Fairlot private eBay operations — privacy

This service is for Fairlot's own eBay seller account. It is not open to other sellers.

With the owner's consent, it uses eBay OAuth to verify the connected seller and read a count of active listings. Its fixed calls are GetUser and GetMyeBaySelling. The default eBay OAuth scope can permit broader operations; this service exposes no listing-write, arbitrary API proxy or token-download route.

Cloudflare processes the service's HTTPS requests and hosts its private D1 database. Refresh authorization is encrypted using AES-256-GCM; its separate key is held as a Worker secret. Access tokens and raw API responses are used transiently and not stored. GetUser can return other account information; only the needed identity references are used and the rest is discarded. Buyer data, orders, addresses, messages, payment details and tax IDs are not imported.

Account identifiers, short-lived login tickets and browser-bound state are represented in storage by keyed hashes. The login cookie is Secure, HttpOnly, SameSite=Lax and lasts at most ten minutes. Request/payload logging and traces are disabled in this application's configuration. Cloudflare may separately process platform/security metadata under its policies.

Signed eBay account-deletion notifications erase matching managed data and encrypted authorizations. Minimal hashed notification receipts last 30 days. Sensitive pseudonymous suppression hashes prevent reimport of deleted accounts and remain until a retention decision is made. These hashes are not anonymous. Cloudflare backup/Time Travel retention may delay removal from recovery copies; restore procedures must reapply suppression before reactivating data access.

The account owner can revoke the application through eBay's application-access settings. This notice describes the private service's intended data handling; it does not claim certification or guarantee regulatory compliance.

Updated October 16, 2026