Data Security, Retention & Deletion Policy

Color More Lines (TMA-CML LLC)

Last Updated: November 11, 2026

1. Introduction

Color More Lines is committed to protecting the confidentiality, integrity, and security of information entrusted to us by our clients.

We provide e-commerce management, analytics, reporting, business intelligence, and operational support services to online sellers, including businesses operating on Amazon marketplaces.

This policy explains how we access, process, protect, retain, and delete client information. Our data protection practices are designed to comply with applicable laws, contractual obligations, and Amazon’s Selling Partner API (SP-API) Data Protection Policy (DPP) and Acceptable Use Policy (AUP).

2. Information We Process

We access and process business information only with appropriate client authorization and only to provide agreed services.

Depending on the services provided, this information may include:

  • Seller account identifiers and marketplace information.
  • Sales, order, refund, fee, and settlement information.
  • Product listings, pricing, and inventory information.
  • Advertising campaigns and performance metrics.
  • Financial reports, operational data, and business analytics.

We limit data collection and processing to information necessary for authorized business activities.

We do not sell client information or share Amazon information with unauthorized third parties.

3. Multi-Factor Authentication and Access Control

Access to client accounts, administrative systems, and sensitive business information is protected through multi-factor authentication (MFA) and appropriate access controls.

We implement the following security measures:

  • Multi-Factor Authentication: MFA is required for applicable systems containing sensitive client information.
  • Restricted Staff Access: Client information is accessible only to specifically assigned and authorized personnel who require access to perform their responsibilities.
  • Least-Privilege Access: Access permissions are limited to what is necessary for each authorized role.
  • Access Reviews: User permissions are reviewed periodically to identify unnecessary or outdated access.
  • Access Revocation: Access is promptly removed when personnel leave the organization, change roles, or no longer require access to a client account.

We do not permit unauthorized personnel to access client systems or information.

4. Managed Devices and Endpoint Security

Employees and contractors accessing client information are required to use company-approved, managed devices.

These devices are protected through appropriate security controls, including:

  • Password-protected user accounts and device authentication.
  • Operating system and software security updates.
  • Endpoint protection and anti-malware safeguards.
  • Device access restrictions and security configuration management.
  • Secure network connections.

We maintain device security requirements designed to reduce the risk of unauthorized access, malware infections, data loss, and information disclosure.

5. Data Encryption and Credential Protection

We use encryption and secure communication technologies to protect client information during transmission and storage.

Encryption in Transit

Information transmitted between systems, applications, and third-party services is protected using secure communication protocols, including TLS 1.2 or higher where applicable.

Encryption at Rest

Stored client information is protected using industry-standard encryption technologies appropriate to its sensitivity and applicable security requirements.

API and Credential Security

API credentials, authentication tokens, passwords, and other sensitive access information are protected through secure storage, restricted access permissions, and appropriate credential management practices.

Credentials are not intentionally exposed through public-facing systems or unauthorized communications.

6. Amazon Buyer Data Protection

Color More Lines primarily processes Amazon seller business information for account management, analytics, reporting, and operational purposes.

Our operating policy is that Amazon buyer personal information is not downloaded, exported, or stored outside Amazon Seller Central.

This includes buyer names, personal email addresses, telephone numbers, shipping addresses, and other information that directly identifies individual buyers.

Where buyer information must be viewed for an authorized business purpose, access is limited to authorized Seller Central workflows and assigned personnel.

We do not transfer buyer personal information into external analytics databases, reporting systems, or other unauthorized storage platforms.

We do not use buyer personal information for unauthorized advertising, marketing, profiling, or unrelated commercial activities.

7. Data Retention

We retain client information only for as long as necessary to fulfill authorized business purposes or comply with applicable legal, tax, regulatory, and contractual obligations.

Our retention practices follow these principles:

  • Seller Business Data: Retained only for authorized business purposes and within applicable Amazon data retention limitations.
  • Amazon Buyer Personal Information: Not stored outside Seller Central under our operating policy.
  • Other Client Information: Retained only for legitimate operational, contractual, or legal purposes.
  • Data Minimization: Information no longer required for an authorized purpose is identified for deletion.

We periodically review data retention requirements and apply the relevant restrictions to information obtained through Amazon SP-API and other platforms.

8. Data Deletion and Client Termination

When a client terminates our services, revokes authorization, or otherwise ends our access to their Amazon information, we initiate secure data deletion procedures.

Applicable Amazon client data is securely deleted from our systems within 30 days of termination, authorization revocation, or another applicable deletion trigger, unless continued retention is legally required.

Our procedures include:

  • Deleting client information from active databases and applications.
  • Removing unnecessary reports, exports, and stored files.
  • Addressing relevant data copies and backups according to applicable deletion requirements.
  • Revoking API credentials and integration access.
  • Removing staff access to the terminated client’s systems and information.
  • Documenting deletion activities where required.

When Amazon specifically requires deletion or provides a deletion notice, we follow the applicable Amazon requirements and deadlines.

Information retained to meet a legal obligation remains protected, and its use is restricted to that obligation.

9. Third-Party Service Providers

We may use authorized technology providers for cloud infrastructure, data processing, analytics, reporting, and operational services.

We require providers with access to protected information to maintain appropriate security and confidentiality safeguards.

Access to client information is limited to what is necessary to deliver authorized services, subject to applicable contractual restrictions and Amazon requirements.

We do not authorize third parties to use Amazon information for purposes unrelated to the services permitted by the relevant seller and Amazon.

10. Security Monitoring and Incident Response

We maintain security controls and incident response procedures designed to detect, investigate, contain, and address suspected or confirmed security incidents.

Our security incident procedures include:

  • Monitoring relevant systems for suspicious activity.
  • Investigating unauthorized access or potential information disclosure.
  • Containing and remediating identified security issues.
  • Documenting incidents and corrective actions.
  • Notifying affected clients, Amazon, and relevant authorities when required.

For security incidents involving Amazon information, we follow Amazon’s applicable reporting requirements, including notification to Amazon within 24 hours of detection.

11. Client Data Requests

Clients may contact Color More Lines regarding their information and our data protection practices.

Subject to applicable legal, contractual, and platform requirements, clients may request:

  • Information about the categories of data processed on their behalf.
  • Correction of inaccurate information.
  • Deletion of information no longer required.
  • Clarification of our retention and security practices.
  • Revocation of authorized data access.

We evaluate and respond to requests according to applicable requirements.

12. Policy Review and Compliance

We periodically review our data protection practices to address changes in business operations, technology, security risks, and applicable laws or platform requirements.

Our security controls are designed to align with Amazon’s SP-API Data Protection Policy, Acceptable Use Policy, and other applicable requirements.

We update this policy as necessary to reflect material changes in our data protection practices.

13. Contact Information

For questions regarding data security, retention, deletion, or this policy, please contact:

Color More Lines (TMA-CML LLC)

1102 A Street, Suite 300
Tacoma, WA 98402
United States

Email: info@colormorelines.com

Website: https://www.colormorelines.com/