User Data Deletion Instructions

1. Overview & Commitment to Data Subject Rights

Kynali ("Kynali", "we", "us", or "our") respects the privacy rights of all users, merchants, and buyers. In full compliance with Article 17 of the General Data Protection Regulation (GDPR - "Right to Erasure / Right to be Forgotten"), the California Consumer Privacy Act (CCPA), and the eBay API License Agreement (Marketplace Account Deletion / Closure Mandates), this document provides transparent, actionable instructions on how individuals may request the deletion of their personal data from our infrastructure.

2. How to Request Data Deletion

You may initiate a personal data deletion request through any of the following standard methods:

Method A: Self-Service Deletion via Vendor Panel (Registered Merchants)

Registered merchants and developers may execute an instant account and vault purge directly from their authenticated console:

1. Sign in to your authenticated Seller Console at kynali.com/panel.
2. Navigate to Settings & Security → Privacy & Data Control.
3. Click Request Account Deletion & Vault Purge.
4. Confirm your request via your secondary multi-factor authentication (2FA / OTP). Upon verification, your account credentials, API tokens, webhook subscriptions, and encrypted vault items are queued for irreversible cryptographic erasure.

Method B: Direct Request via Email (Merchants, Developers, or Buyers)

If you do not have an active seller account or made a purchase as an end-buyer through an automated checkout link (/pay/{id}):

1. Send an email to our dedicated Privacy Desk at support@kynali.com.
2. Use the subject line: "Data Deletion Request — GDPR/CCPA" or "eBay Marketplace Account Deletion".
3. Provide the identifier associated with your record (e.g., your registered merchant email address, or the buyer email address that received an automated digital delivery receipt).
4. Our Data Protection Officer will verify your identity and confirm completion in writing within thirty (30) days.

3. Automated eBay Marketplace Account Deletion Notifications

In compliance with the eBay Developers Program and Section 5.3 of the eBay API License Agreement:

• Dedicated Webhook Endpoint: Kynali maintains an automated, high-availability webhook listener configured to receive Marketplace Account Deletion / Closure event notifications directly from eBay's Event Notification API.
• Automated Ingestion & Verification: Upon receiving an eBay Marketplace Account Deletion payload, our security infrastructure verifies the digital signature provided in the eBay payload headers (verifying public key certificate authenticity).
• Irreversible Data Purge: Once validated, our automated pipeline queries all internal order routing tables and securely deletes or cryptographically anonymizes all personal data associated with the specified eBay user ID (including shipping address, recipient email, name, and contact information) within 30 calendar days.
• No Manual Action Required for eBay Buyers: eBay buyers whose accounts are closed or deleted through eBay do not need to contact Kynali separately; the deletion is automatically cascaded and processed via eBay's direct notification API.

4. Scope of Deleted Information

When a data deletion request or eBay account deletion notification is executed, Kynali permanently purges:

• Merchant Account Information: Corporate billing name, email address, password hashes, and seller profile data.
• API & OAuth Credentials: Encrypted eBay OAuth access tokens, refresh tokens, Stripe API keys, and PayPal webhook secrets.
• Encrypted Vault Items: Digital templates, software files, API tokens, and creator assets stored in the merchant's private partition.
• Customer & Buyer Telemetry: Delivery email addresses, client IP logs, browser user-agents, and ephemeral transmission payloads.
• Notification Subscriptions: Web Push notification endpoints and Telegram bot chat identifiers.

5. Statutory Retention Exceptions (Legal & Tax Compliance)

Pursuant to GDPR Article 17(3)(b) & (e), CCPA § 1798.105(d), and applicable electronic commerce statutory regulations, Kynali may retain strictly limited, non-marketable records:

• Financial & Tax Accounting Ledgers: Transaction reference IDs, prepaid credit invoice amounts, UTC timestamps, and payment processor transaction IDs required by corporate tax authorities (retained for statutory periods, typically 5 to 7 years, after which they are automatically destroyed).
• Dispute & Fraud Prevention Proofs: Irreversible SHA-256 cryptographic hashes of delivery receipts necessary to defend against fraudulent chargebacks or dispute claims under Visa Compelling Evidence (CE 3.0), Mastercard, and PayPal Intangible Goods Seller Protection rules. These records contain zero readable personal data.

6. Confirmation & Verification Notice

Upon completion of the deletion procedure, a formal confirmation notice is recorded in our audit compliance ledger. If the request was submitted manually via our Privacy Desk, a confirmation email will be dispatched to your address stating that all personal data has been permanently removed from our active systems.

7. Contact the Data Protection Officer (DPO)

If you have questions regarding this User Data Deletion Instructions policy or wish to submit an expedited request, please contact our team:

Data Protection Desk: support@kynali.com
Compliance Desk: Platform Compliance Statement
Privacy Policy: Full Privacy Policy
Support Center: Help Desk & Direct Support