Privacy Policy

1. What We Collect

• Account data — your email address, name, and a securely hashed password (we never store passwords in plain text).
• Etsy shop data — when you connect a shop through Etsy's official OAuth flow, we sync your shop profile, listings, orders, and shop statistics via the official Etsy API. Your Etsy access tokens are stored encrypted (AES-256). We never see your Etsy password.
• Social media accounts — if you choose to connect a Pinterest or Instagram account through the platform's official OAuth flow, we store your account name, account ID, and access tokens (encrypted, AES-256) so we can publish the posts you create or schedule and retrieve engagement statistics for them. We never see your social media passwords, and we only post content you explicitly create. You can disconnect an account at any time, which deletes the stored tokens.
• Billing data — payments are handled by Stripe. We store your subscription tier and Stripe customer reference; your card details never touch our servers.
• Usage data — page analytics (Google Analytics), feature-usage counters (for plan limits), and server logs kept for security and debugging.

2. How We Use It

• To operate the Service: dashboards, analytics, sync, and billing.
• To generate AI suggestions: listing content you choose to analyze is sent to Google Cloud Vertex AI for processing. It is used to produce your suggestions, not to train Google's foundation models.
• To send transactional email (account verification, password resets, billing notices) via our email provider, Resend.
• To publish social media posts: when you create or schedule a post, the content you wrote and the product image you selected are sent to the platform you chose (Pinterest or Instagram) on your behalf.
• To enforce plan limits, prevent abuse, and secure the Service.

We do not sell your personal data or your shop data to anyone.

3. Service Providers

We share data only with the processors required to run the Service:

• Vercel — application hosting
• Neon — database hosting (PostgreSQL)
• Upstash — caching and rate limiting (Redis)
• Stripe — payment processing
• Google Cloud — AI processing (Vertex AI)
• Resend — transactional email
• Cloudflare — bot protection (Turnstile) and DNS
• Google Analytics — aggregate site analytics
• Pinterest / Meta (Instagram) — social publishing, only for accounts you explicitly connect

Each provider receives only the data needed for its function and processes it under its own security and privacy commitments.

4. Cookies

We use cookies for authentication (keeping you signed in) and security. Google Analytics sets cookies for aggregate usage measurement. We do not use third-party advertising cookies.

5. Retention and Deletion

• Account and shop data are retained while your account is active.
• Disconnecting a shop stops syncing and revokes our access; you can also revoke access from your Etsy account settings at any time.
• To delete your account and personal data, email [email protected]. We delete or anonymize your data within 30 days, except records we must keep for legal or accounting reasons (e.g., invoices).

6. Security

All traffic is encrypted in transit (TLS). Etsy OAuth tokens are encrypted at rest with AES-256. Passwords are hashed with bcrypt. Access to production systems is limited to the operator. No method of storage is 100% secure, but we work to protect your data with industry-standard measures.

7. Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, or to object to certain processing. Contact us at [email protected] and we will honor applicable requests. If you are in the EU/EEA or UK, you may also lodge a complaint with your local supervisory authority.

8. Children

The Service is not directed at children under 18 and we do not knowingly collect their data.

9. Changes

We may update this policy. Material changes will be announced by email or in-app notice before they take effect. The effective date above always reflects the current version.

10. Contact

Privacy questions: [email protected]. See also our Terms of Service.