Privacy & Security Policy

Teko is software for Amazon sellers, built and operated by Cuesta Brands LLC ("we," "us," or "our"), a privately held company based in the United States. Teko is accessible at ops.tekohand.com.

Teko is offered to Amazon sellers generally — it is not limited to our own seller accounts. Any Amazon seller can connect their own Amazon account to Teko, with their permission, through Amazon's own OAuth authorization process. Every data handling and security practice described in this policy applies equally to every seller account connected to Teko, whether that seller is Cuesta Brands or an independent, unaffiliated seller.

This policy is designed to comply with Amazon's Data Protection Policy and applicable data protection laws in the regions where our connected sellers and their customers are located, including the CCPA and the GDPR, across all Amazon marketplaces we support, including the United States, Canada, the European Union, and the United Kingdom.

Teko connects to Amazon's Selling Partner API (SP-API) and the Amazon Ads API through each seller's own individual Amazon authorizations, granted directly by that seller through Amazon's account-authorization process. We never access a seller's Amazon account without that seller's explicit authorization. Through these connections, we access the following categories of Amazon data for each connected seller:

• Product listing data (ASIN catalog, listing health, content status)
• Pricing and Buy Box data for the seller's own ASINs
• FBA inventory levels, inbound shipments, and fulfillment metrics
• Order data, including buyer shipping addresses for FBM orders the seller fulfills directly
• Settlement and financial data (fees, revenue, disbursements)
• Account health metrics and performance notifications
• Amazon Advertising data — campaign, keyword, and search-term performance for the seller's own campaigns, via the Amazon Ads API
• Brand Analytics data (Search Query Performance and Market Basket) for the seller's own brands
• Tax-related transaction data for invoicing and sales tax compliance
• Buyer contact information for compliant post-purchase communication

We do not support Vendor Central, Amazon Business, or Global Selling programs at this time — Teko supports Fulfilled by Amazon (FBA) and Fulfilled by Merchant (FBM) sellers only. We also use non-Amazon, publicly available market and competitor data from third-party research tools (such as Keepa and Jungle Scout) to inform pricing and market insights — this never includes Amazon Information or any other seller's private data.

We access Amazon Information strictly through the official Amazon Selling Partner API and Amazon Ads API, using our registered developer credentials. We do not use web scraping, third-party data brokers, or any other non-official source to obtain Amazon Information. The market and competitor research data described above (Keepa, Jungle Scout) is separate, publicly available third-party data — never Amazon Information, and never a substitute for it.

All Amazon data accessed via Teko is used exclusively for operational management of the specific Amazon seller account it came from:

• Order fulfillment — Buyer shipping addresses are used solely to generate shipping labels for FBM orders the seller fulfills directly.
• Tax compliance — Transaction-level data is used to generate tax invoices and calculate sales tax obligations for the seller.
• Inventory and pricing insights — Sales velocity, pricing, and inventory data inform the insights, alerts, and recommendations Teko shows to that seller.
• Account monitoring — Account health, listing status, and financial data are surfaced in that seller's own Teko dashboard.
• Buyer communication — Compliant post-purchase messages and review solicitation sequences are sent through Amazon's messaging system only.
• AI-generated insights — Sales, inventory, and account data derived from a seller's Amazon account may be used to generate AI-written insights and recommendations shown to that seller (see Section 12 for how this works).

We do not use Amazon data for resale, or for any purpose beyond operating the specific seller account it came from. Where a seller uses Teko's advertising management, we use that seller's own advertising data — through the Amazon Ads API — solely to run that same seller's own campaigns; this is a first-party use inside the seller's own account, not a share with any outside advertiser, ad network, or data broker. Data belonging to one seller is never used to advertise for, benefit, profile, train shared models for, or inform decisions for a different seller on the platform.

In plain terms: this data is what powers the dashboards, insights, and — only with that seller's permission — the automated actions that are the actual product Teko provides to each connected seller.

We access buyer PII only where required for the specific operational purposes described above — primarily shipping label generation (buyer name and address) and tax invoicing (transaction-level data).

Buyer PII is:

• Accessed only by authorized Cuesta Brands personnel, and by that seller through their own Teko account, on a specific operational need basis
• Never sold, never shared with advertising platforms, marketing services, or data brokers
• Never used for purposes beyond the immediate fulfillment or compliance task
• Encrypted at rest using AES-256 and in transit using TLS
• Subject to access controls enforced at the database layer via Row-Level Security (RLS)

PII in Testing and Development

Production Amazon Information, including buyer PII, is never used in test or development environments. All testing uses synthetic or anonymized data that does not contain real buyer information. Our staging environment is fully isolated from production data and infrastructure.

What Happens When You Disconnect or Cancel

If a seller disconnects their Amazon account or cancels their use of Teko, all of that seller's data — including any cached Amazon Information — is deleted from our production systems within 30 days of disconnection, except where a longer retention period is required for tax, legal, or Amazon recordkeeping obligations. A seller can also request deletion sooner by contacting us directly (see Contact, below).

Our application is hosted on Vercel's serverless infrastructure, which provides a Web Application Firewall (WAF), DDoS mitigation, and network isolation at the platform layer. Our database (Supabase / Postgres) is network-isolated and not publicly accessible — every connection requires application-layer authentication, and no database ports are exposed to the internet.

Production access is restricted to authorized personnel via authenticated API calls only. There is no direct database access from developer machines, and no standing SSH or VPN path into production infrastructure.

All personnel with Amazon Information access are individually authenticated via Supabase Auth using unique credentials — shared credentials are prohibited. Multi-factor authentication (MFA) is mandatory for every account.

Access is enforced at the database layer via Row-Level Security (RLS) policies that restrict each user to only the data their specific role requires — a strict need-to-know model, not blanket access. Access rights are reviewed whenever a team member's role changes, and revoked immediately upon offboarding.

Personal Devices & Removable Media

Our application is entirely web-based. All Amazon Information is stored in Supabase and accessed only through authenticated browser sessions — there is no mechanism in the application to export or download data to local devices, USB drives, or personal cellphones. API tokens are stored server-side and are never exposed to the client in an exportable form.

Supabase audit logs capture every data access event. Our monitoring stack (Sentry + Supabase) alerts authorized personnel if unusual access patterns or authentication anomalies are detected, so any attempt to move data outside authorized channels would surface immediately.

In plain terms: your data lives in two places — Supabase, our database provider, and Vercel, our application hosting provider — and it is encrypted both in transit (TLS) and at rest (AES-256).

Encryption at Rest

Amazon Information is stored in Supabase (Postgres), which encrypts all data at rest using AES-256. Encryption keys are managed by Supabase's Key Management System (KMS) using hardware security modules (HSMs) with automatic key rotation. Application-level sensitive values (API credentials, tokens) are separately encrypted using AES-256 before storage and managed via Vercel's encrypted environment variable system.

Backups & Disaster Recovery

Supabase maintains automated encrypted backups with geographic redundancy across multiple AWS availability zones, retained for a minimum of 30 days. Backup data is protected with the same AES-256 encryption as primary storage.

Restore procedures are documented and tested periodically, with a target Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 24 hours.

Infrastructure Summary

• Application hosting: Vercel — serverless infrastructure with WAF, DDoS protection, and TLS enforcement on all connections.
• Database: Supabase (PostgreSQL) — network-isolated, AES-256 encrypted at rest, HSM-backed key rotation.
• Backups: Automated, encrypted, geographically redundant across AWS availability zones, retained 30 days.

All database access, authentication events, and data modifications are captured in Supabase's built-in audit logs. Application-level errors and anomalies are monitored via Sentry with real-time alerting, and Vercel provides request and deployment logs.

Audit logs are reviewed bi-weekly for suspicious activity and retained for a minimum of 12 months. Automated alerts notify authorized personnel of authentication failures, unusual access patterns, and system errors as they occur.

In the event of a suspected database compromise, unauthorized access, or data leak, we follow a defined response plan:

1. Detect and confirm the incident via audit log review.
2. Revoke affected credentials and API keys via Supabase and Seller Central.
3. Isolate the compromised access path.
4. Assess the scope of exposure via audit logs and Sentry.
5. Notify Amazon at security@amazon.com within 24 hours of detection.
6. Notify affected individuals as required by applicable law.
7. Remediate the root cause and document findings.
8. Conduct a post-incident review and implement preventive controls.

All accounts with access to systems handling Amazon Information require a minimum 12-character password with uppercase, lowercase, numbers, and special characters. MFA via authenticator app is mandatory. Passwords expire every 90 days, with a full annual rotation review. Individual credentials are required — shared passwords are prohibited. This policy is enforced via our identity provider (Supabase Auth), and access is revoked immediately upon personnel offboarding.

All credentials and API keys are stored in Vercel's encrypted environment variable system and are never committed to source code repositories — all .env files are excluded from version control via .gitignore. API keys are rotated on a scheduled basis and immediately upon any suspected compromise. Access to production credentials is restricted to authorized personnel only and reviewed regularly.

Application code is scanned for known vulnerabilities before every release via automated scanning (Snyk / GitHub security scanning). Critical findings block deployment until resolved. Runtime vulnerability monitoring is handled by Sentry, and all third-party dependencies are reviewed for known CVEs as part of our CI/CD pipeline.

Findings from vulnerability scans and penetration tests are logged in our internal project tracking system with assigned owners, severity classifications, and remediation targets aligned to Amazon's requirements: 7 days for critical findings, 30 days for high severity findings. Progress is tracked through our CI/CD pipeline and reviewed weekly.

We do not sell or rent Amazon Information, and we do not share it with third-party advertisers, marketing platforms, or data brokers. (Managing a seller's own Amazon Advertising campaigns through the Amazon Ads API is a first-party action inside that seller's own account — not a share of their data with an outside party.) To operate Teko, a limited set of infrastructure and service providers process data on our behalf, each bound by a data processing agreement, and none of them may use your data for their own purposes or to train shared models:

• Vercel — application hosting
• Supabase — database and storage
• Sentry — technical error monitoring only; used to catch bugs and outages, never for advertising, profiling, or resale
• Trigger.dev — background job processing (for example, syncing Amazon data on a schedule); processes data only to run these jobs on our behalf
• Amazon Web Services (AWS / SQS) — used to ingest Amazon Marketing Stream data as part of our SP-API integration
• Third-party AI provider — sales, inventory, and account data derived from a seller's Amazon account is sent to a third-party AI provider solely to generate the AI-written insights and recommendations Teko shows that seller. This data is used only to generate that seller's own insights — it is never used to train shared models and is never shared with any other party or seller.

Because Teko is used by multiple, independent sellers, each seller's data is logically isolated at the database layer via Row-Level Security (RLS), scoped so that one seller's data, credentials, and analytics are never visible to, combined with, or used to inform decisions for another seller.

If You Are an Amazon Buyer

Because Teko processes data related to the Amazon orders and operations of the seller accounts connected to it, buyer data is handled in accordance with Amazon's Buyer-Seller Messaging policies and applicable privacy laws including CCPA and relevant state statutes. If you are an Amazon buyer and have questions about how your data was used in connection with an order from a seller using Teko, please contact us at the email address below.

If You Are a Connected Seller

If your Amazon account is connected to Teko, you can contact us at any time to request a copy of the data we hold about your account, ask us to correct inaccurate information, or have your data deleted (including on disconnection — see Section 4). We will respond to any such request within 30 days.

Our Role: Controller and Processor

For each connected seller's Amazon account data, that seller is the data controller and Cuesta Brands LLC acts as a data processor, handling data strictly on the seller's instructions and for the purposes described in this policy. For data about Cuesta Brands' own accounts and personnel, Cuesta Brands LLC acts as the data controller.

Legal Basis for Processing (GDPR)

Teko operates across all Amazon marketplaces we support, including the European Union and the United Kingdom. Where the General Data Protection Regulation (GDPR) applies — including where a connected seller, its customers, or its buyers are located in the European Economic Area (EEA), the UK, or Switzerland — we process personal data on the following legal bases:

• Performance of a contract: processing a seller's Amazon data to provide the Teko service the seller has engaged us for.
• Legitimate interests: securing our systems, preventing fraud, and maintaining the service, balanced against the individual's rights.
• Legal obligation: retaining transaction data for tax, accounting, and compliance purposes.

Your Rights Under GDPR

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to legal retention obligations
• Restrict or object to certain processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at the email address in Section 15. We will respond within one month, as required by GDPR.

International Data Transfers

Our infrastructure and service providers (Vercel, Supabase, AWS, Trigger.dev, and our third-party AI provider) operate on servers located in the United States. Where personal data originating in the EEA, UK, or Switzerland is transferred to the United States, we rely on Standard Contractual Clauses (SCCs) or another legally recognized transfer mechanism with each provider to ensure your data continues to receive an equivalent level of protection.

Cookies

Our marketing website does not use non-essential tracking or advertising cookies. Any cookies used are strictly necessary for the site or application to function (for example, keeping you logged in).

We may update this Privacy & Security Policy from time to time. The "Last Updated" date at the top of this page will always reflect the most recent version. Material changes will be noted in the changelog below.

• July 27, 2026 — Corrected this policy to reflect that Teko is a publicly available product offered to Amazon sellers generally, not limited to Cuesta Brands' own accounts; replaced "client and partner brand" language with plain seller terminology throughout. Disclosed a third-party AI provider, Trigger.dev, and AWS/SQS as data processors, alongside Vercel, Supabase, and Sentry. Corrected PII retention to 30 days and added non-PII retention limit. Added detailed Security & Data Protection sections (network protection, employee access controls, encryption & key management, backups/DR, logging & monitoring, incident response, password & credential management, vulnerability management). Added data deletion terms for account disconnection/cancellation, and rights for connected sellers (not just Amazon buyers). Added full GDPR compliance section (legal basis, international transfers, EU/UK rights, supervisory authority) alongside CCPA and Amazon's Data Protection Policy.
• July 3, 2026 — Initial publication.

For privacy-related questions or to report a security concern:

• Organization: Cuesta Brands LLC
• Email: teko@tekohand.com
• Website: tekohand.com
• Application: ops.tekohand.com

For security incidents involving Amazon Information, additionally notify: security@amazon.com