Effective Date: April 8, 2026 | Last Reviewed: April 7, 2026 | Approved By: etSEO Management

This Information Security Policy establishes the formal information security program for etSEO (Seller Success Academy, LLC). We implement, maintain, and continuously improve the administrative, technical, and physical safeguards designed to protect all of Our information assets — and Yours. Our goal is to ensure that the data you entrust to Us remains confidential, accurate, and available when you need it.

This policy has been prepared in compliance with industry standards and TikTok Shop Partner requirements.

Table of Contents

1. Purpose
2. Scope
3. Definitions
4. Governance
5. Access Control
6. Data Protection
7. Application Security
8. Infrastructure Security
9. Incident Response
10. Vendor Management
11. Your Responsibilities
12. Monitoring & Auditing
13. Business Continuity
14. GDPR & CCPA Compliance
15. TikTok API Data Usage
16. Legal Compliance
17. Policy Review
18. Contact Us

1. Purpose

This document establishes the formal information security program for etSEO (Seller Success Academy, LLC). We implement, maintain, and continuously improve the administrative, technical, and physical safeguards designed to protect all of Our information assets — and Yours. Our goal is to ensure that the data you entrust to Us remains confidential, accurate, and available when you need it.

2. Scope

This policy applies to all personnel, systems, networks, applications, and third-party integrations — including TikTok Shop APIs — that process or store Company data or Your Personal Data. Whether you access Our Service via the etSEO website, mobile application, or API, these protections apply to you.

3. Definitions

For the purposes of this Policy, the following terms have the meanings set out below. Words with an initial capital letter have the same meaning whether they appear in singular or plural form.

• Personal Data means any information that relates to an identified or identifiable individual, consistent with the definition in Our Privacy Policy.

• Processing includes the collection, storage, transmission, use, and deletion of Personal Data.

• Company (also referred to as 'We', 'Us', or 'Our') refers to Seller Success Academy, LLC dba etSEO, San Diego, California.

• Service refers to the etSEO application and website, accessible at https://www.etseo.com.

• Service Provider means any third-party company or individual that processes data on Our behalf in connection with the Service.

• You means the individual or entity accessing or using Our Service.

4. Governance

We designate responsible parties within the Company to enforce this policy and maintain accountability at every level. Non-compliance by any personnel may result in disciplinary action, up to and including termination, depending on the severity of the breach. We review our governance structure at least annually to ensure it remains effective.

5. Access Control

We restrict access to Our systems based on the principle of least privilege — meaning that each person only has access to the data and tools they genuinely need to do their job. We enforce strong authentication mechanisms, including multi-factor authentication (MFA) where appropriate, to protect Your information from unauthorized access.

6. Data Protection

The security of Your Personal Data is important to Us. We encrypt all sensitive data both in transit and at rest, using commercially reasonable means. Our data handling procedures are designed to ensure the confidentiality, integrity, and availability of Your information at all times. Please note, however, that no method of transmission over the Internet or method of electronic storage is 100% secure, and We cannot guarantee absolute security.

7. Application Security

All software We develop or use follows a secure development lifecycle, including code review, testing, and ongoing vulnerability management. We work to identify and remediate security issues before they can affect You or Your data.

8. Infrastructure Security

Our systems are hardened, continuously monitored, and regularly maintained to prevent unauthorized access or service disruptions. We apply security patches and updates in a timely manner and conduct periodic reviews of our infrastructure posture.

9. Incident Response

We maintain an incident response plan to detect, respond to, and remediate security incidents quickly and effectively. If We become aware of a breach that affects Your Personal Data, We will notify You in accordance with applicable law and our obligations under this Policy.

10. Vendor Management

Before engaging any third-party service provider, We assess their security controls to ensure they meet Our standards. We require Service Providers who handle Your data to maintain adequate safeguards throughout our relationship with them. You can learn more about how We share data with Service Providers in Our Privacy Policy at etseo.com/privacy-policy.

11. Your Responsibilities

All personnel with access to Our systems are required to comply with this policy and complete periodic security training. If you are a user of Our Service, We ask that You keep Your account credentials confidential and notify Us promptly at team@etseo.com if You suspect any unauthorized use of Your account.

12. Monitoring & Auditing

We retain security logs and review them regularly to identify and investigate potential threats. Periodic audits are conducted to validate that Our controls remain effective and that We continue to meet our compliance obligations.

13. Business Continuity

We maintain backup and disaster recovery procedures to ensure that Our Service remains available to You even in the event of unexpected disruptions. Our goal is to minimize downtime and restore normal operations as quickly as possible.

14. GDPR & CCPA Compliance

We comply with applicable privacy regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). This means We honor Your rights to access, correct, delete, and port Your Personal Data, and We ensure that all processing of Your information has a lawful basis. For full details on Your privacy rights and how to exercise them, please review Our Privacy Policy.

15. TikTok API Data Usage

All TikTok Shop data accessed through Our integrations is processed and stored strictly in accordance with TikTok's platform policies. We do not use, disclose, or retain TikTok Shop data beyond what is permitted by those policies and what is necessary to provide Our Service to You.

16. Legal Compliance

We comply with all applicable laws, regulations, and contractual obligations relevant to the operation of Our Service and the protection of Your data. This includes, but is not limited to, data protection laws, consumer protection regulations, and any applicable sector-specific requirements.

17. Policy Review

We review this policy at least once per year and update it as necessary to reflect changes in Our practices, applicable law, or the threat landscape. When We make material changes, We will notify You in the same way We notify You of changes to Our Privacy Policy — by posting the updated document and updating the "Last Reviewed" date at the top of this Policy.

18. Contact Us

If You have any questions about this Information Security Policy, or if You wish to report a security concern, please contact Us:

• By email: team@etseo.com