Privacy Policy

1. Data controller

This Privacy Policy describes how the Etsnipe service collects, uses and protects personal data, in accordance with the General Data Protection Regulation (Regulation EU 2016/679, "GDPR") and the French Data Protection Act ("Loi Informatique et Libertés") as amended.

The data controller is:

Given the size of the structure and the volumes processed, the appointment of a Data Protection Officer (DPO) is not legally mandatory under article 37 of the GDPR. Any request relating to personal data is processed directly by the publisher at the email address indicated above.

2. Data collected

The publisher collects only the data strictly necessary for the operation of the service. The categories of data collected are the following:

• Account data: email address, first name (optional), password (encrypted), date of account creation, language preference.
• Billing data: billing details (name, address if applicable), invoice history. Banking details (card number) are NEVER collected or stored by the publisher; they are processed directly by Stripe.
• Usage data: number of listings generated, number of images generated, credit balance, action history within the service, error logs.
• Connection data (last login IP, date and user-agent): at each successful authentication, the publisher records the IP address used, the date/time of the connection and the user-agent (browser / operating system) on the user profile. Purposes: account security, detection of multiple-account fraud, proof of access in case of dispute. Legal basis: legitimate interest of the publisher in protecting the service against unauthorised access and abuse (art. 6.1.f GDPR). Retention: 6 months on a rolling basis (overwritten at each new connection — only the last connection is kept on the profile beyond this period). Action logs (connection history) are retained for 12 months maximum as indicated in section 4.
• Content data: the product data you import via the extension and the listings generated by the AI. These data are stored on your account so that you can find them and re-export them.
• Publishing diagnostics: if the automatic publishing of a listing on Etsy fails, the extension sends the publisher the current step, the error message and a simplified copy of the Etsy form (no scripts, no embedded images, no account header and no email, phone or password fields). Purpose: understanding and fixing the failure. Legal basis: legitimate interest of the publisher in keeping the service working (art. 6.1.f GDPR). Retention: 90 days.
• Technical data: browser type, operating system, screen resolution, language. Collected anonymously for the operation of the service.
• Communications: emails exchanged with support, messages sent via the contact form.

The publisher does NOT collect sensitive data within the meaning of article 9 of the GDPR (health, sexual orientation, political opinions, religious beliefs, etc.).

3. Purposes and legal bases

The data are processed for the following purposes, each based on a specific legal basis under article 6 of the GDPR:

• Provision of the service (account, generation, history): performance of the contract (art. 6.1.b GDPR).
• Order management and billing: performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR).
• Support and customer relations: performance of the contract and legitimate interest (art. 6.1.b and 6.1.f GDPR).
• Security of the service (logs, fraud prevention): legitimate interest (art. 6.1.f GDPR).
• Commercial communications (newsletters, new feature announcements): consent (art. 6.1.a GDPR), revocable at any time via an unsubscribe link.
• Anonymous statistics on usage: legitimate interest (art. 6.1.f GDPR).

4. Retention period

The publisher retains personal data for limited periods, depending on their nature and purpose:

• Account data: for the entire duration of the account, then deleted within 30 days of closure of the account, except in the event of a legal retention obligation.
• Billing data: retained for 10 years from the issue of the invoice, in accordance with the French Commercial Code (article L.123-22).
• Action logs and connection logs: 12 months maximum.
• Anonymous error logs: 90 days.
• Generated content (listings, products imported in the account): for the entire duration of the account.
• Support communications: 3 years from the last contact.
• Inactive accounts: the user is notified by email after 24 months of inactivity. Without reaction within 30 days, the account is deleted.

5. Recipients and processors

Your data are accessed only by the publisher and by a limited number of processors strictly necessary to the operation of the service, bound by a processing agreement compliant with article 28 of the GDPR. The categories of processors and their role are the following:

• Cloud hosting and database (European Union): hosting of the application, the user database and the generated content. Operates under European servers.
• Application hosting platform (global, headquartered in the United States): serves the web interface of the service and the API.
• Payment provider (Stripe Payments Europe Ltd., Ireland and United States): processes payments, manages subscriptions and recurring billing. Banking data is processed exclusively by this provider, certified PCI DSS Level 1.
• Generative AI providers (text and image, established outside the European Union, in particular in the United States): used to generate listings and images on demand by the user. They receive only the data necessary for the generation (product description, generation parameters) and have no direct access to the user account.
• Transactional email provider: sends order confirmations, password resets and important notifications.
• Anonymous web analytics tool: measures the audience of the service without individual identification.

The nominative list of processors used at any given time is available on simple request by writing to contact@etsnipe.app. The publisher does not sell, rent or share personal data with third parties for advertising purposes.

6. Transfers outside the EU

Some processors (notably the application hosting platform, the payment provider and the generative AI providers) are established outside the European Union, in particular in the United States. These transfers are framed in accordance with articles 44 et seq. of the GDPR by the following appropriate safeguards:

• EU-US Data Privacy Framework (DPF) for providers certified under this framework adopted by the European Commission on 10 July 2023.
• Standard Contractual Clauses (SCC) adopted by the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, for providers not certified under the DPF.
• Additional technical and organisational measures (encryption in transit and at rest, access logs, strict access management).

You can request more details about the safeguards applied to a given transfer by contacting support.

7. Artificial intelligence and profiling

The service uses artificial intelligence models to generate text and images. You are informed that:

• The generations are produced from the product data you provide. They do not constitute automated decisions producing legal effects within the meaning of article 22 of the GDPR, since you remain in control of the final use of the generated content.
• The publisher does NOT use your personal data, your account data or the content generated for you to train AI models. The contracts entered into with AI providers expressly prohibit them from using the data sent to them for the purposes of training their models, subject to compliance with their commitments.
• The data sent to AI providers (product description, generation parameters) does not include your email address, your name or your billing details. Only the data strictly necessary for the generation is transmitted.
• The publisher does NOT carry out profiling for advertising purposes or for individual scoring.

8. Cookies and trackers

The service uses only cookies and local storage data strictly necessary for its operation:

• Session and authentication cookies (keeping you logged in across pages).
• Security cookies (protection against fraudulent requests).
• Local storage of your usage preferences (language, generation settings, display choices).

In accordance with the ePrivacy Directive and the recommendations of the CNIL, these cookies and storage data do not require prior consent because they are essential to the provision of the service you have requested. You can delete them at any time via your browser settings, but their deletion may render the service unusable.

The service uses no advertising cookies, no third-party audience measurement cookies, no social media pixels and no trackers subject to consent.

9. Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access (art. 15 GDPR): obtain confirmation that your data is being processed and a copy of it.
• Right to rectification (art. 16 GDPR): correct inaccurate or incomplete data.
• Right to erasure (art. 17 GDPR), known as "right to be forgotten": obtain the deletion of your data, subject to legal retention obligations.
• Right to restriction of processing (art. 18 GDPR).
• Right to portability (art. 20 GDPR): receive your data in a structured, commonly used and machine-readable format.
• Right to object (art. 21 GDPR) to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out previously (art. 7.3 GDPR).
• Right to lodge a complaint with a supervisory authority (see article 14).
• Right to define directives on the fate of your data after death (article 85 of the French Data Protection Act).

To exercise your rights, send a request by email to contact@etsnipe.app, attaching a copy of an identification document if necessary to verify your identity. A reply will be sent to you within one (1) month, possibly extended by two (2) additional months in the event of a complex request, with intermediate information.

10. Data security

The publisher implements technical and organisational measures to protect personal data against any loss, alteration, unauthorised access or unlawful disclosure:

• Encryption of communications in transit (HTTPS/TLS 1.3).
• Encryption of sensitive data at rest.
• Passwords stored exclusively in hashed form (bcrypt or equivalent).
• Strict access management to internal infrastructure (principle of least privilege).
• Connection and action logs to detect suspicious behaviour.
• Regular updates of the software components used.
• Database backups, retained for a maximum of 30 days.

Despite these measures, no data transmission via the internet can be guaranteed 100% secure. The user is invited to use a strong password and to keep their login credentials confidential.

11. Data breach

In the event of a personal data breach likely to result in a risk to the rights and freedoms of users, the publisher undertakes to:

• Notify the CNIL within a maximum of 72 hours after becoming aware of it (art. 33 GDPR).
• Inform the users concerned without undue delay if the risk is high (art. 34 GDPR), via the email address of their account.
• Document the breach, its impact and the corrective measures taken, in a register kept for this purpose.

12. Minors' data

The service is not intended for minors under 16 years of age, in accordance with article 8 of the GDPR and the Terms of Use. If the publisher becomes aware that personal data of a minor under 16 has been collected, the corresponding account is deleted immediately and the data destroyed.

13. Amendment of the policy

This Privacy Policy may be amended to reflect changes to the service or to legal requirements. In the event of a substantial change, users will be informed by email at least 15 days before entry into force. The version in force is the one published at this address, the date of last update of which is indicated at the top of the document.

14. Contact and complaint

For any question relating to this Privacy Policy or to the exercise of your rights, you can contact the publisher at contact@etsnipe.app.

If you consider, after contacting the publisher, that your rights are not respected, you can lodge a complaint with the supervisory authority of your country of residence in the European Union. In France, this authority is: