Legal
Data Processing Addendum
How OnBreeze processes your Walmart Marketplace data for you, and how long it keeps it.
Effective date and last updated: November 7, 2026.
1. Scope
This Addendum is part of the Terms of Service between the seller (“Customer”) and onboard dot ai LLC, a California limited liability company doing business as OnBreeze (“OnBreeze”).
“Customer Data” means data from Customer’s Walmart Marketplace account that OnBreeze processes through the Service, including buyer personal information in it.
“Data Incident” means an actual or reasonably suspected unauthorized access to, or loss, disclosure or alteration of, Customer Data, or of Walmart API keys.
2. Roles and instructions
Customer controls Customer Data. OnBreeze processes it only for Customer and on Customer’s documented instructions. Those instructions are the Terms, this Addendum and Customer’s requests through the Service.
Under California privacy law, OnBreeze acts as Customer’s service provider. OnBreeze does not sell or share Customer Data. It does not keep, use or disclose Customer Data outside its direct relationship with Customer, or for any purpose other than providing the Service.
3. Purpose limits
OnBreeze processes Customer Data only to provide the Service to that Customer. OnBreeze does not:
- combine Customer Data with another customer’s data, or aggregate, de-identify or re-identify it across customers;
- build cross-seller benchmarks from it;
- use it to train machine-learning models;
- use buyer personal information for marketing, or contact a buyer.
4. Buyer information
- Order and return reads mask buyer names, emails, phones, street addresses, cities and postal codes before a result leaves the Service. State and country stay. Walmart’s answer passes through OnBreeze’s services in memory so that they can mask it.
- OnBreeze does not keep order and return answers as read evidence.
- Support records, logs and the audit log exclude buyer names, addresses and contact details.
- Order report workbooks are rewritten. Customer columns are masked, and any column we have not reviewed is masked too.
- Shipping labels, scan forms and claim documents can show buyer details. They are never given to an AI client. Only the person who ran the read can download them, in a signed-in browser.
- Captured data for accounts in the capture pilot keeps order facts and identifiers with ship-to state and five-digit postal code. It keeps no buyer name, phone, email or street address.
- The address of a seller or of a Walmart facility is business data. OnBreeze does not mask it.
5. Confidentiality and personnel
Only people who need access to operate the Service can reach Customer Data, and they must keep it confidential. Operator views show redacted records and never show API keys. OnBreeze logs operator access to request details.
6. Security
OnBreeze maintains a written information security program. The Security page summarizes it.
7. Subprocessors
Customer authorizes the subprocessors on the Subprocessors page. OnBreeze gives 30 days’ notice by email or in the Service before it adds a subprocessor that processes Customer Data.
OnBreeze requires each subprocessor to protect Customer Data under written data protection terms. OnBreeze stays responsible for its subprocessors’ processing of Customer Data.
8. Retention and deletion
| Record | Kept for | Details |
|---|---|---|
| Redacted request and result details | Up to 7 days | For our support team. Access is restricted. |
| Private downloads | Expire within 7 days | Access requires the owning account. Most files that a read delivers expire after 24 hours. A report file and a claim documents file stay 7 days. A claim documents file can hold buyer information. Claim evidence that you upload stays 7 days, and a short record of its deletion stays 30 days. |
| Basic activity events | Up to 90 days | Short facts about each request and connection, such as the tool, the outcome and the time. No request or response contents. |
| Daily usage totals | Up to 180 days | Usage added up by day. |
| Failed agent sign-in records | Up to 30 days | For our support team. Each record holds the time, the error, the agent’s client ID, internal account and authorization IDs, the Cloudflare data center and the client type. It never holds access tokens, refresh tokens or authorization codes. Deleted with your account. |
| Change records | At least 90 days | Unfinished changes stay until they are resolved, or until account deletion closes their records. Closing a record does not decide what happened to the change. Finished changes move to an archive after 30 days and stay with your account until you delete it. They can hold the previous and new values of the change. |
| Read evidence | 120 seconds | The answer to a verified read, kept so that a later step can use the same read. Order and return reads are never kept this way. |
| Stored Walmart report rows and listing-quality rows | Up to 7 days | Item and report rows that eComm Router requests, and Walmart’s listing-quality scores of a SKU. No buyer information. |
| Walmart API keys | Until you rotate them, disconnect or delete your account | Held in Google Secret Manager. They are never shown again. Cleanup deletes them after running requests end. |
| Captured Walmart data | Rolling 3 years | Only for accounts in the capture pilot. Database rows and archive files are deleted when they pass 3 years, or sooner on disconnect or account deletion. Turning the nightly data copy off stops new reads. Stored data still follows this period. |
| Audit log | 13 months | Entries are deleted with the account. |
| Saved goals and decisions | Until you clear them, disconnect or delete your account | Notes you ask your client to save. |
| Closed tasks | 90 days after closing | Task records of a connection. |
| Walmart notification records | Up to 30 days | Events that Walmart sends and our delivery records. Used only where notifications are on. |
| Production settings history | 400 days | Who turned a production change on or off, and hourly check results. |
| Account, team and agent connection records | Until you delete your account | Your email, sign-in link, team roles and agent connection records. |
| Marketplace votes | Until you ask us to delete them | Ask through the contact form. |
| Contact form messages | In our support mailbox until we no longer need them | The Service does not store them. They go to our support inbox by email. |
| Backups | Up to 7 days for captured data; up to 30 days for the Cloudflare database | Deleted records can remain in backups until those backups expire. We use backups only to restore the Service. |
Disconnect
When Customer disconnects a Walmart Marketplace account, agent access stops at once and unsent changes end. A cleanup task then waits 120 seconds for running requests to end and runs in the next hourly maintenance. It deletes the API keys, the files, the settled entries of the private change ledger and any captured data of that connection. Saved goals and decisions are erased. If a step fails, the task retries, with at most one hour between tries.
The audit log and the change records of that connection stay until their period ends or until Customer deletes the account.
Account deletion
Account deletion needs a recent sign-in, a browser review and a confirmation. It disables the account, ends sessions, revokes agent access, removes the email address and starts the same cleanup. A separate page shows its status for 30 days.
Deletion finishes only after the private service confirms that keys and data are gone. A change without a confirmed result keeps its required records until it is settled or a reviewed closure ends it. A minimal record of changes and of the closure stays for at least 90 days.
Timing
OnBreeze aims to finish cleanup within 30 days of disconnect or account deletion. There is no fixed deadline: a cleanup stays pending while a provider or a change blocks it, and it keeps retrying. The status page reports pending cleanup instead of claiming that deletion is complete. Reconnect waits until cleanup finishes.
Backups expire on the schedule above. OnBreeze does not use them for any other purpose. On written request, OnBreeze confirms deletion in writing.
9. Data Incidents
OnBreeze notifies Customer without undue delay, and within 72 hours, after it confirms a Data Incident that affects Customer Data.
OnBreeze also notifies Walmart as Walmart’s terms require: by phone within 24 hours and in writing within 48 hours. Those terms give Walmart a role in decisions about notices of a Data Incident. OnBreeze coordinates the content and timing of a notice with Walmart where those terms require it, unless the law requires OnBreeze to give the notice.
OnBreeze gives Customer the facts it has, the steps it has taken and the help Customer reasonably needs.
10. Assistance
OnBreeze gives reasonable help with data subject requests, security questions and requests from Walmart about Customer Data.
If a buyer sends OnBreeze a request, OnBreeze sends it to Customer and, where Walmart’s terms require, to Walmart. OnBreeze acts on Walmart’s written instructions about that request within 30 days.
11. Location
- Captured data is stored in the United States.
- The main database runs in Western North America. The private service and its files are in us-central1.
- Traffic can enter Cloudflare’s network outside the United States when the sender is outside it.
- Two stores are not limited to the United States. Google Secret Manager keeps Walmart API keys with automatic replication, and Cloudflare Workers KV copies OAuth tokens across its global network.
- The Subprocessors page gives each location.
12. Walmart
Customer’s data comes from Walmart, and Walmart has rights of its own. Walmart can ask OnBreeze for information, audit its compliance with Walmart’s terms, or direct OnBreeze to stop using or to delete Walmart data. OnBreeze can act on those requests without further instructions from Customer.
13. Information
On reasonable written request, no more than once a year, OnBreeze gives Customer the information needed to show compliance with this Addendum. OnBreeze also gives this information after a Data Incident.
14. Term and liability
This Addendum applies while OnBreeze processes Customer Data. The limits in the Terms apply to it, as far as the law allows.
15. Contact and notices
Send notices under this Addendum to the address below.
onboard dot ai LLC (doing business as OnBreeze)
Notice address: 10312 Meredith Drive, Huntington Beach, CA 92646
Email: team@getonbreeze.com
Contact page: Talk to the team