Privacy Policy

By creating an account or using the service, you agree to the practices described in this policy. If you do not agree, please do not use ListingSmart.ai. This policy should be read together with our Terms of Service.

We collect the following categories of data:

• Account data: your name, email address, and a securely hashed password. We never store your password in plain text.
• Subscription & billing data: your plan tier, billing interval, and subscription status. Payments are processed by Stripe. We do not store your full card numbers or payment credentials — Stripe handles all payment data.
• Marketplace connection data: OAuth access tokens for marketplaces you connect (Amazon, Shopify, eBay, Etsy, Walmart) and the listing data we retrieve from them (titles, descriptions, bullets, images metadata, identifiers).
• Listing content you submit: product text and details you paste or import for scoring, generation, or optimization.
• Usage & performance data: LSQ scores, scoring history and snapshots, optimization runs, keyword runs, quota usage, and product activity.
• Cookies & technical data: authentication/session cookies and basic device/log information needed to operate and secure the service. See “Cookies” below.

• To provide and operate the service — scoring, content generation, keyword research, and competitor benchmarking.
• To connect and sync with the marketplaces you authorize.
• To manage your account, subscription, billing, trial, and quota usage.
• To send transactional and service emails (e.g. verification, password reset, billing notices, and reports you opt into).
• To maintain security, prevent abuse, debug, and improve the service.
• To comply with legal obligations.

Our lawful bases under GDPR/UK GDPR include: performance of a contract (providing the service), legitimate interests (securing and improving the service), consent (where required, e.g. certain cookies or marketing), and legal obligation.

ListingSmart.ai uses third-party artificial intelligence / large language model providers (for example, Google Gemini) to analyze and generate listing content. When you use scoring, generation, or optimization features, the relevant listing content you submit is transmitted to these AI providers for processing and a result is returned to you.

• Do not submit sensitive personal data or confidential third-party information you are not permitted to share.
• AI providers process this content under their own terms and privacy/data-processing policies.
• AI output may be inaccurate and must be reviewed by you before publishing (see our Terms of Service).

We rely on the following categories of processors to deliver the service:

• Stripe — payment processing and subscription billing.
• AI / LLM providers (e.g. Google Gemini) — processing listing content for scoring and generation.
• Connected marketplaces (Amazon, Shopify, eBay, Etsy, Walmart) — to read and, where you direct, publish listing data.
• Email service provider — to send transactional and service emails.
• Hosting and infrastructure providers — to run the application and store data. [ADD HOSTING/INFRA PROVIDERS]

A current list of sub-processors is available on request at [PRIVACY CONTACT EMAIL].

We share data with the processors above as needed to provide the service, and we may disclose data where required by law, to protect rights and safety, or in connection with a corporate transaction (e.g. merger or acquisition). We do not sell your personal data.

We retain personal data for as long as your account is active and as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. When you delete your account or upon a valid erasure request, we delete or anonymize your personal data within a reasonable period, except where retention is legally required. [CONFIRM RETENTION PERIODS WITH COUNSEL]

We use industry-standard measures including encryption in transit, hashed passwords, encrypted storage of sensitive credentials (such as marketplace tokens and integration secrets), and access controls. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

We and our processors may process data in countries other than where you reside, including the United States. Where we transfer personal data out of the UK or EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or other lawful transfer mechanisms. [CONFIRM TRANSFER MECHANISMS WITH COUNSEL]

EU / UK (GDPR & UK GDPR). Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Data portability (receive your data in a portable format);
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with your local supervisory authority.

California (CCPA/CPRA). Subject to applicable law, you have the right to:

• Know what personal information we collect and how it is used;
• Request deletion of your personal information;
• Opt out of the “sale” or “sharing” of personal information — note that we do not sell your personal information; and
• Be free from discrimination for exercising your rights.

To exercise any right, contact [PRIVACY CONTACT EMAIL]. We may need to verify your identity before responding.

We use cookies that are strictly necessary for authentication and session management. We may use additional cookies for preferences or analytics where permitted; where consent is required, we will request it. [CONFIRM ANALYTICS/COOKIE TOOLS WITH COUNSEL]

ListingSmart.ai is not intended for individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us so we can delete it.

We may update this policy from time to time. We will post the updated version with a new effective date and, where appropriate, notify you. Continued use of the service after changes take effect constitutes acceptance.

For privacy questions or to exercise your rights, contact us at [PRIVACY CONTACT EMAIL] or by mail at [BUSINESS ADDRESS]. The data controller is [LEGAL ENTITY NAME].