Privacy Policy

We collect the following categories of information:

Account information you provide

• Email address, password (hashed), name, profile preferences, language preference;
• Contact information you submit through forms, support requests, or onboarding;
• Marketing or communication preferences.

Marketplace account data (after you connect)

• OAuth refresh tokens for eBay, Amazon, or other connected marketplaces;
• Listing data: titles, descriptions, prices, images, categories, item specifics, inventory, shipping details, return policies, business policies;
• Order, sales, and account status data retrieved from the marketplace as needed to operate Listify;
• Marketplace seller IDs, store names, and similar identifiers.

Billing and subscription data

• Stripe customer ID, subscription ID, plan, status, trial information, and billing cycle;
• Payment method type and last 4 digits as returned by Stripe (Listify does not store full card numbers, CVCs, or full bank account numbers);
• Invoice and receipt records.

AI inputs and outputs

• Product information, photos, and notes you submit for AI processing;
• AI-generated titles, descriptions, keywords, prices, and analyses returned to you.

Usage and technical data

• Device type, operating system, browser type and version, IP address, language, time zone;
• Pages viewed, features used, error logs, performance logs, and timestamps;
• Referrer, page URL, user agent string for support requests;
• Authentication session cookies.

Support communications

• Messages, screenshots, attachments, and metadata you submit through /support or by email;
• Resolution status, internal notes, and ticket history.

We use the information we collect to:

• Provide, operate, secure, and improve the Service;
• Authenticate you and maintain your session;
• Connect to marketplaces on your behalf and execute actions you request;
• Generate, optimize, suggest, and process listings using AI;
• Process payments, manage subscriptions, and send billing notifications;
• Enforce usage limits, free-trial allowances, and plan entitlements;
• Respond to support requests, troubleshoot, and provide customer service;
• Detect, prevent, and respond to fraud, abuse, security incidents, and policy violations;
• Comply with legal obligations, enforce our Terms of Service, and resolve disputes;
• Send transactional and service-related communications;
• Improve reliability, monitor performance, and develop new features.

When you connect your eBay, Amazon, or other marketplace account, Listify receives and stores OAuth tokens (refresh tokens and, where applicable, access tokens) issued by that marketplace. These tokens allow Listify to act on your behalf within the scopes you authorized.

OAuth tokens are stored in our database and protected by access controls. We use them only to perform operations you initiate or authorize, such as creating, updating, ending, or syncing listings, retrieving catalog data, applying policies, and maintaining the active connection.

You may revoke marketplace access at any time from Settings, which deletes the corresponding token from our systems. You may also revoke access directly from the marketplace's authorization settings. After revocation, certain processing performed before revocation may remain in logs and backups for the periods described in Section 13.

We do not sell or share your OAuth tokens or marketplace credentials with third parties.

Payments are processed by Stripe, Inc. (“Stripe”). When you provide payment information, you submit it directly to Stripe's systems through Stripe Elements or Stripe Checkout. Listify does not see, store, or transmit your full card number, CVC, or full bank account number.

From Stripe, Listify receives and stores: your Stripe customer and subscription IDs, your plan and billing status, payment method type and last 4 digits, country, ZIP/postal code as returned by Stripe, invoice and charge records, refund records, and webhook event data.

Stripe's handling of your payment data is governed by Stripe's privacy policy at stripe.com/privacy.

Listify uses third-party artificial intelligence providers to generate listing content and verify product photos based on the product information, photos, and instructions you submit. Your inputs are transmitted to the relevant AI provider for processing; the outputs are returned and stored in your account. Our current AI providers are:

• Google Gemini — listing content generation (titles, descriptions, keywords, analyses). Data processed: product information, photos, and notes you submit. Region: United States and Google global locations. Privacy policy: policies.google.com/privacy.
• Anthropic, PBC (Claude AI) — product detection and catalog/slot verification via the verify-slot-image endpoint. Data processed: product photos you upload for catalog/listing verification and associated auto-generated text snippets. Purpose: AI-powered product detection and listing optimization. Region: United States. Privacy policy: anthropic.com/privacy. Retention: Anthropic does not retain inputs or outputs by default for API customers; ArtechGarage maintains an API-only relationship (no opt-in to model training).

We use commercially reasonable contractual and technical safeguards to limit how providers may process your AI inputs and outputs. We do not authorize AI providers to use your inputs to train their generally available base models when contractually possible to opt out. We do not warrant that providers will not retain logs for abuse prevention, security, or model evaluation as permitted by their own policies.

You should not submit information through AI features that you are not authorized to share with third-party AI providers, including confidential third-party information, regulated personal data, or trade secrets.

Listify uses two privacy-respecting analytics providers to understand how the Service is used, catch UX bugs, and prioritize improvements. Both load after the page becomes interactive (no critical-path cost) and can be disabled with standard blocker extensions.

Google Analytics 4 (GA4)

• Measurement ID: G-XXXXXXXXXX (configured via environment variable; the active value appears in each page's HTML).
• What it captures: page views, basic interaction events (CTA clicks, form submissions, signup completion), device type, browser, country approximated from IP, referrer, browser language, session duration.
• Privacy configuration: anonymize_ip: true (IP is truncated before storage), Google Signals disabled (no cross-device enrichment using Google account data), allow_ad_personalization_signals: false (data is not used for advertising audiences).
• Why we use it: understand which features are used, where users drop off in onboarding, and which improvements to prioritize.
• Provider policy: policies.google.com/privacy.

Microsoft Clarity

• Project ID: XXXXXXXXXX (configured via environment variable; the active value appears in each page's HTML).
• What it captures: anonymized session recordings (mouse moves, clicks, scroll, keystrokes in non-sensitive fields), aggregate heatmaps, rage-click and dead-click metrics. Sensitive fields (passwords, card numbers) are automatically masked by Clarity.
• Why we use it: detect UX friction that doesn't surface in aggregate metrics (broken buttons, confusing forms, layouts that break in specific browsers).
• Provider policy: privacy.microsoft.com/privacystatement.

How to opt out

• Install the Google Analytics Opt-out Browser Add-on to block GA4 across all sites.
• Use standard blocker extensions (uBlock Origin, Privacy Badger, Ghostery) — they block both GA4 and Clarity automatically.
• Enable your browser's “Do Not Track” signal — we do not honor it automatically today (see Section 19), but future versions of the Service may, and that change will be documented here.
• In browsers with native tracker blocking (Brave, Safari ITP, Firefox Strict mode), both GA4 and Clarity are blocked by default.

Both scripts can be fully disabled in development and preview builds. If you stop seeing the analytics footprint in production, open a ticket at /support.

Listify requests permission to access your camera and photos on supported mobile devices and browsers to enable two specific features of the Service:

• Barcode scanning via the html5-qrcodelibrary, which uses your device's live camera stream to detect and decode UPC/EAN/ISBN codes on physical products.
• Product photo capture for creating listings (main photo, additional photos, item condition) and for AI-powered catalog verification.

Camera and photos are only accessed when you actively use these features. The camera stream used by the barcode scanner is transient — it is processed locally on your device, and the raw video frames are not stored or transmitted to our servers. Only the decoded barcode (text) is sent to look up the product.

Photos you capture or upload as listing photos are: (a) transmitted to our AI providers (Google Gemini, Anthropic) for product detection and verification under Section 5, and/or (b) stored as listing photos in your account using Supabase Storage. Photos are encrypted in transit (TLS) and protected at rest via Row Level Security (RLS) — only you can access your own photos.

Camera access is denied by default and requires explicit operating-system or browser-level permission. You may deny the permission prompt and still use Listify (with reduced functionality). You can revoke camera access at any time from your OS settings (Android: Settings → Apps → Listify → Permissions; iOS: Settings → Listify; browser: site permissions settings).

We use cookies and similar technologies to operate the Service. Today, Listify uses primarily:

• Authentication cookies set by Supabase Auth to keep you signed in across pages and devices.
• Session cookies required for security, CSRF protection, and load balancing.
• Preference cookies that remember your language and locale.

We do not currently use third-party advertising cookies. If we add analytics or advertising cookies in the future, we will update this Privacy Policy and our Cookie Policy at /cookies and provide appropriate consent mechanisms where required by law.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from signing in or using key features of the Service.

Listify shares information with third-party service providers that help us operate the Service. These providers process information only as needed to perform their functions and are bound by confidentiality and data protection obligations. Current providers include:

• Supabase — database, authentication, file storage (account data, listings, OAuth tokens, support tickets, attachments).
• Stripe — payment processing and subscription billing.
• Vercel — frontend hosting, edge runtime, and CDN.
• Railway — backend (FastAPI) hosting.
• Upstash Redis — rate limiting and short-term usage counters.
• Google Gemini — AI generation of listing content.
• Anthropic, PBC (Claude AI) — AI-powered product photo verification and catalog detection.
• Resend — transactional email delivery (including support ticket notifications).
• Google Analytics 4 — site usage analytics (page views, events, aggregate metrics). See Section 6.
• Microsoft Clarity — anonymized session recordings and heatmaps for UX friction detection. See Section 6.
• eBay, Amazon, and other marketplaces — when you publish or sync listings, your listing data is transmitted to these marketplaces under your seller account.
• Shippo or similar — shipping label and tracking integrations, when used.

We may add or change service providers as the Service evolves. Material changes that affect how your personal information is processed will be reflected in updates to this Privacy Policy.

We share information in the following limited circumstances:

• With marketplaces when you publish, update, or sync listings under your authorization;
• With service providers as described in Section 9;
• When required by law, subpoena, court order, or government request;
• To enforce our Terms of Service, investigate fraud or abuse, or protect rights, property, or safety;
• In connection with a merger, acquisition, reorganization, asset sale, or change of control, in which case we will use reasonable efforts to ensure the recipient continues to honor this Privacy Policy;
• With your direct consent for any purpose not otherwise described.

We do not sell or rent your personal information.

Listify is operated from the United States. Information you provide is processed and stored on infrastructure located in the United States and other countries where our service providers operate. By using the Service, you understand that your information may be transferred to and processed in the United States, where data protection laws may differ from the laws of your jurisdiction.

When required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms to protect personal information during international transfers.

We use reasonable administrative, technical, and organizational safeguards to protect personal information and OAuth tokens, including encrypted transport (TLS), access controls, role-based authorization, secret management for API keys, and audit logging.

No method of transmission, storage, or processing is completely secure. We cannot guarantee absolute security. You are responsible for maintaining a strong password, safeguarding your devices, and promptly revoking access if you suspect unauthorized use.

If we determine that a security incident requires notification under applicable law, we will provide notice in accordance with applicable legal requirements.

We retain account data, OAuth tokens, listing data, billing records, AI inputs and outputs, support records, and related information only as long as reasonably necessary to provide the Service, maintain security, comply with legal obligations, resolve disputes, enforce agreements, improve reliability, and operate our business.

You may request account deletion or revoke marketplace access at any time from Settings or by contacting info@artechgarage.com. After deletion, certain records may remain for a limited period in backups, billing systems, fraud prevention systems, audit logs, security systems, and legal records as permitted or required by law. See Section 14 for the full account-deletion flow.

Listify users may delete their account at any time. We provide two equivalent methods to initiate deletion:

• In-app:Settings → “Delete account”. This action is available to all authenticated users.
• Public URL: listify.artechgarage.com/account/delete — processes the same flow with email confirmation, without requiring an active login in the app.

What gets deleted

• Your profile and account data;
• Listing drafts, saved drafts, and user-generated configurations;
• Preferences, language, and profile settings;
• OAuth tokens for eBay, Amazon, and other connected marketplaces (immediate revocation);
• Your subscription is automatically cancelled via Stripe;
• Payment data in Stripe is masked per Stripe's retention rules.

Retention exceptions (data we must keep by law)

• Tax and billing records: 7 years (required by U.S. IRS);
• Abuse, fraud, and security logs: 90 days, for Service protection;
• Minimum legal audit logs required by applicable law.

Timelines

• Email confirmation sent within 24 hours of the request;
• Full deletion within 30 days, consistent with CCPA and GDPR;
• Account deletion is final and irreversible — once processed, neither the account nor its data can be recovered.

If you have questions about the deletion process or need assistance, contact info@artechgarage.com.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access to the personal information we hold about you;
• Correction of inaccurate or incomplete information;
• Deletion of personal information, subject to legal exceptions;
• Restriction or objection to certain processing;
• Portability of your information in a machine-readable format;
• Withdrawal of consent for processing based on consent;
• Opt-out of marketing communications (transactional messages remain).

To exercise these rights, contact info@artechgarage.com. We may verify your identity before responding. We will respond within the timeframes required by applicable law.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), grants you specific rights regarding your personal information.

Categories of personal information collected

In the past twelve (12) months, we have collected the categories of information described in Section 1, including identifiers, commercial information, internet or network activity, geolocation data (general), professional or employment information (seller activity), and inferences derived from such information.

Sources, purposes, and disclosures

The sources of this information are: you, your devices, marketplaces you connect, payment processors, and AI providers. The purposes are described in Section 2. We disclose information to the service providers in Section 9 and to marketplaces under your authorization.

Right to know, delete, correct, and limit

California residents may request the right to know, delete, or correct personal information, and to limit our use of sensitive personal information.

No sale or sharing for cross-context behavioral advertising

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

Non-discrimination

We will not discriminate against you for exercising your privacy rights.

Authorized agents

You may designate an authorized agent to make a request on your behalf. We may require verification of your identity and the agent's authority.

To exercise California rights, contact info@artechgarage.com.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation, the UK GDPR, or equivalent law (collectively, “GDPR”).

Legal bases for processing

• Performance of a contract with you (operating the Service, processing payments);
• Compliance with our legal obligations;
• Our legitimate interests in operating, securing, and improving the Service, balanced against your rights;
• Your consent, where required (for example, certain optional cookies or marketing).

Your rights

• Access to your personal information;
• Rectification of inaccurate information;
• Erasure of your information, subject to legal exceptions;
• Restriction of processing;
• Objection to processing based on legitimate interests;
• Data portability;
• Withdrawal of consent at any time, without affecting prior lawful processing;
• Lodging a complaint with your local supervisory authority.

To exercise GDPR rights, contact info@artechgarage.com.

The Service is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will delete the information. If you believe a child under 18 has provided us with personal information, contact us at info@artechgarage.com.

Some browsers transmit “Do Not Track” signals. Because there is no consistent industry standard for responding to these signals, the Service does not currently respond to them. We will update this Privacy Policy if our practices change.

We may update this Privacy Policy from time to time as the Service evolves or as legal, security, or business requirements change. The “Last updated” date at the top reflects the most recent version.

For material changes, we will make reasonable efforts to notify you by email, in-app notice, or by posting an updated version. Continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy or how we handle your information, contact us at:

ArtechGarage LLC d/b/a Listify
1000 Brickell Ave, Ste 715
Miami, FL 33131
United States
Email: info@artechgarage.com