Privacy Policy

Last updated: July 6, 2026 · GDPR & CCPA compliant

This Privacy Policy explains how EtsyRank Pro (the "Service") collects, uses, and protects information about you. This page is maintained by the EtsyRank Pro team to answer common privacy questions.

1. Data controller

EtsyRank Pro is the data controller for the personal data described below. Contact: email support.

2. What we collect

• Account data: email address, hashed password or OAuth identifier, sign-in timestamps.
• Content data: product descriptions you submit and the AI-generated listings we return.
• Usage data: MCP tool calls, rate-limit counters, plan usage aggregates.
• Technical data: IP address, browser/user-agent, coarse device information.
• Billing data: handled entirely by our payment processor; we never see or store full card numbers.

3. Why we process it (lawful bases)

• To provide the Service (contract, Art. 6(1)(b) GDPR).
• To bill and prevent fraud (legitimate interests, Art. 6(1)(f) GDPR).
• To comply with legal obligations (Art. 6(1)(c) GDPR).
• To send product emails you can unsubscribe from at any time.

4. Subprocessors

We share data only with the vendors needed to run the Service:

• Supabase — authentication, Postgres database, storage.
• Cloudflare — hosting, CDN, DDoS protection.
• Lovable AI Gateway — routing generation requests to large-language-model providers (OpenAI, Google, Anthropic).
• Resend — transactional email delivery (bulk-job summaries, sign-in emails).
• Payment processor — subscription billing (used only when payments are enabled).

We do not sell personal data. We do not use your product content to train third-party models beyond the transient generation request.

5. International transfers

Data may be processed in the United States and the European Union. Transfers rely on Standard Contractual Clauses where required.

6. Retention

Account and content data are retained while your account is active. On account deletion, we erase personal data within 30 days, except where retention is required by law (e.g. tax records for billed subscriptions).

7. Your rights (GDPR / UK GDPR / CCPA)

You have the right to access, correct, delete, export (portability), restrict processing, and object to processing. California residents have the right to opt out of any "sale" or "share" of personal information — we do neither. To exercise any right, email support. We respond within 30 days.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Row-Level Security isolates every tenant. We enforce least-privilege access for our team. Report vulnerabilities to email support.

9. Children

The Service is not directed to children under 16 and we do not knowingly collect data from them.

10. Changes

Material changes will be announced by email or in-app. The "Last updated" date reflects the current version.