order IDs, order status, shipping service level, marketplace, item-level details, tracking numbers, IOSS numbers, tax registration details (where provided)
Financial data: Amazon settlement reports, referral fees, FBA fulfilment fees
Advertising data: Campaign performance, keyword performance, ACOS, spend, sales
Buyer Personally Identifiable Information (PII): buyer name, shipping address, contact phone number — obtained via Amazon’s Restricted Data Token (RDT) flow only when required for order fulfilment (shipping label generation or shipping CSV export to contracted logistics carriers)

3. How We Use This Information

Internal operations: inventory management, pricing optimisation, sales analysis, advertising optimisation
Order fulfilment: generating shipping labels and dispatching orders through contracted logistics carriers
Compliance: tax-related record keeping

4. Data Storage and Retention

Persisted data: Non-PII data (SKUs, ASINs, order IDs, order status, financial and advertising metrics) is stored in a SQLite database on an AWS Lightsail instance. The underlying storage volume uses AWS platform-level AES-256 encryption.
Buyer PII: Buyer PII (name, address, phone) is never persisted to our database. It is retrieved via SP-API RDT only at the moment of use, held in process memory during the shipping label or CSV export flow, and cleared from session state upon flow completion.
Backups: Non-PII backups are encrypted (GPG + AES-256) and stored off-site at Cloudflare R2 with 30-day retention. Backups contain no buyer PII.

We share Amazon buyer shipping information with the following contracted logistics carriers solely for the purpose of order fulfilment:

4PX Express (www.4px.com) — buyer name, full shipping address, contact phone, order ID; used to generate shipping labels and deliver orders.
SF Express (www.sf-express.com) — same data fields and purpose as above.

Where Amazon’s Buy Shipping API is available, we route shipments through Amazon directly, keeping buyer PII within the Amazon environment. CSV export to external carriers is used only where Buy Shipping does not cover the required route.

We do not share Amazon Information with advertising networks, analytics providers, AI providers (our internal rules specifically exclude buyer PII from any AI prompt), or any other third party.

6. Security

In transit: TLS 1.2 or higher for all data transmission
At rest: AES-256 storage volume encryption; AES-256-GCM field-level encryption available for sensitive fields
Key management: GPG-backed pass key store; RSA-4096 master key; 20-character passphrase held offline in a secure physical location
Access control: Single-operator access enforced via SSH Ed25519 key-only, Nginx HTTP Basic Auth (bcrypt), Streamlit loopback-only binding (127.0.0.1)
Monitoring: PII access audit logging, daily PII regression canaries, weekly Trivy vulnerability scans, fail2ban SSH brute-force protection

7. Your Rights

You may request access to, correction of, or deletion of any personal data concerning you by contacting us at the address below. We aim to respond within 30 days in accordance with GDPR Article 12. Where the data in question is buyer PII obtained via Amazon SP-API, please note that we do not persist such data, so deletion is automatic.

8. Incident Response

In the event of a data breach affecting Amazon Information, we commit to notifying Amazon Developer Support (security@amazon.com) within 24 hours of confirmed detection, in accordance with the Amazon Data Protection Policy. Affected buyers and regulatory authorities will be notified per GDPR Article 33 (within 72 hours) where applicable.

9. Changes to This Policy

This Privacy Policy may be updated when our data handling practices change. The “Last updated” date at the top of this document reflects the most recent revision. Material changes will be communicated via an updated policy version on this page.

10. Website Visitors and Bulk Quote Enquiries

This section covers personal data we collect through our website, www.yoiyee.com. It is separate from the Amazon SP-API data described in sections 1 to 9.

Information we collect:

Quote enquiries: when you send a bulk quote request, we collect your name, company name, email address, phone number, country, your message, and the products and quantities you ask about.
Server logs: our hosting provider records technical information for each request to the website, such as IP address, browser type, the page requested and the time of the request.
Cookies: we use only cookies that are necessary for the website to work, such as keeping your quote list while you browse. We do not use analytics or advertising cookies.

How we use this information and our lawful basis:

To reply to your enquiry and prepare a quotation. Lawful basis: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)).
To keep the website secure and prevent spam and abuse. Lawful basis: our legitimate interests (UK GDPR Article 6(1)(f)).
We do not use enquiry data for marketing unless you ask us to, and we do not sell it.

Who we share it with:

Hostinger, our website hosting provider, which stores the website and its database on servers in the United Kingdom.
Hostinger email (SMTP), which delivers enquiry notifications to our sales team.

International transfers:

We are a company based in China. Our website and its database are hosted in the United Kingdom, and enquiry data is stored there. Our sales team works in China and reads and answers enquiries through the website’s administration area and our business email account, so your enquiry data is accessed from China. The UK has not made adequacy regulations for China, which means China is not recognised as giving the same level of protection as the UK.

We protect your data when it is accessed from China as follows:

Enquiry data stays on our UK-hosted website and in our business email account. We do not copy it into other systems, and we do not pass it to any other organisation in China or elsewhere.
Only the staff who handle enquiries can access it, using password-protected accounts and always over encrypted connections (TLS 1.2 or higher).
We use the data only to answer your enquiry and prepare a quotation, and we delete it after the retention period below.

We access your data from China because this is necessary to respond to the request you send us. Data accessed from China may be subject to Chinese law, including requests from public authorities. You can contact us (section 11) for more information about how we protect your data.

How long we keep it:

Quote enquiries: 24 months after our last contact, then deleted.
Server logs: for the period set by our hosting provider.

Your rights:

You can ask us for access to, correction of, or deletion of your personal data, and you can object to or ask us to restrict how we use it. Contact us using the details in section 11. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).

11. Contact

For privacy-related inquiries:

Email: amazon@yoiyee.com
Organisation: Shenzhenshi Canhuan Xinxijishu Youxiangongsi
Country: China