UION XERP · Shenzhen Yuxiong Technology Co., Ltd.

Privacy policy

Updated: October 24, 2026

This policy explains how Shenzhen Yuxiong Technology Co., Ltd. handles account information, seller-authorized Amazon data, and buyer personal information in UION-XERP.

1. Scope and processing roles

This policy applies to the public portal, account and team services, ERP workbench, and related support operated by Shenzhen Yuxiong Technology Co., Ltd. Sellers determine their account authorization and order-processing purposes. We process data for the authorizing seller only within approved SP-API roles, seller authorization, and applicable law. Publishing this policy does not grant access to restricted Amazon data.

2. Sources and data categories

Amazon orders, items, catalog information, statuses, and customization content come from SP-API, Amazon-provided customization files, or the seller's own imported Amazon order exports. YunExpress and Yanwen supply labels, tracking, and delivery updates for corresponding shipments. We do not obtain Amazon datasets from data brokers, data marketplaces, or scraping services. Data includes account contacts, authorization credentials, security logs, order identifiers, ASINs, SKUs, quantities, customization selections, uploaded images, personalized text, production files, and review records. Shipping data includes recipient names, addresses, and necessary contact details. Photos, personalized text, customization ZIPs, production images, labels, and delivery proofs may contain personal information; excluding shipping details does not make them anonymous.

3. Purposes and minimization

Authorized order and customization data supports synchronization, product and design-scheme matching, production images, human review, production export, and the seller's own sales analysis. Shipping recipient information is used only for address verification, shipment creation, labels, delivery, and necessary delivery-exception handling, not production-image generation or sales analysis. We request only the data required for each function. We do not sell Amazon information or use buyer information for advertising, unrelated marketing, profiling across unrelated sellers, or data resale. Account contacts support service communications, security, and lawful requests.

4. Storage and access protection

Alibaba Cloud servers host XERP services and databases; Alibaba Cloud OSS stores business files. Service access uses HTTPS/TLS. Private-file access requires server-side identity, tenant, and permission checks before a short-lived signed URL is issued. Sensitive business credentials are encrypted server-side and are not returned in ordinary business responses. Tenant isolation, individual identities, and role/action permissions restrict access. Complete recipient details, telephone numbers, labels, and delivery proofs require explicit shipping-data permissions; ordinary order, artwork-review, or sales access does not grant them. Signed-link expiry does not delete downloaded files. Staff must not copy personal information to unapproved devices or locations.

5. External recipients and transfers

Alibaba Cloud processes information needed to host XERP services and databases and store business files in OSS. YunExpress or Yanwen receives necessary recipient, address, contact, and package details through HTTPS APIs only when selected by the seller for shipping, labels, delivery, and tracking. When image processing is enabled, customization images and necessary instructions are sent directly to the OpenAI API over HTTPS for background removal or other selected production-image operations; shipping recipient information and Amazon credentials are not appended. Images and instructions may themselves contain personal information. Results are used for the corresponding order and reviewed by staff. This disclosed route does not use OpenRouter or other model-routing intermediaries. Sharing is limited to the relevant service and must comply with applicable service terms, data-protection arrangements, and Amazon policies. Enabling a feature does not authorize unrestricted sharing. New recipients or changed purposes require review of the lawful basis, data scope, retention, and notices. Legally required disclosures are limited to necessary information.

6. Retention, deletion, and backups

This policy requires Amazon buyer PII to be retained only as long as necessary for the authorized purpose and no longer than 30 calendar days after order delivery. Longer retention is permitted only when applicable law requires it, with the legal basis, scope, and duration recorded and the data segregated. Routine after-sales needs, open cases, or service contracts do not automatically extend retention. Deletion covers recipient records and PII-containing customization materials, ZIPs, production images, labels, proofs, temporary files, caches, and copies. Database and object deletion must be handled separately; expiring links, rolling back application versions, or deleting addresses alone is insufficient. Non-personal statistics may be retained only as necessary and without identifying buyers. Backups and archives containing Amazon information are subject to access restrictions, encryption, and deletion deadlines and must not extend retention. Restoration must account for revoked authorizations and deletion records before data returns to business use. Only legally required exceptions may enter segregated archives, not routine operations. Relevant Amazon information and surviving copies must be securely deleted within 30 days of the earliest of an Amazon deletion notice, seller revocation or termination of access, loss of our authority to process, or termination of participation in the relevant service, except where retention is legally required. Revocation stops new retrieval under that authorization.

7. Cross-border processing

Processing locations depend on the actual Alibaba Cloud deployment and storage regions, delivery destinations, and selected providers, including OpenAI's service arrangements. Data may be processed within or outside China; we do not promise that all data remains in one country. Cross-border processing requires review of the applicable lawful basis, notices, and safeguards. An authorized Amazon Marketplace does not itself determine the storage location.

8. Requests and seller choices

Sellers can revoke authorization through Amazon and contact us to request access, correction, deletion, or restriction. We verify identity, authority, and scope and handle requests under applicable law and Amazon policy. Any legally required retention must have an explained basis and duration. Buyers may exercise applicable rights through their seller or by contacting us directly.

9. Security incidents

Incidents involving Amazon information require immediate containment, evidence preservation, impact investigation, remediation, and recovery. Amazon must be notified at security@amazon.com within 24 hours of detection, without waiting for the investigation to finish; updates follow as facts become available. Notifications to individuals and authorities follow applicable law.

10. Updates and contact

We update this policy and its date when recipients, purposes, or retention rules materially change and provide notice where required. Updated: October 24, 2026. For privacy requests, deletion, or security incidents, contact support@ionmm.com or +86 198 7678 7974.