Privacy Policy

Last updated: April 1, 2026

1. Our Commitment to Privacy

Your privacy is important to us. To better protect your privacy we provide this notice explaining our information practices and the choices you can make about the way your information is collected and used. This Privacy Policy applies to all information collected or submitted on Mydepot Inc ("MyDepot", "we", "us", or "our") websites, including www.mydepot.com, shop.mydepot.com, and dropship.mydepot.com (collectively, the "Sites"). When you register at MyDepot, we ask you for personal information. We use this information to process your orders, conduct account verifications, and to communicate with you about the status of your orders. We also use your email address to send you newsletters you are subscribed to during registration, as well as messages about MyDepot special offers, promotional announcements and consumer surveys. Occasionally, we send our customers special offers and promotional information via postal mail, using the shipping address provided. If you no longer want to receive the newsletters or other announcements simply unsubscribe by checking the unsubscribe links.

2. The Information We Collect

This notice applies to all information collected or submitted on MyDepot websites. On some pages, you can order memberships, order products, make requests, and register to receive materials. The types of personal information collected at these pages are:

Name
Billing address
Email address
Phone number
Credit/debit card information
Alternative payment information
Unique identifiers (such as username and password)
Retail site URL or marketplace name
Shipping account information
Federal EIN
State sales tax ID

On some pages, you can submit information about other people. For example, if you order a product and want it drop shipped directly to your customer, you will need to submit their address. In this circumstance, the types of personal information collected are:

Name
Shipping address
Phone number
Email

3. How We Use Information

The primary use of your personal information, other than directly in connection with a purchase, is to efficiently provide you with personalized, relevant information. We also use registration information to let you know about new features or other offers of interest from us and to address customer service needs and requests.

Cookies

Cookies are simple text files that are stored on your computer or mobile device by a website's server. Each cookie is unique to your web browser. We use the following types of cookies:

Necessary cookies: Allow us to offer you the best possible experience when accessing and navigating through our website and using its features.
Functionality cookies: Let us operate the site in accordance with the choices you make.
Analytical cookies: Enable us and third-party services to collect aggregated data for statistical purposes on how our visitors use the website. These cookies do not contain personal information such as names and email addresses.

We use cookies to keep you signed in, understand how you use our site, show you relevant products and services, and work with partners to deliver relevant advertising. If you want to restrict or block cookies, you can do so through your browser settings. For more information, visit internetcookies.com.

Log Files

Like most standard website servers we use log files. This includes Internet protocol (IP) addresses, browser type, Internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and number of clicks to analyze trends, administer the site, track user movement in the aggregate, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.

4. Communications from MyDepot

Special offers and updates: We send all new members a welcoming email to verify password and username. Established members will occasionally receive information on products, services, special deals, and a newsletter. You may opt out of these communications at any time.
Newsletter: If you subscribe to our newsletter, we ask for contact information such as name and email address. We provide a way to opt-out of these communications.
Service announcements: On rare occasions it is necessary to send out strictly service-related announcements. These communications are not promotional in nature.
Customer service: We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account.

5. Sharing with Third Parties

MyDepot will not disclose your personal information provided in connection with membership registration or purchases, except with your knowledge and consent as described in this Privacy Policy or as may be required by law, or to protect the rights or property of MyDepot.

Information submitted by you online (such as information about products you purchase from us, your name, address, email address) may be shared with companies with which we have a commercial relationship, including companies through which you reached MyDepot.

We will not, except as may be required by law, share with any other party your password or payment information. We also reserve the right to disclose aggregated user statistics in order to describe our services to prospective partners, advertisers, and other third parties.

Important: Amazon Information obtained through the Amazon Selling Partner API is categorically excluded from any sharing with marketing partners, advertising networks, or data brokers. See Section 9 below for full details on Amazon data handling.

6. Our Commitment to Data Security

MyDepot takes every precaution to protect our users' information. When users submit sensitive information via the website, their information is protected both online and offline. When our registration/order form asks users to enter sensitive information (such as credit card numbers), that information is encrypted and is protected with SSL encryption. All of our users' information is restricted in our offices. Only employees who need the information to perform a specific job are granted access to personally identifiable information. All employees are kept up-to-date on our security and privacy practices. The servers that store personally identifiable information are in a secure environment.

7. Children's Privacy

Protecting the privacy of the very young is especially important. We never collect or maintain information at our website from those we actually know are under 13, and no part of our website is structured to attract anyone under 13. In order to subscribe to MyDepot's services, the member must be 18 with a valid credit card.

8. Your Rights

Depending on where you live, you may have some or all of the following rights in relation to your personal information:

Right to Access / Know: You may request access to personal information that we hold about you by logging into your account and visiting the "Settings" section.
Right to Delete: You may request that we delete personal information we maintain about you.
Right to Correct: You can correct factual errors in your personally identifiable information by sending us a request that credibly shows error.
Right of Portability: You may request a copy of the personal information we hold about you.
Withdrawal of Consent: Where we rely on consent to process your personal information, you may withdraw this consent.

To protect your privacy and security, we will take reasonable steps to verify your identity before granting access or making corrections. To exercise any of these rights, please contact us at info@mydepot.com.

9. Amazon Selling Partner API — Data Handling Policy

Last updated: April 1, 2026

This section specifically describes how Mydepot Inc ("MyDepot"), operating as an Amazon Selling Partner API ("SP-API") Solution Provider, handles information obtained through Amazon's Selling Partner API, referred to as "Amazon Information." This section applies to all Amazon Information and takes precedence over any conflicting terms in the general sections above with respect to Amazon data. MyDepot complies with Amazon's Acceptable Use Policy, Data Protection Policy, and the Amazon Services API Solution Provider Agreement.

9.1 Collection

MyDepot collects Amazon Information exclusively and directly through Amazon's Selling Partner API (SP-API). This includes:

Order details (order ID, item information, order status)
Buyer Personally Identifiable Information ("Buyer PII"): buyer name and shipping address, required for order fulfillment
Product listing data (titles, descriptions, images, identifiers)
Inventory levels and pricing data
Shipping and tracking information
Operational reports and notifications

We do not collect Amazon Information from any third-party sources, scrapers, data brokers, aggregators, or intermediary services.

9.2 Processing

Amazon Information is processed solely for the following purposes:

Order Fulfillment: Routing orders to verified suppliers for direct-to-consumer shipment
Shipping Label Generation: Using buyer name and address to create shipping labels
Tracking Updates: Pushing shipment tracking information back to Amazon via SP-API
Inventory Synchronization: Maintaining real-time stock levels between suppliers and Amazon storefronts
Product Listing Management: Synchronizing product data, pricing, and catalog information
Tax Compliance: Generating compliant tax invoices per applicable local regulations
Operational Reporting: Pulling SP-API reports for inventory accuracy and order processing

No automated decision-making or profiling is performed on Amazon Buyer PII. Amazon Information is never used for marketing, advertising, profiling, resale, or any purpose unrelated to order fulfillment and authorized seller operations.

9.3 Storage

All Amazon Information is stored on encrypted AWS infrastructure located in the United States:

Primary location: AWS US-East-1 (N. Virginia)
Backup location: AWS US-West-2 (Oregon) — geographically separated
Encryption at rest: AES-256 via AWS RDS for databases; AES-256 S3 server-side encryption (SSE-KMS) for file storage; additional AES-256-GCM envelope encryption for PII fields
Key management: AWS KMS manages all encryption keys with automatic annual rotation. Separate Customer Master Keys (CMKs) per environment (dev/staging/production). Only the application service role can decrypt production data. Key usage audited via CloudTrail.
Network security: Databases reside in private VPC subnets with no public IP addresses. Access restricted via security groups. S3 uses Block Public Access. Developer access requires VPN with MFA.
Backups: Daily encrypted RDS snapshots replicated to US-West-2. Retention: 30 days. RTO: 4 hours. RPO: 1 hour (point-in-time recovery). Restore drills conducted semi-annually.

9.4 Use

Amazon Information is used exclusively for:

Order fulfillment and shipping label generation
Inventory synchronization between suppliers and Amazon storefronts
Product listing and pricing management for authorized sellers
Tax invoice generation for regulatory compliance
Generating operational reports for authorized sellers

Amazon Information is NEVER:

Sold to any third party
Shared for advertising or marketing purposes
Used for buyer profiling or behavioral targeting
Used for any purpose unrelated to the authorized SP-API roles

9.5 Sharing

MyDepot shares limited Amazon Information with the following parties, solely for order fulfillment:

Recipient	Data Shared	Purpose	Protection
Verified supplier partners in MyDepot's dropshipping network	Buyer name and shipping address only	Shipping label generation and direct-to-consumer order fulfillment	Encrypted API transmission (TLS 1.2+); suppliers cannot bulk export or download PII; each supplier bound by a Data Processing Agreement (DPA)

No other parties receive Amazon Information. No payment or financial data is shared with suppliers. No Amazon Information is shared with advertising, analytics, marketing partners, data brokers, or resellers.

9.6 Retention and Disposal

Buyer PII (name, shipping address): Retained for a maximum of 90 days after order shipment delivery confirmation. After this period, PII is automatically and permanently purged from all production databases.
Encrypted backups containing PII: Retained for 30 days with AES-256 encryption, then permanently deleted.
Non-PII operational data (inventory levels, listing data, pricing, anonymized metrics): May be retained longer for business continuity.
Disposal method: Automated purge jobs run daily to identify and permanently delete PII records past the retention period. Deletion is verified through audit logs.

9.7 Security Controls

MyDepot implements the following security controls for Amazon Information:

Encryption: TLS 1.2+ for all data in transit; AES-256 for all data at rest; AWS KMS for key management with automatic rotation
Access Control: Role-based access control (RBAC) with mandatory MFA. Access limited to authorized individuals on a need-to-know basis.
Network Security: AWS VPC with private subnets, security groups, network ACLs, VPN-only developer access
Endpoint Protection: Company-managed workstations only; USB storage disabled via Group Policy; no mobile device access to production systems
Monitoring and Logging: AWS CloudTrail and CloudWatch with 12-month log retention; bi-weekly audit log reviews; automated anomaly detection with real-time alerting
Vulnerability Management: Vulnerability scans every 30 days; annual third-party penetration testing; critical findings remediated within 7 days, high within 30 days
Code Security: SAST scanning on every release; pre-commit hooks to prevent credential exposure; dedicated test environments with synthetic data only — no production PII in testing
Password Policy: Minimum 14 characters with complexity requirements; MFA mandatory; 90-day expiration; account lockout after 5 failed attempts
Credential Management: All secrets stored in AWS Secrets Manager with 90-day automatic rotation; never in source code or config files

9.8 Incident Response

MyDepot maintains a formal incident response plan reviewed every 6 months:

Detection: Automated alerting via CloudWatch and PagerDuty
Containment: Immediate revocation of compromised credentials, system isolation, SP-API token rotation
Assessment: Scope determination and evidence preservation in locked S3 storage
Notification: Amazon notified at security@amazon.com within 24 hours of detection; affected parties notified within 72 hours per CCPA/GDPR
Eradication: Vulnerability patching, system rebuild from clean images
Recovery: Restoration from encrypted backups with integrity verification
Post-Mortem: Root cause analysis and preventive measures documentation

9.9 Amazon Buyer Rights

If you are an Amazon buyer whose information has been processed by MyDepot through the Selling Partner API, you have the right to:

Request access to the personal information we hold about you
Request correction of inaccurate information
Request deletion of your personal information

To exercise these rights, please contact us at tony@mydepot.com. We will respond within 30 days.

10. International Users

We may transfer, store and process your personal information outside the country you live in. If we transfer your personal information out of Europe, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

11. Contact Information

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us:

Company: Mydepot Inc
Address: 1551 South Lilac Avenue, Bloomington, CA 92316, US
General Inquiries: info@mydepot.com
Privacy and Data Protection: tony@mydepot.com
Phone: +1 (714) 360-2659

Incident Management Point of Contact (IMPOC):

Name: Tony Fu, CTO
Email: tony@mydepot.com
Phone: +1 (714) 360-2659
Available: 24/7 for security incidents

MyDepot reserves the right to make amendments, modifications, or changes to this Privacy Policy at any time. If any material change is made, we will notify our users about those changes via email. This Privacy Policy was last updated on April 1, 2026.