Privacy Policy

What we collect

Account data

Your email address, used to create your account, sign you in (via a one-time link), and send service messages. We never store a password.

Shop data (only after you connect a shop)

When you connect an Etsy shop, you authorize us through Etsy’s official OAuth flow. With that permission we read, via Etsy’s documented Open API v3:

• Listings — titles, tags, attributes, prices, photo counts, views and favourites
• Orders (receipts) — timestamps and fulfilment status, to measure shipping timeliness
• Reviews — ratings and text, to surface recurring themes worth improving
• Shop profile — name, policies and announcement

We store daily snapshots of this data so we can show you trends over time. Etsy’s API only returns current values, so history exists only because we record it.

Usage data

Basic product analytics (pages viewed, features used) to understand what helps sellers and what doesn’t.

What we do not collect

• Buyer conversations. We never read, store, or send messages on your behalf.
• Card details. Payments are processed by Stripe; we never see your card number.
• Unnecessary buyer information. We keep the minimum needed for order-related features and nothing more.

How we protect it

Your Etsy access and refresh tokens are encrypted at rest with AES-256-GCM before they are written to our database, and decrypted only server-side when a job needs to talk to Etsy on your behalf. Database access is restricted per user with row-level security, so one seller can never read another seller’s data.

Changes to your shop

Nothing in your shop is ever changed automatically. When we suggest an action — updating tags or attributes, renewing a listing — it is applied only after you explicitly confirm it. Where Etsy charges a fee for an action (for example, a listing renewal), we show that fee before you confirm.

Who else processes your data

We use a small set of providers, each only for its stated purpose:

• Supabase — database, authentication and scheduled jobs
• Vercel — website hosting
• Stripe — subscription payments
• Resend — transactional email
• Amplitude and Meta — product and advertising analytics
• Anthropic — generating the wording of your suggested actions

Retention and deletion

We keep your data while your account is active. You can disconnect a shop at any time, which stops all data collection for it, or delete your account entirely — which removes your profile, your shops, their tokens and their history. To request deletion, email hello@stellashop.app.

Your rights

You can ask us to access, correct, export or delete your personal data, and withdraw your consent at any time by disconnecting your shop. Write to hello@stellashop.app and we will respond within 30 days.

Cookies

We use a session cookie to keep you signed in, and analytics cookies to measure how the product is used. No advertising profile is built from your shop data.

Contact

Questions about this policy? Email hello@stellashop.app.