Privacy Policy

We collect the following categories of information:

Account information you provide

• Email address, password (hashed), name, profile preferences, language preference;
• Contact information you submit through forms, support requests, or onboarding;
• Marketing or communication preferences.

Marketplace account data (after you connect)

• OAuth refresh tokens for eBay, Amazon, or other connected marketplaces;
• Listing data: titles, descriptions, prices, images, categories, item specifics, inventory, shipping details, return policies, business policies;
• Order, sales, and account status data retrieved from the marketplace as needed to operate Listify;
• Marketplace seller IDs, store names, and similar identifiers.

Billing and subscription data

• Stripe customer ID, subscription ID, plan, status, trial information, and billing cycle;
• Payment method type and last 4 digits as returned by Stripe (Listify does not store full card numbers, CVCs, or full bank account numbers);
• Invoice and receipt records.

AI inputs and outputs

• Product information, photos, and notes you submit for AI processing;
• AI-generated titles, descriptions, keywords, prices, and analyses returned to you.

Usage and technical data

• Device type, operating system, browser type and version, IP address, language, time zone;
• Pages viewed, features used, error logs, performance logs, and timestamps;
• Referrer, page URL, user agent string for support requests;
• Authentication session cookies.

Support communications

• Messages, screenshots, attachments, and metadata you submit through /support or by email;
• Resolution status, internal notes, and ticket history.

We use the information we collect to:

• Provide, operate, secure, and improve the Service;
• Authenticate you and maintain your session;
• Connect to marketplaces on your behalf and execute actions you request;
• Generate, optimize, suggest, and process listings using AI;
• Process payments, manage subscriptions, and send billing notifications;
• Enforce usage limits, free-trial allowances, and plan entitlements;
• Respond to support requests, troubleshoot, and provide customer service;
• Detect, prevent, and respond to fraud, abuse, security incidents, and policy violations;
• Comply with legal obligations, enforce our Terms of Service, and resolve disputes;
• Send transactional and service-related communications;
• Improve reliability, monitor performance, and develop new features.

When you connect your eBay, Amazon, or other marketplace account, Listify receives and stores OAuth tokens (refresh tokens and, where applicable, access tokens) issued by that marketplace. These tokens allow Listify to act on your behalf within the scopes you authorized.

OAuth tokens are stored in our database and protected by access controls. We use them only to perform operations you initiate or authorize, such as creating, updating, ending, or syncing listings, retrieving catalog data, applying policies, and maintaining the active connection.

You may revoke marketplace access at any time from Settings, which deletes the corresponding token from our systems. You may also revoke access directly from the marketplace's authorization settings. After revocation, certain processing performed before revocation may remain in logs and backups for the periods described in Section 11.

We do not sell or share your OAuth tokens or marketplace credentials with third parties.

Payments are processed by Stripe, Inc. (“Stripe”). When you provide payment information, you submit it directly to Stripe's systems through Stripe Elements or Stripe Checkout. Listify does not see, store, or transmit your full card number, CVC, or full bank account number.

From Stripe, Listify receives and stores: your Stripe customer and subscription IDs, your plan and billing status, payment method type and last 4 digits, country, ZIP/postal code as returned by Stripe, invoice and charge records, refund records, and webhook event data.

Stripe's handling of your payment data is governed by Stripe's privacy policy at stripe.com/privacy.

Listify uses third-party artificial intelligence providers, including Google Gemini, to generate listing content based on the product information, photos, and instructions you submit. Your inputs are transmitted to the AI provider for processing; the outputs are returned and stored in your account.

We use commercially reasonable contractual and technical safeguards to limit how providers may process your AI inputs and outputs. We do not authorize AI providers to use your inputs to train their generally available base models when contractually possible to opt out. We do not warrant that providers will not retain logs for abuse prevention, security, or model evaluation as permitted by their own policies.

You should not submit information through AI features that you are not authorized to share with third-party AI providers, including confidential third-party information, regulated personal data, or trade secrets.

We use cookies and similar technologies to operate the Service. Today, Listify uses primarily:

• Authentication cookies set by Supabase Auth to keep you signed in across pages and devices.
• Session cookies required for security, CSRF protection, and load balancing.
• Preference cookies that remember your language and locale.

We do not currently use third-party advertising cookies. If we add analytics or advertising cookies in the future, we will update this Privacy Policy and our Cookie Policy at /cookies and provide appropriate consent mechanisms where required by law.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from signing in or using key features of the Service.

Listify shares information with third-party service providers that help us operate the Service. These providers process information only as needed to perform their functions and are bound by confidentiality and data protection obligations. Current providers include:

• Supabase — database, authentication, file storage (account data, listings, OAuth tokens, support tickets, attachments).
• Stripe — payment processing and subscription billing.
• Vercel — frontend hosting, edge runtime, and CDN.
• Railway — backend (FastAPI) hosting.
• Upstash Redis — rate limiting and short-term usage counters.
• Google Gemini — AI generation of listing content.
• Resend — transactional email delivery (including support ticket notifications).
• eBay, Amazon, and other marketplaces — when you publish or sync listings, your listing data is transmitted to these marketplaces under your seller account.
• Shippo or similar — shipping label and tracking integrations, when used.

We may add or change service providers as the Service evolves. Material changes that affect how your personal information is processed will be reflected in updates to this Privacy Policy.

We share information in the following limited circumstances:

• With marketplaces when you publish, update, or sync listings under your authorization;
• With service providers as described in Section 7;
• When required by law, subpoena, court order, or government request;
• To enforce our Terms of Service, investigate fraud or abuse, or protect rights, property, or safety;
• In connection with a merger, acquisition, reorganization, asset sale, or change of control, in which case we will use reasonable efforts to ensure the recipient continues to honor this Privacy Policy;
• With your direct consent for any purpose not otherwise described.

We do not sell or rent your personal information.

Listify is operated from the United States. Information you provide is processed and stored on infrastructure located in the United States and other countries where our service providers operate. By using the Service, you understand that your information may be transferred to and processed in the United States, where data protection laws may differ from the laws of your jurisdiction.

When required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms to protect personal information during international transfers.

We use reasonable administrative, technical, and organizational safeguards to protect personal information and OAuth tokens, including encrypted transport (TLS), access controls, role-based authorization, secret management for API keys, and audit logging.

No method of transmission, storage, or processing is completely secure. We cannot guarantee absolute security. You are responsible for maintaining a strong password, safeguarding your devices, and promptly revoking access if you suspect unauthorized use.

If we determine that a security incident requires notification under applicable law, we will provide notice in accordance with applicable legal requirements.

We retain account data, OAuth tokens, listing data, billing records, AI inputs and outputs, support records, and related information only as long as reasonably necessary to provide the Service, maintain security, comply with legal obligations, resolve disputes, enforce agreements, improve reliability, and operate our business.

You may request account deletion or revoke marketplace access at any time from Settings or by contacting info@artechgarage.com. After deletion, certain records may remain for a limited period in backups, billing systems, fraud prevention systems, audit logs, security systems, and legal records as permitted or required by law.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access to the personal information we hold about you;
• Correction of inaccurate or incomplete information;
• Deletion of personal information, subject to legal exceptions;
• Restriction or objection to certain processing;
• Portability of your information in a machine-readable format;
• Withdrawal of consent for processing based on consent;
• Opt-out of marketing communications (transactional messages remain).

To exercise these rights, contact info@artechgarage.com. We may verify your identity before responding. We will respond within the timeframes required by applicable law.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), grants you specific rights regarding your personal information.

Categories of personal information collected

In the past twelve (12) months, we have collected the categories of information described in Section 1, including identifiers, commercial information, internet or network activity, geolocation data (general), professional or employment information (seller activity), and inferences derived from such information.

Sources, purposes, and disclosures

The sources of this information are: you, your devices, marketplaces you connect, payment processors, and AI providers. The purposes are described in Section 2. We disclose information to the service providers in Section 7 and to marketplaces under your authorization.

Right to know, delete, correct, and limit

California residents may request the right to know, delete, or correct personal information, and to limit our use of sensitive personal information.

No sale or sharing for cross-context behavioral advertising

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

Non-discrimination

We will not discriminate against you for exercising your privacy rights.

Authorized agents

You may designate an authorized agent to make a request on your behalf. We may require verification of your identity and the agent's authority.

To exercise California rights, contact info@artechgarage.com.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation, the UK GDPR, or equivalent law (collectively, “GDPR”).

Legal bases for processing

• Performance of a contract with you (operating the Service, processing payments);
• Compliance with our legal obligations;
• Our legitimate interests in operating, securing, and improving the Service, balanced against your rights;
• Your consent, where required (for example, certain optional cookies or marketing).

Your rights

• Access to your personal information;
• Rectification of inaccurate information;
• Erasure of your information, subject to legal exceptions;
• Restriction of processing;
• Objection to processing based on legitimate interests;
• Data portability;
• Withdrawal of consent at any time, without affecting prior lawful processing;
• Lodging a complaint with your local supervisory authority.

To exercise GDPR rights, contact info@artechgarage.com.

The Service is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will delete the information. If you believe a child under 18 has provided us with personal information, contact us at info@artechgarage.com.

Some browsers transmit “Do Not Track” signals. Because there is no consistent industry standard for responding to these signals, the Service does not currently respond to them. We will update this Privacy Policy if our practices change.

We may update this Privacy Policy from time to time as the Service evolves or as legal, security, or business requirements change. The “Last updated” date at the top reflects the most recent version.

For material changes, we will make reasonable efforts to notify you by email, in-app notice, or by posting an updated version. Continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy or how we handle your information, contact us at:

ArtechGarage LLC d/b/a Listify
Email: info@artechgarage.com