隐私政策

This Policy applies to the CUPIN website, our Amazon Ads API integration for authorized advertisers, and the ERP system used for order, customer, product, inventory, purchasing, finance, and fulfillment management, operated by [Legal Company Name] (“CUPIN,” “we,” “us”).

Controller/personal information handler: [Legal Company Name]; registered address: [Registered Address]; privacy email: [Privacy Email]. Where we process ERP or advertising data solely under an enterprise customer’s documented instructions, that customer is generally the controller/personal information handler and we act as its processor/entrusted party.

We do not send sensitive personal information, as defined by applicable law, to Amazon through Amazon Ads. Unless legally permitted and strictly necessary, we do not intentionally collect precise geolocation, health, biometric, government ID, or full payment credentials.

• Fulfill orders, support, returns, invoicing, and logistics;
• With authorization, create, manage, optimize, and report Amazon campaigns;
• Synchronize ERP order, product, inventory, and financial data and generate analytics;
• Authenticate, administer access, troubleshoot, prevent fraud, and secure systems;
• Meet tax, accounting, and other legal duties; and
• Send marketing or use non-essential cookies with required consent.

Depending on law, we rely on contract, legal obligations, appropriately balanced legitimate interests, and/or consent. Consent may be withdrawn at any time.

We access Amazon Ads Data only after express authorization through Amazon OAuth and selection of the relevant profiles. We use it solely for requested campaign management, automation, monitoring, optimization, and reporting—not unauthorized profiling, interest-based advertising, remarketing, sale, rental, or an independent third-party purpose.

We apply least-privilege access, protect API credentials, and follow Amazon throttling, validation, and security requirements. You may revoke access through Amazon or our service. We then stop new API access and delete or de-identify cached data under applicable agreements, law, and this Policy. We do not disclose Amazon Ads credentials except to approved confidential service providers.

We may disclose necessary data to carriers, payment providers, cloud/database hosts, ERP vendors, analytics/security vendors, Amazon and affiliates, and lawful authorities. Vendors act only under contract with confidentiality and security duties. We do not sell personal information or share it for cross-context behavioral advertising.

Amazon, cloud, or international fulfillment may process data abroad. Where required, we use adequacy decisions, Standard Contractual Clauses, China standard contracts/certification/security assessment, or another valid mechanism, and conduct impact assessments, identify recipients, and obtain separate consent under Chinese law.

We retain data for the shortest necessary period: raw/cached Amazon Ads Data generally during authorization and no more than 90 days after revocation; de-identified aggregate reports may remain longer; ERP order, invoice, and transaction records generally for seven years or the locally required period; security logs generally 12 months; and OAuth tokens are disabled and scheduled for deletion upon revocation, expiry, or account deletion. A shorter Amazon or legal rule controls, subject to legal holds.

Safeguards include encryption in transit and at rest, role-based access, MFA, credential isolation, monitoring, backups, vulnerability management, training, and incident response. We notify affected persons, customers, Amazon, and/or regulators where legally required.

Subject to law, you may request access/knowledge, copies, portability, correction, supplementation, deletion, restriction or objection, consent withdrawal, account closure, and human review of significant automated decisions. California residents may also opt out of sale/sharing, limit certain sensitive-data uses, and receive non-discriminatory treatment. We currently do not sell or share personal information.

Submit requests to [Privacy Email]. We may verify identity and authority and respond within the legal period. You may also complain to your local regulator.

Essential cookies support language, security, and core functions. Before analytics, Amazon pixels, or similar technology, we obtain consent and provide controls where required. Third parties, including Amazon, may use cookies to measure ads and, with consent, show interest-based ads. For UK/EEA users we transmit a valid Amazon Consent Signal, GPP, or IAB TCF signal before personal information is sent to Amazon.

Manage choices through cookie settings, your browser, or Amazon Ad Preferences. Rejecting non-essential cookies does not affect purchases or core ERP functions.

The service is not directed to children under 14, and we do not knowingly collect their data. We may revise this page; material changes receive prominent notice or renewed consent where required. The Chinese version controls in case of conflict unless mandatory law provides otherwise.