Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

BRANTELO OÜ (operating as ListsGenie)
Registry Code: 17282632
Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia
Email: support@listsgenie.com
Data Protection enquiries: support@listsgenie.com (subject line: "Data Protection Request")

2. What Data We Collect

We collect the following categories of personal data:

Account Data

• Full name
• Email address
• Password (stored as a one-way hash; we cannot read your password)
• Subscription plan and credit balance

Billing Data

• Payment method details (processed and stored by Stripe; we do not store card numbers)
• Billing address
• Transaction history

Platform Usage Data

• Features used and frequency of use
• AI generation requests and outputs
• Credit consumption logs

Etsy Integration Data

• Etsy OAuth access tokens (stored securely; used only to retrieve your shop/listing data)
• Etsy shop and listing metadata (temporarily cached to power features)

Device and Log Data

• IP address
• Browser type and version
• Operating system
• Time zone and language settings
• Pages visited and session duration (via Google Analytics)
• Error logs

3. Legal Basis for Processing (GDPR – Article 6)

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): To create and manage your account, deliver the subscription service, and process payments.
• Legitimate interests (Art. 6(1)(f)): To improve service quality, detect fraud, ensure platform security, and conduct anonymised analytics.
• Consent (Art. 6(1)(a)): For non-essential cookies and analytics (you may withdraw consent at any time via cookie settings).
• Legal obligation (Art. 6(1)(c)): To comply with tax, accounting, and regulatory requirements.

4. How We Use Your Data

We use your personal data to:

• Create and manage your ListsGenie account;
• Process subscription payments and issue receipts;
• Deliver AI-generated Etsy listing content;
• Provide customer support;
• Send transactional emails (account confirmations, billing receipts, subscription alerts);
• Monitor and improve platform performance and security;
• Comply with applicable legal and regulatory obligations;
• Send service-related communications (material changes to Terms, policy updates).

We do not use your data for unsolicited marketing without your explicit consent.

5. Data Sharing and Sub-Processors

We do not sell, rent, or trade your personal information to third parties.

We share your data only with the following categories of processors, who are contractually bound to protect it:

All sub-processors are required to implement appropriate technical and organisational measures to protect your data and may only process it for the specified purposes.

5A. Etsy API Content and AI Processing

We integrate with Etsy exclusively through the official Etsy API and OAuth 2.0. Etsy-related content accessed through the Service is processed solely to provide features to your account and is not retained for independent analytics, machine learning, or AI model training.

• No model training: We do not use Etsy API content to train, fine-tune, or improve any AI/ML models.
• No cross-user aggregation: We do not combine Etsy API content from multiple users for analytics or benchmarking.
• Inference only: When OpenAI processes your prompts, Etsy data is transmitted only to generate a response. We operate under OpenAI’s API terms, which prohibit using API inputs for model training.
• No scraping: Only Etsy’s official API and permitted OAuth flows are used.
• Limited retention: Etsy OAuth tokens are stored to maintain the active integration. Listing metadata may be short-term cached to improve response times and is not retained beyond operational necessity.
• Disconnect and deletion: Upon disconnecting your Etsy account or requesting account deletion, Etsy OAuth tokens and cached API content are deleted, subject to mandatory legal retention obligations.

6. International Data Transfers

As an Estonian company, your data is processed within the EU/EEA. However, some of our sub-processors (OpenAI, Stripe, DigitalOcean, Google Analytics) are based in the United States. For all such transfers, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, supplemented by appropriate technical safeguards (encryption in transit and at rest, access controls).

UK users: Transfers to and from the United Kingdom are conducted in accordance with the UK GDPR and the UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs, as applicable.

7. Data Retention

8. Your Rights

EU / EEA Residents (GDPR)

Under the GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Ask us to correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): Request deletion of your data (subject to legal retention obligations).
• Right to restrict processing (Art. 18): Ask us to limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You may file a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — www.aki.ee) or the supervisory authority in your country of residence.

UK Residents (UK GDPR)

UK residents have equivalent rights under the UK GDPR. Complaints may be lodged with the Information Commissioner’s Office (ICO — ico.org.uk).

California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to delete: Request deletion of your personal information (subject to certain exceptions).
• Right to correct: Request correction of inaccurate personal information.
• Right to opt-out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising.
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined under CCPA.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise any of the above rights, contact us at support@listsgenie.com with subject line "Privacy Rights Request". We will respond within 45 days (CCPA) or 30 days (GDPR).

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Estonian Data Protection Inspectorate (and/or the ICO for UK users) within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR;
• Notify you directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Art. 34 GDPR), including a description of the nature of the breach, likely consequences, and measures taken;
• Maintain an internal breach register documenting all incidents.

10. Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• HTTPS/TLS encryption for all data in transit;
• Encryption of data at rest;
• Role-based access controls — only authorised personnel access personal data on a need-to-know basis;
• Hashed password storage (bcrypt or equivalent);
• Regular security reviews and vulnerability assessments;
• Secure OAuth token handling for Etsy integration.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@listsgenie.com.

11. Cookies

We use cookies and similar tracking technologies. For a full description of the cookies we use, their purpose, and how to manage them, please see our Cookie Policy.

12. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@listsgenie.com and we will delete such data promptly.

For EU/EEA residents, we do not knowingly process data of children under the age of 16 without verifiable parental consent.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and/or by a prominent notice on our website at least 14 days before the changes take effect. The "Last Updated" date at the top of this Policy reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

14. Chrome Extension Privacy

The ListsGenie Chrome Extension operates as an extension of the main Service and is subject to this Privacy Policy. Specific details:

Data Collected via the Extension

• Product images: Images you upload for listing generation are transmitted to our servers and to OpenAI for processing. Images are not permanently stored; they are deleted immediately after the AI output is returned.
• Generated content: AI-generated titles, descriptions, and tags are temporarily cached (up to 24 hours) for your convenience, then deleted.
• Active tab data: The extension reads the current Etsy listing page only when you actively interact with it on etsy.com.
• Extension preferences: Stored locally in your browser.
• Anonymised usage analytics: Feature interaction metrics sent to Google Analytics.

Browser Permissions Requested

• activeTab — to interact with the current Etsy listing page;
• storage — to save your extension preferences locally;
• Host permission for etsy.com — to enable functionality on Etsy seller pages only.

What the Extension Does NOT Access

• Your browsing history or other websites you visit;
• Personal files on your device;
• Your Etsy account credentials or Etsy API tokens (these are managed server-side);
• Payment information.

Extension Data Retention

• Uploaded images: Deleted immediately after processing.
• Generated content cache: Up to 24 hours.
• Analytics data: Anonymised and aggregated; retained per Google Analytics settings (14 months).
• Local browser storage: Persists until extension is uninstalled or browser data is cleared.

15. Contact and Exercising Your Rights

For any privacy-related enquiry, data access request, or complaint, please contact:

BRANTELO OÜ (Data Controller)
Tornimäe tn 5, 10145 Tallinn, Estonia
Email: support@listsgenie.com
Subject line for data requests: "Privacy Rights Request" or "Data Protection Request"

We will acknowledge your request within 5 business days and provide a full response within 30 days (extendable to 60 days for complex requests, with notice).