AtlasCore Market

Etsy Legal addendum · Legal version v1 · Last updated: July 13, 2026

Etsy Data Protection & Privacy (DPP) Compliance

Last updated: August 23, 2026

This addendum summarizes AtlasCore controls aligned with Etsy Developer Data Protection requirements and our platform security practices for Etsy-connected shops.

Field-level token encryption

OAuth access and refresh tokens for Etsy shops are encrypted at rest before persistence:

- Algorithm: AES-256-GCM via industry-standard cryptography libraries.

  • Storage format: Ciphertext prefixed with `enc:v1:`; plaintext tokens are refused at decrypt time.
  • Key material: Derived from deployment secrets (`ATLASCORE_TOKEN_ENCRYPTION_KEY` or enterprise master override). Keys are never stored alongside ciphertext.
  • Scope: Encryption applies to Etsy OAuth state, access tokens, and refresh tokens held in AtlasCore databases.

All production traffic uses TLS 1.2+ (HTTPS) for data in transit.

Automated PII scrubbing (30-day post-fulfillment / 90-day unfulfilled)

AtlasCore applies time-bounded retention to Etsy-derived personally identifiable information (PII) where cached for commercial fulfillment features. Buyer name and shipping/contact fields in `etsy_orders.extra` are encrypted at rest.

- Fulfilled / shipped / completed / delivered / refunded receipts: buyer and shipping PII are redacted 30 days after `fulfilled_at` (the first time the receipt enters a shipped or terminal state). The clock is not reset by later syncs.

  • Unfulfilled / open receipts: buyer and shipping PII are redacted 90 days after `created_at`.
  • `last_synced_at` is not a retention clock.
  • Seller-facing `GET /orders/` reads the local cache only. Buyer names are masked unless the caller sets `include_pii=true` and is a platform administrator or holds the `fulfillment_manager` role. Authorized unmask events are audit-logged.
  • Expired PII fields are scrubbed or anonymized by scheduled maintenance jobs.
  • Commercial snapshots (review text, conversation subjects, and dispute reasons and extras) are redacted on the same 30-day terminal / 90-day open clocks.
  • Disconnect in AtlasCore destroys locally stored Etsy OAuth ciphertext (`enc:v1:` access and refresh tokens) and cached shop data. It does not remotely revoke the grant at Etsy.
  • Remote revocation: In the Etsy account Apps / Developer Portal permissions, revoke AtlasCore so Etsy invalidates tokens at the source.
  • Sellers may request earlier deletion through AtlasCore disconnect plus Etsy-side revoke.

See also our global Data & Retention policy.

Role-gated access (RBAC)

Access to Etsy shop data within AtlasCore is controlled through layered authorization:

- User authentication — JWT session cookies with CSRF protection on mutating routes.

  • Shop linkage (default B2C) — API handlers require a valid AtlasCore session and resolve the caller's own `EtsyAccount`; cross-user shop access is denied.
  • Optional workspace overlay — When a shop is bound to an organization, `tenant_id` / `X-Tenant` further scopes that user's Etsy rows. Personal shops may have a null `tenant_id`.
  • Organization RBAC — Enterprise deployments may assign organization roles; permissions gate administrative views and operator actions, including the `include_pii` order unmask.
  • Platform operator access — AtlasCore admin routes require explicit admin email allowlisting and audit logging for sensitive operations.

Seller controls

- Disconnect Etsy in AtlasCore to destroy local cryptographic credentials and stop new API calls.

  • Revoke AtlasCore in the Etsy account Apps / Developer Portal permissions for token invalidation at the source.
  • Contact privacy@atlascore-market.com for data subject requests related to Etsy-synced information.