1. Who we are
ZHHBoldness Workspace is operated by HKBizPower Limited, a Hong Kong company. This notice covers our public product website, service enquiries, reporting services when activated, and the existing team workspace.
We are preparing a reporting service for Amazon sellers. Amazon API connections are not yet active. Activation requires Amazon approval, the required data-protection controls, and the account owner’s authorization.
Contact: support@zhhboldness.com.
2. Information and purpose
We use information to respond to enquiries, discuss service requirements, deliver agreed analysis, manage authorized access, resolve issues, and protect the service.
- Contact and business information: the name, business contact details, and requirements you provide when discussing a service or requesting support.
- Workspace account information: email addresses, authentication records, and access permissions.
- Reporting information: authorized store and advertising reports, product identifiers, keywords, images, analysis settings, task records, and outputs relevant to the agreed workflow.
- Technical information: IP addresses, browser details, request times, and service logs processed by hosting and authentication providers.
The planned SP-API scope excludes buyer names, email addresses, telephone numbers, shipping and billing addresses, and restricted tax-invoicing information. It uses non-PII reporting data only. This exclusion does not mean that business contact details and account information are not personal information.
Do not include buyer personal information, passwords, or API secrets in an enquiry or uploaded report.
4. Service providers and locations
We use providers only for the functions involved in the relevant workflow:
- Cloudflare: the public website and domain services.
- Tencent Cloud and COS: server processing and object storage.
- Supabase: authentication, task records, and private storage.
- Alibaba Mail: enquiries and support correspondence.
- Volcengine / Doubao, Sorftime, and Xiyou: selected keyword, product, image, or market-analysis functions in the existing workspace. This does not authorize sending future SP-API reports to these services.
The planned SP-API processing and storage are limited to the Tencent Cloud server and approved private Supabase/COS storage. Additional processors for SP-API data would require a separate assessment and an update to this notice before use.
Information may be processed outside Hong Kong, including in mainland China and Singapore, and through the infrastructure used by these providers. We may disclose information where required by law or a valid legal request.
5. Data protection and access
The selected Supabase and Tencent Cloud COS storage services support TLS 1.2 or higher for data transmission and AES-256 encryption at rest. Existing administrative and team access uses multi-factor authentication.
Before activating the public SP-API service, we require private, access-controlled storage; separation of seller access; secure credential storage; and logs that exclude report content and secrets. SP-API calls and processing will run on the Tencent Cloud server. Staff computers will not display, download, cache, or store SP-API data.
The current internal workspace has some generated reports that can be opened by anyone who obtains their links. Those existing links are not an approved delivery method for future SP-API reports. Source files use private cloud storage. Contact us if an existing report link needs to be withdrawn.
6. Retention and deletion
Contact enquiries, service correspondence, and existing non-API work records are retained only while needed for their purpose or to meet legal obligations. Existing workspace archives are reviewed and deleted by administrators; we do not currently claim automatic deletion for those archives.
The confirmed retention policy for the planned SP-API service is:
- Raw reports: delete promptly after processing; any encrypted retry copy is kept for no more than 24 hours.
- Normalized non-PII data and analysis reports: retain only while needed for the agreed purpose, for no more than 24 months.
- Security logs: retain for 12 months, excluding report contents and secrets.
These limits must be enforced before SP-API production processing begins. An earlier deletion trigger takes priority: retained Amazon information must be securely deleted within 30 days after Amazon requests deletion, a seller revokes authorization or ends our access, we are no longer authorized to process the information, or our participation in the services ends. Retention beyond those triggers is permitted only where required by law, tax, or regulation.
Deletion covers applicable active records, stored objects and versions, generated reports, and retained copies. Send requests to support@zhhboldness.com.
7. Website and browser storage
This public website has no account registration or upload form, advertising trackers, or analytics scripts. Using an email link opens your own email application.
The separate team workspace uses browser storage for sign-in state. Hosting and authentication providers may process technical information needed to provide their services. Visiting this public website does not activate a seller data connection.
8. Your requests and questions
Contact support@zhhboldness.com to ask about information use, request access or correction, request deletion, or report an access or report-link concern.
Identify the relevant account or service without sending passwords, API secrets, or unnecessary buyer data. We may need to verify your identity and authority. We will explain if a legal requirement prevents us from fulfilling a request.
9. Changes to this notice
We update this notice when our services, data handling, or applicable requirements change. The date above identifies the current version. Material changes to seller data use will be reflected here before the corresponding workflow is activated.