# Walmart Marketplace Data Protection (DPP) Compliance

**Last updated:** August 24, 2026

This addendum describes how AtlasCore handles Walmart Marketplace order data at rest, on seller-facing surfaces, and during retention purge. It applies only to Walmart-connected seller accounts.

## What AtlasCore stores

Walmart order cache rows (`encrypted_order_payload`) store an **allowlisted operational dictionary** only:

- `purchase_order_id`, `customer_order_id`
- `order_status`, `order_date`
- Line items: SKU and quantity
- `items_count`, `order_total`

Buyer names, emails, phone numbers, and shipping / billing addresses from Partner order JSON are **not** persisted in the order cache or on seller-facing list APIs.

## Seller-facing surfaces

- `GET /api/v1/walmart/orders/cache/` returns PII-minimized dashboard rows: purchase order id, date, status, item count, total, and sync timestamp.
- `GET /api/v1/walmart/orders/` applies the **same** minimized row shape to live Partner list responses. Buyer and shipping blocks are stripped before the response leaves the API.
- Catalog `GET /api/v1/walmart/items/` is a read-only item listing and returns allowlisted fields only (`sku`, `product_name`, `lifecycle_status`, `price`, `published_status`). It is not an inventory write-back.

## Retention clocks

AtlasCore redacts remaining operational JSON on the following Walmart-owned clocks:

| Order state | Clock | Window |
|---|---|---|
| Terminal (`SHIPPED`, `DELIVERED`, `COMPLETED`, `CLOSED`, `CANCELLED`, `FULFILLED`, `REFUNDED`) | Order fulfillment/status timestamp (`order_date`); `created_at` only if that timestamp is missing on a terminal row | **30 days** |
| Open / unfulfilled (Created, Released, Acknowledged, and other non-terminal statuses) | `created_at` | **90-day ceiling** |

After the clock elapses, the encrypted payload is replaced with a DPP redaction marker. Operational identifiers on the row (purchase order id, status) may remain for seller history.

Linked `channel_orders` snapshots for Walmart are redacted only when they match the **same** `user_id` and purchase order id as the expired Walmart row.

## Anti-rehydration

If a Walmart order row is already DPP-redacted, later Partner syncs and webhook deliveries **do not** overwrite the encrypted payload with buyer or shipping data. Status, date, and operational identifiers may still update.

## Writes that touch Walmart

The live write API is `POST /v3/orders/{purchaseOrderId}/acknowledge` for Created or Released purchase orders. AtlasCore does not create shipments or decrement Walmart inventory.

## Seller controls

- Disconnect Walmart in AtlasCore to purge credentials and cached order rows for the signed-in account (and workspace overlay when bound).
- Contact [privacy@atlascore-market.com](mailto:privacy@atlascore-market.com) for data subject requests.

See [Walmart API Compliance](/legal/walmart/walmart-api-compliance.md) and our [Privacy Policy](/legal/privacy).