AtlasCore Market

eBay Legal addendum · Legal version v1 · Last updated: July 13, 2026

eBay Data Protection & Privacy (DPP) Compliance

Last updated: August 24, 2026

This addendum describes how AtlasCore Marketplace Hub handles eBay seller and order data in alignment with the eBay API License Agreement and Commerce Notification requirements.

Independent application status

AtlasCore is an independent software application. eBay and related marks are trademarks of eBay Inc. AtlasCore is not sponsored, endorsed, or affiliated with eBay.

Data we access

When you connect an eBay seller account, AtlasCore may access:

- Inventory items and offers for workspace catalog synchronization and authorized Inventory API writes

  • Order headers and line items for operational dashboards and fulfillment
  • Buyer and shipping personally identifiable information (PII) only when explicitly authorized and role-gated in the dashboard

Controls at rest and in transit

- Encryption: OAuth access and refresh tokens, PKCE state verifiers, and cached order PII are encrypted at rest using AES-256-GCM with the `enc:v1:` storage prefix. Plaintext secrets are refused at decrypt time.

  • Transport: All production API traffic uses TLS 1.2+ (HTTPS).
  • Seller (B2C) isolation: eBay accounts, orders, and webhook ledger rows belong to the signed-in seller. A workspace overlay (`tenant_id`) is applied only when a request supplies `X-Tenant`; marketplace seller routes are not tenant-partitioned by default.
  • Access control: Unmasking buyer/shipping PII requires authenticated sessions and fulfillment-manager or platform-admin roles.

PII retention clocks

AtlasCore operates a scheduled retention job that redacts eBay order buyer and shipping PII on two clocks:

- 30-day post-fulfillment: Eligible only when `fulfillment_status` is `FULFILLED` and write-once `fulfilled_at` is at least 30 days old. The 30-day clock is not started from `creation_date` and is not applied to open or unfulfilled orders.

  • 90-day unfulfilled ceiling: Open or unfulfilled orders retain PII until 90 days after `creation_date` (or `last_synced_at` when creation is missing). Unfulfilled orders are not redacted at 30 days.

Redaction overwrites encrypted PII columns with a secure redaction marker. Subsequent order syncs do not rehydrate buyer or shipping PII onto a already-redacted row. Non-PII order metadata (order ID, totals, line-item SKUs) may remain for operational history.

The public orders cache API (`GET /api/v1/ebay/orders/cache/`) returns PII-safe display rows only — buyer names and addresses are excluded.

See also our global Data & Retention policy.

Commerce Notification storage

Inbound checkout and order notifications persist an allowlisted operational dictionary only (`notificationId`, `event_type`, `orderId`, SKUs / line items, and seller identity). Raw unrestricted webhook JSON is not stored. Operational checkout events require a declared `notificationId`.

Marketplace Account Deletion notifications

AtlasCore registers for eBay Commerce Notifications including `MARKETPLACE_ACCOUNT_DELETION`:

- Challenge verification: The webhook endpoint responds to eBay portal GET/POST challenges using SHA-256(`challenge_code` + verification token + endpoint URL).

  • Signature validation: Inbound notifications require `X-EBAY-SIGNATURE` verification (ECDSA in production, with HMAC fallback where applicable) before acknowledgment. Missing verification tokens are not accepted outside explicit local mock testing.
  • Automated purge: Account-deletion events trigger remote webhook unsubscribe and automated purge of the seller's encrypted OAuth tokens, cached orders, webhook ledger entries, and workspace catalog rows tied to that eBay account.

Seller controls

- Disconnect eBay in AtlasCore to revoke ongoing sync and purge encrypted credentials for your workspace.

See also our global Privacy Policy and Disconnect Marketplace guidance.