Amazon Services Privacy Addendum

This Amazon Services Privacy Addendum ("Amazon Addendum") supplements the BellNova Privacy Policy and applies when an Amazon seller, vendor, advertiser, agency, or other authorized account holder (an "Authorized User") authorizes BellNova to access information through:

• the Amazon Selling Partner API and other Amazon Services APIs used for selling-partner operations (collectively, "SP-API"); and
• the Amazon Ads API and related Amazon advertising tools approved for BellNova (collectively, "Amazon Ads").

In this addendum, "Amazon Information" means information obtained from or relating to SP-API or Amazon Ads, including information derived from that data. "Amazon Ads Data" means data, reports, analysis, content, or other materials relating to or derived from Amazon Ads.

BellNova intends to provide the BellNova application to multiple Authorized Users. Each Authorized User must separately authorize BellNova through the authorization workflow supported by the applicable Amazon service. This addendum does not expand the permissions granted by Amazon or an Authorized User. If it conflicts with the main policy regarding Amazon Information, the requirement that provides greater protection to Amazon Information controls.

Publication of this addendum does not itself represent that Amazon has approved BellNova for any particular role, scope, feature, certification, or partner status.

The exact information BellNova processes is limited to the data required for the approved features selected by an Authorized User and depends on the Amazon service, marketplace, advertising account, profile, role, and permission granted.

2.1 SP-API Information

BellNova requests only non-restricted SP-API roles. Depending on the approved non-restricted roles and features, BellNova may process:

• seller, vendor, merchant, account, and marketplace identifiers;
• catalog items, listings, product attributes, pricing, and inventory;
• non-PII order, fulfillment, shipment, return, and delivery status made available through approved non-restricted operations;
• business, operational, settlement, financial, and performance reports available through approved non-restricted roles; and
• notifications, API request metadata, authorization status, and audit records.

BellNova does not apply for Restricted Roles, request restricted data tokens, or request, retrieve, store, or otherwise process Amazon customer PII through SP-API. This includes customer names, street addresses, email addresses, telephone numbers, gift messages, and other customer-identifying information protected as PII under Amazon policy.

2.2 Amazon Ads Data

Depending on the approved Amazon Ads functionality, BellNova may process:

• advertiser, agency, manager-account, marketplace, account, and profile identifiers;
• portfolios, campaign groups, campaigns, ad groups, ads, creatives, products, keywords, targets, negative targets, placements, budgets, bids, and campaign settings;
• campaign status, eligibility, moderation, recommendations, and change history;
• impressions, clicks, spend, attributed conversions and sales, performance metrics, and aggregated advertising reports; and
• OAuth grants, access and refresh tokens, API request metadata, authorization status, error records, and security and audit logs.

BellNova does not obtain or ask an Authorized User to provide Amazon Portal or Advertising Console usernames or passwords. BellNova does not attempt to obtain Amazon Information outside the approved roles, scopes, API operations, and functionality required for the feature the Authorized User selects.

BellNova uses Amazon Information only to operate the approved BellNova features for the Authorized User that supplied the authorization. Depending on the selected features, this may include:

• synchronizing and managing catalog, listing, price, and inventory information;
• supporting authorized order, fulfillment, shipment, return, reconciliation, and reporting workflows;
• creating, viewing, updating, monitoring, and optimizing Amazon advertising portfolios, campaigns, ad groups, ads, creatives, products, keywords, targets, budgets, and bids;
• providing advertising dashboards, performance reporting, attribution, alerts, recommendations, and customer-requested automation;
• validating data, monitoring connection health, respecting API limits, handling errors, and detecting suspicious activity;
• providing support for the Authorized User; and
• meeting documented security, regulatory, and legal requirements relating to the non-PII information BellNova processes.

BellNova does not sell, rent, sublicense, publish, or independently monetize Amazon Information. BellNova does not use Amazon Information for product marketing directed at Amazon customers, customer profiling, or review creation or manipulation.

BellNova does not use Amazon Ads Data to reidentify or reconstruct the identity of an individual, conduct unlawful or discriminatory surveillance or profiling, or provide unauthorized interest-based advertising or behavioral retargeting. BellNova does not combine Amazon Ads Data with third-party data unless Amazon has expressly approved the combination and all required user notices, permissions, consents, and legal bases are in place.

BellNova does not use Amazon Information to train a general-purpose artificial intelligence or machine-learning model. If an approved BellNova feature uses analytics, models, or automated recommendations that may materially affect an Authorized User's business, BellNova describes the feature's purpose, principal inputs, limitations, and data freshness and applies appropriate data-integrity, validation, error-handling, and user-control measures.

BellNova accesses Amazon Information only after an Authorized User grants express, verifiable authorization through Amazon's supported workflow. BellNova requests only the roles, scopes, and data necessary for the selected functionality and does not use one Authorized User's authorization to access another Authorized User's data.

BellNova applies least-privilege and need-to-know access controls. Access is limited to approved personnel and services with a documented operational need. BellNova does not share Amazon access keys, developer credentials, or customer credentials, use generic or shared user accounts for protected systems, or permit personnel to store Amazon Information on personal devices.

Authorized Users may revoke BellNova's authorization through Seller Central, the Amazon Advertising Console, or another Amazon-provided control and, where available, through BellNova. Revocation stops future API retrieval and Authorized User-initiated actions. Information already obtained is deleted or retained only as described in Section 8.

BellNova does not disclose Amazon Information to another customer or advertiser. BellNova may disclose Amazon Information only to:

• the Authorized User and users that the Authorized User has approved;
• Amazon, where needed to complete the authorized activity, comply with Amazon policy, or respond to an Amazon inquiry;
• BellNova personnel with a documented need to know; and
• an infrastructure or service provider approved or otherwise permitted under the applicable Amazon terms, solely where access is necessary to operate the approved BellNova feature.

BellNova currently uses Amazon Web Services in the United States, including the us-west-1 region, for hosting and infrastructure. Before another provider receives Amazon Information, BellNova applies the review, approval, confidentiality, data-protection, and contractual controls required by Amazon and applicable law. Such providers may not use Amazon Information for their own advertising, data brokerage, model training, or unrelated purposes.

BellNova maintains administrative, physical, and technical safeguards designed to protect Amazon Information from unauthorized access, acquisition, use, disclosure, alteration, loss, or destruction. Controls applied according to the data and approved Amazon access include encrypted transmission, unique user identities, multi-factor authentication, least-privilege access, credential protection and rotation, access review and prompt deprovisioning, network protection, logging and monitoring, vulnerability management, secure software-development practices, personnel security training, risk assessment, backup and recovery, and incident-response procedures.

To report a suspected privacy issue, security vulnerability, or actual or suspected misuse of Amazon Information, email marketing@bellnova.com with the subject "Amazon Privacy or Security Report." Include contact information, a description of the issue, the affected BellNova or Amazon account if known, relevant dates, and supporting evidence. Do not include passwords, access tokens, secret keys, or personal information.

BellNova records and tracks submitted reports, assesses their severity, takes containment and remediation measures appropriate to the risk, and provides status or resolution information where legally and operationally permitted. BellNova may request additional information needed to investigate or verify a report.

For a Security Incident involving information governed by the Amazon Data Protection Policy, BellNova follows its incident-response plan, preserves appropriate evidence, documents corrective actions, and notifies Amazon at security@amazon.com within 24 hours of detection. BellNova also provides notices required by applicable law and does not represent or speak on Amazon's behalf unless Amazon expressly authorizes it in writing.

BellNova retains Amazon Information only for the shortest period necessary to provide the approved functionality, satisfy an Authorized User's documented instruction, comply with Amazon policy, or meet an applicable legal requirement.

7.1 SP-API Retention

• SP-API Information: retained for no longer than 18 months unless longer retention is required by applicable law or Amazon directs otherwise.
• Security logs: retained for at least 12 months where required by Amazon. BellNova configures logs not to contain Amazon customer PII or other unnecessary personal information.

7.2 Amazon Ads Retention

Amazon Ads Data is retained only while required for the approved BellNova feature and permitted by Amazon. BellNova promptly deletes and discontinues use of Amazon Ads Data when it is no longer required for a permitted use, when the applicable authorization or agreement terminates, or when Amazon requests deletion. If applicable law requires retention of specific Amazon Ads Data, BellNova isolates and securely protects the retained data, uses it only for the legal requirement, and permanently deletes it when that requirement ends.

7.3 Deletion Process

BellNova permanently and securely deletes Amazon Information in accordance with Amazon's deletion notice and within 30 days of an Amazon request where the Amazon Data Protection Policy applies, unless the information must be retained to meet an applicable legal requirement. Secure deletion uses industry-standard sanitization processes consistent with NIST SP 800-88 or an equivalent standard and covers applicable production data stores, caches, exports, temporary files, and backup lifecycle controls. BellNova permanently and securely deletes all live, online, or network-accessible instances within the period required by Amazon. Upon Amazon's request, BellNova provides written certification that the required information has been securely destroyed.

BellNova hosts Amazon Information using Amazon Web Services in the United States, including the us-west-1 region, unless a different location is disclosed before authorization. BellNova maintains a mechanism to identify or attribute the Amazon origin and relevant Authorized User for Amazon Information. International transfers are made only where permitted by the applicable Amazon agreement and applicable law and are subject to required contractual and organizational safeguards.

Authorized Users may request access, correction, deletion, or restriction relating to information BellNova controls by emailing marketing@bellnova.com with the subject "Amazon Privacy Request." BellNova may verify the requester's identity, account, and authority before acting on the request.

Requests from Amazon customers concerning information controlled by a seller, vendor, advertiser, or other Authorized User should normally be directed to that Authorized User. BellNova assists the relevant Authorized User with valid data-subject requests as required by law, contract, and Amazon policy.

BellNova reviews changes to applicable Amazon policies and updates this addendum or its practices where required. BellNova cooperates with reasonable Amazon compliance inquiries and maintains records required to demonstrate its handling of Amazon Information.

For privacy questions, rights requests, complaints, security reports, or vulnerability notifications, contact:

• Company: BellNova Corporation
• Website: https://www.bellnova.com
• Privacy and Security Email: marketing@bellnova.com
• Last Updated: August 3, 2026
• Effective Date: August 3, 2026