Privacy policy

1.1 Account data

When you register for an account, we collect:

• Name: to personalise your experience.
• Email address: for authentication, transactional emails and account recovery.
• Password hash: we store a bcrypt hash of your password, never the plaintext password.
• OAuth profile data: if you sign in with Google, we receive your name, email address and profile picture from Google.

1.2 Listing data

When you use the listing scanner, we collect the Etsy listing URL you submit and the listing data we retrieve from it (title, description, tags, price, category). This data is used to run the compliance scan and is stored in your account for future reference. We do not store listing data beyond what is needed to display your scan history.

1.3 Appeal questionnaire data

When you use the appeal letter generator, we collect your answers to the multi-step questionnaire (suspension type, Etsy's stated reason, shop details, steps taken, supporting documentation references and any additional context you provide). This data is used to generate your appeal letter and is stored in your account so you can review it later.

1.4 Etsy shop connection and API-sourced data

If you connect your Etsy shop (on eligible plans), we receive and store data from Etsy via authorised API access. This may include your shop identifier, shop name, OAuth tokens (handled as sensitive credentials with restricted access), listing fields (title, description, tags, price, image URLs and similar metadata), and review content needed to provide compliance, import, monitoring and shop health features.

Vetsy uses this access in a read-oriented manner to pull data into your account. We do not modify your Etsy listings, prices or policies through the Service, and we do not post buyer-facing responses on Etsy for you unless we separately introduce and clearly disclose an opt-in automation. Today, any review reply text we show is a draft for you to post yourself on Etsy.

1.5 Payment data

We do not collect or store payment card information. All payment processing is handled by LemonSqueezy, our payment processor. We receive confirmation of payment events (for example, subscription created or subscription cancelled) and store subscription status only. Please review LemonSqueezy's privacy policy for details of how they handle payment data.

1.6 Usage data

We collect usage data to operate and improve the Service, including:

• Pages visited, features used and time spent on the Service.
• Scan and appeal credit usage counts.
• An account activity log (sign-ins and failed sign-in attempts, pages visited in your dashboard, scans, appeals, billing events, shop syncs and settings changes) with the IP address, approximate country and browser or device type of each event. We use it to secure accounts (for example, to detect password guessing), provide support and investigate abuse. It is retained for 180 days and deleted with your account.
• Server logs, including IP address, browser type and request timestamps (retained for up to 30 days for security purposes).
• Error reports: when something breaks, technical details about the error are sent to our error monitoring provider (see section 3).

We use the data we collect to:

• Create and manage your account.
• Provide the listing scanner and appeal generator features.
• Process payments and manage subscriptions (via LemonSqueezy).
• Send transactional emails, such as email verification, password reset and appeal-ready notifications (via Resend). You can disable non-essential notifications in your account settings.
• Improve the Service: analyse usage patterns to identify bugs and prioritise new features (using anonymised or aggregated data where possible).
• Detect, diagnose and fix errors and outages (via Sentry).
• Comply with legal obligations and enforce our terms of service.

We share data with the following trusted third-party service providers (processors), solely to the extent necessary to deliver the Service:

• LemonSqueezy: payment processing and subscription management. Receives: email address, name and payment details (card data is processed directly by LemonSqueezy and not passed to us).
• Anthropic: AI generation of appeal letters. Receives: your appeal questionnaire answers and listing context. Anthropic processes this data to generate your letter. Please review Anthropic's privacy policy.
• Resend: transactional email delivery. Receives: your email address and name for the purpose of sending emails you have requested (verification, password reset, notifications).
• Vercel: website hosting and serverless infrastructure. Processes request data (IP addresses, request logs) as part of serving the application.
• Sentry (Functional Software, Inc.): error monitoring. When an error occurs, receives technical details about it, such as the stack trace, the page URL, browser and device type, and IP address. For browser sessions that hit an error, Sentry may also receive a session replay in which all text is masked and all media is blocked. We use this only to find and fix problems. Please review Sentry's privacy policy.
• Etsy API and shop tokens: when you connect a shop, Etsy may process authentication requests per Etsy's policies. Access and refresh tokens are encrypted at rest (AES-256-GCM), are never sent to your browser, and are only used to read your shop, listings and reviews. Disconnecting your shop in Vetsy immediately deletes the tokens and the listings and reviews we imported.
• Supabase / PostgreSQL: encrypted database hosting for all account, scan, appeal and synced shop data.

We do not sell your personal data to any third party. We do not use your data for advertising purposes and we do not share data with advertising networks.

• Account data (name, email, password hash): retained until you delete your account.
• Imported Etsy listings and synced reviews: retained while your account is active and the shop remains connected. If you disconnect your Etsy shop or delete your account, we delete Etsy OAuth tokens promptly and remove or anonymise synced listing and review copies tied to that connection within 30 days, except where a record is needed for legitimate legal or security purposes.
• Scan history: retained for 12 months from the date of the scan, after which it is automatically deleted. You can delete individual scans at any time.
• Appeal letters: retained indefinitely so you can access them in the future. You can delete individual appeals at any time.
• Payment records: subscription event logs are retained for 7 years to meet financial record-keeping obligations.
• Server logs: retained for up to 30 days.
• Error reports: retained by Sentry for a limited period under its standard data retention settings, then deleted.
• When you delete your account, all personal data associated with your account (scans, appeals, profile information) is permanently deleted within 30 days, except where retention is required by law.

We use a minimal set of cookies necessary to operate the Service:

• Session cookie: set by NextAuth.js to maintain your login session. This is an essential cookie required for authentication. It expires when you sign out or after 30 days of inactivity.
• CSRF token cookie: set by NextAuth.js to protect against cross-site request forgery attacks.

We do not use advertising cookies, tracking pixels or third-party analytics cookies. We do not use Google Analytics or any equivalent service that tracks individual users across websites.

Your browser's cookie settings can be used to delete or block cookies, but this may prevent you from using the authenticated features of the Service.

Depending on your location, you may have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to correction: you can update your name and email in your account settings at any time.
• Right to erasure (“right to be forgotten”): you can delete your account from your settings page. This permanently deletes all personal data associated with your account within 30 days.
• Right to data portability: download a copy of your data (profile, scans, appeal letters, imported listings and reviews, activity log) at any time from Settings, Account, Download my data, or email support@vetsy.io.
• Right to object or restrict processing: you can ask us to stop processing your data for specific purposes. Note that this may prevent us from providing the Service.
• Right to lodge a complaint: if you are in the EU or UK, you have the right to lodge a complaint with your local data protection authority (for example, the ICO in the UK).

6.1 Lawful basis for processing (GDPR)

For users in the EU/EEA, we process your data on the following lawful bases:

• Contract: processing necessary to provide the Service you have signed up for (account management, scan and appeal features, billing).
• Legitimate interest: service improvement, error monitoring, security monitoring and fraud prevention.
• Legal obligation: retention of payment records.
• Consent: sending non-essential marketing communications (you may withdraw consent at any time in your notification settings).

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS (TLS) encryption for all data in transit.
• bcrypt hashing for all stored passwords.
• Encrypted database storage via Supabase.
• Restricted handling of Etsy OAuth secrets (access limited to what the Service needs).
• Role-based access controls: only your own data is accessible to you.
• Rate limiting on authentication endpoints to prevent brute-force attacks.

No system is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by applicable law.

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this privacy policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 14 days before the changes take effect.

For any privacy-related questions, requests to exercise your rights, or data export requests, please contact us at:

Email: support@vetsy.io

We will respond to all requests within 30 days.