ZiloOne · BigSur Corp.
Data Protection & Security
Last updated: 18 October 2026
1. BigSur's commitments
BigSur intends to protect information it processes for ZiloOne with technical and organisational safeguards appropriate to the data and service. The commitments on this page describe the controls we aim to operate and maintain; they are not a claim of independent certification, completed audit, or guaranteed compliance with every law or standard.
2. Purpose limitation and least privilege
Connected seller data is intended to be used only to provide the customer-requested integration features, support, security and legal obligations. Access permissions should be limited to those needed for features actually provided. BigSur does not sell Amazon seller data or use buyer personal information for advertising or unrelated purposes.
3. Access control and credentials
Access to seller data and integration credentials should be restricted to authorized services and personnel with a legitimate business need. Secrets must not be exposed in public pages or client-side code. Administrative and support access should be controlled and reviewed, with credentials revoked or rotated when needed or suspected to be compromised.
4. Secure transmission and storage
Website and integration traffic should use HTTPS/TLS. Seller data and tokens should be stored in access-controlled systems with safeguards against unauthorized disclosure, and excluded from ordinary logs unless strictly necessary and appropriately protected. The exact storage and infrastructure controls depend on the service deployment and operating model.
5. Monitoring and incident response
BigSur intends to maintain appropriate operational and security monitoring, investigate suspected unauthorized access, limit further exposure, preserve relevant evidence, and notify affected customers or authorities when required by law. Report a concern to contact@bigsur.in. Do not include passwords, API secrets or buyer personal data in the initial report.
6. Retention, revocation and deletion
Amazon buyer personal information must not be retained longer than 30 days after order delivery, except where applicable law requires longer retention for legal, tax or regulatory obligations. Amazon information must be securely deleted from active systems, backups and other copies within 30 days of the earliest applicable trigger: authorization is revoked, access is no longer permitted, Amazon requires deletion, or the service or participation ends, subject to legally required retention. Deletion must be permanent; hashing or anonymization is not a substitute where deletion is required. Automated retention and deletion controls must be implemented and tested, and customers should also revoke the app's access through the relevant Amazon account controls when disconnecting it.
7. Service providers
Where infrastructure or support providers are required, they should receive only the information necessary for their contracted function and be subject to appropriate confidentiality and security requirements. They should not use seller data for unrelated purposes. Optional third-party integrations may have separate data handling terms.
8. Shared responsibilities
Customers are responsible for the users they authorize, their lawful use of seller and buyer information, their own devices and systems, and infrastructure they operate. This does not replace BigSur's responsibilities for data BigSur itself processes or controls. Specific responsibilities should be set out in applicable customer agreements.
9. Scope and contact
For security or privacy concerns, contact contact@bigsur.in. This page does not claim Amazon approval, Amazon affiliation, or third-party security certification. Our Privacy Policy describes the categories of information and purposes more fully.