AtlasCore Market

Temu Legal addendum · Legal version v1 · Last updated: July 13, 2026

Temu Data Handling

Last updated: August 24, 2026

AtlasCore is an independent software application. Temu and related marks are trademarks of PDD Holdings Inc. / Whaleco Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Temu.

Data accessed

When you connect a Temu seller account, AtlasCore may access:

- Seller identifier and Open Platform OAuth access/refresh tokens (encrypted at rest)

  • Product catalog metadata (goods ID, SKU, title, price, stock quantity, listing status)
  • Operational order metadata only: order id, status, totals, currency, dates, and line-item SKU/quantity

AtlasCore does not scrape Temu seller admin surfaces. Cached order blobs store an allowlisted operational subset only. Receiver names, street addresses, email addresses, and phone numbers are not persisted. Shipping decrypt (`bg.order.decryptshippinginfo.get`) is not run during sync or cache ingest.

Seller-facing `GET /orders/` and `GET /products/` return local cache rows only. Live Temu fetches run only on `POST /sync/` (and catalog/inventory sync POSTs).

Encryption & transport

- Open Platform OAuth tokens are stored using AES-256-GCM encryption at rest with the `enc:v1:` format

  • Cached order payloads are encrypted at rest and redacted per retention policy
  • Production API traffic uses TLS 1.2+ (HTTPS)
  • Outbound Open Platform requests use MD5 request signing per Temu Partner Platform requirements

Authentication

AtlasCore supports OAuth authorization code and merchant-pasted access/refresh tokens. OAuth permissions are configured in the Temu Partner Center (authorize URL sends `app_key`, `redirect_uri`, and `state` only). Catalog and order reads run when the integration is enabled. Seller writes — `bg.local.goods.stock.edit`, `bg.logistics.shipment.confirm`, and `bg.order.decryptshippinginfo.get` — run only when both `TEMU_INTEGRATION_ENABLED` and `TEMU_WRITE_APPROVED` are true. A write-capable Open Platform grant is not sufficient by itself. Inbound order webhooks never issue stock PUTs — Temu already decrements managed inventory when an order is placed.

Webhook security

Inbound Temu notifications at `POST /api/v1/temu/webhooks/` are verified using HMAC-SHA256 (`X-Temu-Signature`) over the raw request body before JSON parsing. A timestamp header freshness check (±300s) is required. Unknown seller identifiers that present a valid HMAC are acknowledged with `200` so Temu does not retry-storm. If the same `seller_id` is active in more than one workspace, webhook resolve fail-closes. Connect enforces one active seller ID globally and requires a genuine seller/mall ID (it does not synthesize `temu-{user_id}`).

Success-path webhook rows store identifiers only (`event_id` namespaced as `{seller_id}:{event_key}`, account binding, `order_id`, event type). Leftover failed-row ciphertext is scrubbed after 24 hours.

Tenant isolation

- Temu seller data is isolated per enterprise workspace — each connected account is bound to an AtlasCore tenant via the `X-Tenant` header

  • Order, product, and status queries are scoped to the authenticated seller within the active workspace
  • Unified channel-order rows are scoped to the seller; ambiguous cross-workspace matches are cleared rather than merged
  • AtlasCore never aggregates Temu seller data across accounts for comparative insights or public display
  • AtlasCore strictly prohibits re-identification, sale, or unauthorized secondary use of Temu seller or buyer data

Retention

AtlasCore redacts cached Temu order payloads after 30 days post-fulfillment or 90 days unfulfilled, whichever applies. A Temu-owned retention worker applies the 30-day clock only to exact terminal names, using `shipTime` / `deliveryTime` or the first terminal time. The 90-day open ceiling is measured from native `orderTime` / `createdAt` / `created_date`. Sync does not reset fulfillment clocks. Awaiting, unshipped, and partial statuses are not treated as fulfilled.

Disconnect & deletion

- Disconnect Temu from the dashboard purges encrypted credentials, cached orders/products, and OAuth state for your tenant workspace

  • Replay defense identifiers in `temu_processed_webhook_events` are retained in an unlinked state after credential purge so a later reconnect cannot ingest the same notification twice
  • GDPR export includes all Temu tenant bindings per user with `tenant_id`

Contact

For data handling questions: privacy@atlascore-market.com