Privacy policy · Better Be Goods BV

This policy explains what data BBG Sentinel and this website process, why, how it is protected, and what rights you have. It describes the system as it is actually built rather than in general terms.

1. Who is responsible

Better Be Goods BV (“we”, “us”) is the controller for the data described here:

Noorderhaven 106, 8861 AR Harlingen, Netherlands
Chamber of Commerce (KvK) 64779440 · VAT NL855837627B01

BBG Sentinel is our internal platform for managing Amazon Selling Partner API (SP-API) credentials for our group companies and partner brands.

Contact for any privacy matter: see our contact page, and mark your message “Privacy request”.

2. What this policy covers

BBG Sentinel, the credential platform itself.
betterbegoods.com, this website.

BBG Sentinel has no public sign-up and no consumer users. It is used by our own systems and by named administrators at the brands whose Amazon authorisations it holds.

3. What we collect

Amazon authorisation data

When a brand authorises BBG Sentinel through Amazon’s SP-API authorisation flow, we store:

the selling partner identifier and the marketplaces the authorisation covers;
which SP-API roles were granted;
the SP-API refresh token issued by Amazon, which is a credential rather than personal data, but is treated as our most sensitive stored value;
the organisation within our installation that owns the authorisation.

Administrator and account data

For the people who have access to the BBG Sentinel interface: name, work email address, the organisation they belong to, and their permissions. This is business contact data of people acting in a professional capacity.

Audit and operational data

For every access token issuance and every administrative action: the time, the requesting identity (usually a service account, sometimes a named operator), the organisation, the action and whether it succeeded. Our infrastructure also produces standard application and request logs, which can include IP addresses.

This website

This website is static. It sets no cookies, runs no analytics, and contains no advertising or tracking scripts. It also makes no third-party requests: the fonts are served from this domain, not from a font CDN, so viewing a page does not reveal your visit or your IP address to anyone but us and our hosting provider.

The hosting provider keeps standard request logs, which include IP addresses, as described under sharing below.

What we deliberately do not collect

BBG Sentinel does not request Amazon’s restricted SP-API roles that expose personally identifiable information about buyers. Buyer names, shipping addresses, phone numbers and email addresses are therefore never retrieved, never transmitted through BBG Sentinel and never stored by it. We also do not collect special categories of personal data, and we do not buy data from third parties.

4. How we use it, and on what legal basis

What we do	Why	GDPR basis
Store an authorisation and issue access tokens from it	To operate the Amazon integrations the brand has asked us to run	Performance of a contract (Art. 6(1)(b)); legitimate interests where the brand is a group company
Maintain administrator accounts and permissions	To control who can see and manage which organisation’s credentials	Contract; legitimate interests in access control (Art. 6(1)(f))
Keep an append-only audit log of token issuance	To be able to establish after the fact which system used which credential, and to detect misuse	Legitimate interests in security and accountability (Art. 6(1)(f)); Art. 32 security obligation
Keep application and request logs	To run, debug and secure the service	Legitimate interests (Art. 6(1)(f))
Respond to your emails	To answer you	Contract, or legitimate interests

We do not use any of this data for advertising or profiling, and no decision affecting you is made by automated means.

5. How we store and protect it

This is the substance of the policy, so it is specific:

Credentials are encrypted at rest. Amazon refresh tokens are encrypted with Fernet symmetric encryption before being written to the database.
Decryption happens in exactly one place. A single code path in BBG Sentinel decrypts a stored refresh token, and it does so only to perform the token exchange with Amazon. The decrypted value is passed straight into that exchange: it is never bound to a long-lived variable, never returned to the calling system, never written to a log, and never copied anywhere else.
The encryption key is held separately, in Google Secret Manager. It is not in our source code, container images, configuration files or environment files, and it is not stored in the same system as the data it protects. Access to it is granted to the runtime service account that needs it and to no one else by default.
There are no static database credentials. The application authenticates to its database using short-lived Google Cloud IAM tokens. No database password exists to be leaked, shared or committed to a repository.
Encrypted transport, enforced. The managed database instance is configured to reject unencrypted connections outright. Traffic between our components, between BBG Sentinel and Amazon, and between your browser and this website is over TLS.
Per-organisation isolation at the row level. Every credential, authorisation and audit record carries the organisation that owns it, and every query is scoped to that organisation. One brand’s data is not reachable from another brand’s context.
An append-only audit log. Every token issuance is recorded, and audit entries cannot be modified or deleted through the application.
Least-privilege runtime service accounts, separated per component. No component runs under a shared administrative identity, and each is granted only the permissions it needs.
Calling systems are authenticated, not trusted by network position. A system requesting a token must present a Google-issued identity token, which is validated against an allow-list of permitted service accounts.
Access tokens are short-lived and not persisted. The tokens BBG Sentinel hands to calling systems expire by Amazon’s design and are not stored.

No system is beyond compromise, and we do not claim otherwise. The design above is intended to limit what a single failure can expose and to make any misuse visible in the audit record.

We do not sell data, and we do not share it for anyone else’s marketing. Data is shared only with:

Amazon, as a recipient — necessarily, because the entire purpose is to exchange a credential with Amazon’s Login with Amazon endpoint and to call SP-API on the brand’s behalf.

Better Be Goods BV’s EU vendor relationships with Amazon are entered into with Amazon EU S.à r.l., a limited liability company (société à responsabilité limitée) with its registered office at 38 avenue John F. Kennedy, L-1855 Luxembourg, registered with the Luxembourg Trade and Companies Register under number B 101.818. That is the contracting entity; the Amazon group entity that technically operates the Login with Amazon and SP-API endpoints may be a different one.
Google Cloud, as our infrastructure provider — hosting, the managed database, Secret Manager, logging and the hosting of this website. Google processes the data only on our instructions under its data processing terms, as our processor and therefore as a sub-processor in relation to the brands we act for. It has no independent right to use the data.
Other brands: never. A partner brand’s authorisations, credentials and audit records are not shared with, or visible to, any other brand.
Authorities or advisers, where we are legally required to disclose something, or where we need legal advice to defend a claim.

Where the data is stored. BBG Sentinel stores and processes data in the European Union, on Google Cloud Platform in region europe-west4. Both the application and its database run there.

Calls to Amazon necessarily reach Amazon’s own SP-API endpoints, and Amazon processes that traffic under its own terms.

7. How long we keep it, and how it is deleted

We would rather be precise here than reassuring, so this section states what the system currently does — including where it retains data rather than deleting it.

Revoking an authorisation

When an authorisation is revoked, BBG Sentinel marks it as revoked and stops issuing tokens from it immediately. The credential becomes unusable for token issuance.

The encrypted refresh token itself is deliberately retained at that point. It is kept, still encrypted, as part of the security record: so that a later investigation can establish what existed and what was used while the authorisation was active. It is not used to issue tokens, and no code path reaches it once the authorisation is revoked.

Automated hard-deletion of revoked credentials is not yet implemented. It is planned. Until it ships, removing a revoked credential from storage is a manual operation, which we will carry out on request — see below.

Retention at a glance

Data	Retention
Amazon refresh token, while the authorisation is active	For as long as the authorisation is active
Amazon refresh token, after revocation	Retained in encrypted form as a security record; no longer usable for token issuance. Removed from storage on request, as a manual operation
Authorisation record and its revoked status	Retained as part of the security record
Administrator account data	Until the person’s access ends, then removed
Audit log entries	12 months, as a security and accountability record. Because the log is append-only, individual entries are not removed on request within that period where we have an overriding legitimate interest or a legal obligation to retain them; we will always explain this if it applies to your request
Application and request logs	Kept for a limited operational period and then rotated out by our infrastructure
Emails you send us	For as long as needed to handle the matter and any follow-up

Asking us to delete something

Ask us through our contact page. If you are a brand, withdrawing the authorisation in Amazon’s own console is the fastest way to stop token issuance, and it takes effect without us doing anything. Tell us as well if you also want the stored encrypted credential removed, and we will do that and confirm when it is done.

Because we are established in the Netherlands, the GDPR applies. You have the right to:

access the personal data we hold about you, and get a copy;
rectify it if it is inaccurate or incomplete;
erasure of it, where one of the grounds in Art. 17 applies;
restrict our processing while a dispute about it is resolved;
data portability, for data you provided to us, in a machine-readable form;
object to processing we base on legitimate interests, including the logging described above — we will then re-assess whether our interest genuinely overrides yours;
withdraw consent, in the cases where we rely on consent; and
not be subject to a decision based solely on automated processing. We make no such decisions.

To exercise any of these, contact us through our contact page. We may need to confirm your identity first, so that we do not disclose someone’s data to the wrong person. We will respond within one month, and will tell you if we need the extension the GDPR allows for complex requests.

Complaints. If you are not satisfied with how we handle your request, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your country of residence.

9. Changes to this policy

If we change how BBG Sentinel handles data, we change this page and update the date at the top. Every change to this text is made as a tracked revision in the repository behind this website, so we can always establish what it said on a given date.

10. Contact

Better Be Goods BV. See our contact page for how to reach us and for our registered details.