Privacy Policy

• Account information — your email address and, if you set one, a password. Passwords are stored only as a salted cryptographic hash by our authentication provider; we never see or store your password in readable form. If you sign in by magic link, we store a record of that sign-in instead.
• Product content — the photographs, videos, digital files, product details and instructions you upload, together with the listing content generated for you.
• Correspondence — the contents of any email or support request you send us, and our replies.

If you choose to connect an Etsy shop, Etsy issues us access tokens under the permissions you approve. We store those tokens, your shop’s identifier and settings, and the listing data needed to operate the Services — including listings we create for you and, where you use the import feature, the content and images of listings you ask us to import.

We never receive or store your Etsy password. You can revoke our access at any time by disconnecting the shop in your settings or from your Etsy account at etsy.com/your/apps.

We collect limited technical information necessary to operate and secure the Services, including usage records such as the number of listings generated and published (used to apply plan allowances), processing history and error logs. Our hosting provider processes standard server request data, such as IP address and browser type, for delivery, performance and security purposes.

We do not operate any analytics, advertising, session-recording, affiliate or cross-site tracking technology on the Services.

We use personal information to:

• create and administer your account and authenticate you;
• provide the Services — researching marketplace data, generating listing content, and creating, updating or publishing listings to your connected shop at your direction;
• apply plan allowances, process payments and manage subscriptions;
• provide support and respond to your enquiries;
• send service communications such as sign-in links, account confirmations, password resets and material changes to our terms;
• maintain security, prevent and investigate abuse or fraud, and diagnose and fix faults;
• comply with our legal obligations and enforce our agreements.

Where the UK or EU General Data Protection Regulation applies, we rely on the following legal bases: performance of a contract for providing the Services, administering your account and taking payment; legitimate interests for security, abuse prevention, fault diagnosis and improving the Services, balanced against your rights; consent for connecting your Etsy shop and any optional feature you switch on, which you may withdraw at any time; and compliance with legal obligations where applicable law requires it.

To generate listing content, we transmit your product photographs and the product details you provide to our artificial intelligence provider, currently Google (Gemini). That provider processes this material to return generated text to us, and its handling is governed by its own terms and privacy commitments.

We send only what is required to produce the listing. We do not transmit your account credentials, your payment details or your Etsy access tokens to the AI provider, and we do not sell your content or provide it to any third party for the training of their models.

We do not sell your personal information, and we do not disclose it to third parties for their own marketing. We share it only with the service providers necessary to run the Services, each of which is authorised to process it solely on our behalf and under confidentiality obligations:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.
• Google — artificial intelligence processing, as described in §6.
• Stripe — payment processing and subscription management.
• Resend — delivery of transactional email.
• Etsy — receives the listing content and images you direct us to publish, under your own relationship with Etsy.

We may also disclose personal information where required by law, court order or a lawful request from a public authority; where necessary to establish, exercise or defend legal claims; to protect the rights, safety or property of ListingComet, our users or the public; or to a successor entity in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, storage on infrastructure that encrypts data at rest, passwords held only as salted hashes by our authentication provider, row-level database rules that restrict each account to its own records, Etsy access tokens held in a table that is not readable by the browser or by other accounts, scoped access controls for administrative operations, and storage of secrets outside the application codebase.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@listingcomet.com. Where a data breach affecting your personal information occurs, we will notify you and the relevant regulators to the extent required by applicable law.

Depending on where you live, you may have some or all of the following rights in respect of your personal information: to be informed how it is used; to access a copy of it; to have inaccurate information corrected; to have it deleted; to receive it in a portable format; to object to or restrict certain processing; to withdraw consent you have given; and to opt out of any sale or sharing of personal information — noting that we do not sell or share personal information in the sense used by those laws.

To exercise any of these rights, email support@listingcomet.com. We will respond within the period required by applicable law. We may need to verify your identity before acting, normally by confirming control of the email address registered to the account, and we may decline a request where the law permits — for example where it would infringe another person’s rights or where we are required to retain the information. We will not discriminate against you for exercising your rights.

You also have the right to complain to your local data protection authority. If you are in the UK this is the Information Commissioner’s Office; in Australia, the Office of the Australian Information Commissioner; in the EEA, your national supervisory authority.

We use only what is necessary for the Services to function. Specifically: cookies set by our authentication provider to keep you signed in and to protect against cross-site request forgery, and an entry in your browser’s local storage that remembers your light or dark theme preference.

We do not use advertising cookies, analytics cookies, tracking pixels, tag managers or any cross-site tracking technology. Blocking essential cookies will prevent you from signing in.