AtlasCore Market

Faire Wholesale Legal addendum · Legal version v1 · Last updated: July 13, 2026

Faire Wholesale Data Handling

Last updated: August 24, 2026

AtlasCore is an independent software application. Faire and related marks are trademarks of Faire Wholesale, Inc. AtlasCore is not sponsored, endorsed, or affiliated with Faire.

Data accessed

When you connect Faire Wholesale, AtlasCore may access:

- Brand account identifiers (`brand_id`)

  • OAuth access tokens (encrypted at rest; no refresh-token grant is used)
  • Wholesale order metadata (status, totals, line-item counts)
  • Product catalog metadata where authorized by granted scopes
  • Inventory quantities and shipment tracking fields required for authorized write scopes

AtlasCore does not scrape Faire surfaces or harvest retailer data outside authorized API scopes. `GET /orders/`, `GET /products/`, and `GET /orders/{id}/shipments/` are cache-only and return the same redacted dashboard shape (no raw Faire JSON to the browser). Live Faire pulls are limited to `POST /sync/`, inbound webhooks, and seller-initiated shipment writes.

Encryption & transport

- OAuth access tokens are stored using AES-256-GCM encryption at rest with the `enc:v1:` format

  • Platform Faire app credentials are resolved from the server environment and are not written on new connects; legacy secrets purged via migration; columns remain unused
  • Cached order JSON is an allowlisted operational snapshot (status, totals, line SKUs/quantities) encrypted or redacted per retention policy — retailer address and email are not stored
  • Production API traffic uses TLS 1.2+ (HTTPS)

Webhook security

Inbound Faire wholesale notifications at `POST /api/v1/faire/webhooks` are verified using HMAC-SHA256 (`X-Faire-Signature`) against the raw request body before JSON parsing. When a timestamp header is present, requests outside the allowed freshness window are rejected. If Faire omits the timestamp header, HMAC verification and `event_id` deduplication still apply — missing timestamps do not fail closed.

Deauthorization events (`APP_REVOKED`, `BRAND_DEAUTHORIZED`, `BRAND_DISCONNECTED`, or `ACCESS_REVOKED`) are persisted and deduplicated by `event_id` before any purge. Replay of the same event cannot wipe a brand after reconnect. Purge is scoped to the matching account for that `brand_id` — not every tenant that ever stored the identifier.

Tenant isolation

- Faire Wholesale data is isolated per enterprise workspace — each connected brand account is bound to an AtlasCore tenant via the `X-Tenant` header

  • An active Faire `brand_id` is uniquely claimed per environment so two workspaces cannot share a live brand connection
  • Order and status queries are scoped to the authenticated seller within the active workspace
  • AtlasCore never aggregates Faire brand data across sellers for comparative insights or public display
  • AtlasCore strictly prohibits re-identification, sale, or unauthorized secondary use of Faire brand or retailer data

Retention

AtlasCore operates automated retention that redacts cached Faire order JSON and linked channel order payloads 30 days after fulfillment — specifically delivery, completion, fulfillment, closed, or an explicit cancel — clocked from `fulfilled_at`, not order creation. In-transit states such as `SHIPPED` remain on the 90-day open ceiling until a terminal `DELIVERED`, `COMPLETED`, `FULFILLED`, `CLOSED`, `CANCELED`, or `CANCELLED` state is reached. Never-fulfilled and in-transit orders are redacted 90 days after `order_date`. `order_date` is stamped once from the created-time field and is not overwritten by later `updated_at` syncs. Channel-order redaction is joined on seller `user_id` and Faire order id and is governed only by this Faire-owned worker. `channel_orders` has no `tenant_id`; if multiple Faire order rows match the same seller and order id, the unified snapshot is redacted (fail-closed).

Inventory

On `NEW_ORDER`, AtlasCore decrements on-hand quantity once per brand, order, and line when write scopes are approved. Stock is not automatically restored when an order is canceled. Recovery of canceled-order quantity is handled by a seller-initiated catalog/inventory refresh (`POST /sync/`) or a manual adjustment in the Faire brand portal.

Disconnect & deletion

- Disconnect Faire Wholesale from the dashboard purges encrypted credentials and cached orders for your workspace. Webhook `event_id` rows and inventory adjustment claims survive account deletion (`ON DELETE SET NULL`) so replay cannot wipe a reconnected brand or double-decrement stock

  • Brand deauthorization webhooks persist `event_id` first, then run the same account-scoped purge; retry workers do not re-purge
  • GDPR export includes all Faire tenant bindings per user with `tenant_id`

Contact

For data handling questions: privacy@atlascore-market.com