Privacy Policy

1. Who this covers

Optimlister ("Optimlister", "we", "us") provides software that helps online sellers write, check, and publish marketplace listings. This policy explains what personal data we collect through optimlister.ai and the Optimlister API, why we collect it, who else processes it, how long we keep it, and what you can require us to do with it.

Optimlister is operated from Atlanta, Georgia, United States. For anything in this policy, write to support@optimlister.ai.

For the purposes of the UK and EU GDPR, Optimlister is the controller of the account data described below. Where you upload product or listing content belonging to a business you act for, you are the controller of that content and Optimlister acts as your processor; section 12 sets out the terms that apply in that case.

2. What we collect

We collect only what the product needs to function, bill correctly, and stay within marketplace and provider limits. Specifically:

• Account data: your email address, your plan and billing status, your monthly usage counter and credit balance, your streak and badge state, and the marketplace you selected as your primary.
• Authentication data: signed, time-limited sign-in tokens and a session cookie. We do not use passwords, so we never store one.
• Content you create or upload: the product facts you type, the listings, roasts, field packs, image plans, reports, images and exports produced from them, and any files or catalogues you provide. We call this your vault.
• Run metadata: which tool ran, when, whether it succeeded, and how many of your monthly listings it used, so quotas, credits and daily caps work and so we can investigate faults.
• Billing data: a Stripe customer identifier and subscription status. Card numbers are entered directly with Stripe and never reach our servers.
• Marketplace connections: where you connect a marketplace such as eBay, the access and refresh tokens that marketplace issues, held so we can act on your instruction. You can disconnect at any time.
• Anonymous free-tool use: visitors using the free roast, fee calculator or title checker without an account are counted using a one-way hashed connection fingerprint. We do not store raw IP addresses.
• Correspondence: emails you send us, and the transactional emails we send you.
• Optional outcome reports: if you choose to tell us what happened to a listing after publication (approved, flagged, suppressed), we record that against the listing. This is off by default.

3. What we do not collect

We do not run advertising trackers, third-party analytics scripts, or cross-site advertising cookies. We do not buy personal data about you from data brokers, and we do not build behavioural advertising profiles.

We do not store payment card numbers, CVVs, or bank details. Those are handled by Stripe.

4. Why we use it, and on what legal basis

Where the UK or EU GDPR applies, we rely on the following bases. To provide the service you asked for, including generating and storing your listings and enforcing your plan limits: performance of a contract. To take payment and prevent abuse of free tiers: performance of a contract and our legitimate interests in running a viable, non-abused service. To send service messages such as sign-in links, receipts and expiry notices: performance of a contract. To keep security logs and investigate faults: our legitimate interests in operating a secure service. For optional outcome reports and any use of your content to improve shared models: your consent, which you may withdraw at any time.

We do not use your listing content for marketing to other people, and we do not use automated decision-making that produces legal or similarly significant effects about you.

5. What we will never do

These are commitments, not aspirations, and they also appear on our data page.

• We never sell your personal data or your content, and we never share it for cross-context behavioural advertising.
• We never show your listings, keywords or catalogue to another customer. Your copy is never used to help a competitor.
• We never train shared models on your content without your explicit opt-in.
• Public roast pages exist only at unguessable links that you choose to share. The public leaderboard shows scores only, never the listings behind them.

6. Who else processes your data

We use a small number of subprocessors, each for a single, stated purpose. All are bound by contract to process data only on our instructions.

• Vercel Inc. - application hosting, content delivery, and cookieless page-view measurement (United States).
• Supabase Inc. - database and file storage for your account and vault (United States).
• Anthropic PBC - large language model processing for generated text (United States).
• Google LLC - Gemini model processing, including web-grounded research where a tool requires it; and Google Analytics, but only on a visit where you have allowed it (United States).
• Resend - delivery of transactional email such as sign-in links and receipts (United States).
• Stripe, Inc. - payment processing and subscription management (United States).
• Marketplace and commerce platforms - only where you connect one (for example eBay or Shopify), and only to carry out what you asked for.
• Tally - hosted forms, where you submit one.

7. Content sent to model providers

To generate a listing, a check or a report, the relevant product facts and listing text are sent to the model provider named above. We use their commercial APIs and do not authorise them to use your content to train their models. We do not send your content to any model provider other than those named in section 6, and we do not send it for any purpose other than producing the output you asked for.

If we ever change providers, or change the terms under which content is processed, we will update this section before the change takes effect.

8. International transfers

Optimlister and all subprocessors listed above operate in the United States, so if you are outside the United States your data will be transferred there. Where you are in the UK, the EEA or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with the technical measures described in section 10, to protect those transfers. A copy of the relevant clauses is available on request.

9. How long we keep it

Your vault is kept for as long as your account is open, so that your work stays available to you. Run history and operational logs are cleared automatically after 90 days. Anonymous free-tool counters are retained only as long as needed to enforce daily caps. Billing records are retained for as long as tax and accounting law requires, which in the United States is generally seven years.

When you ask us to delete your account, we delete your account record and vault contents. Deletion is permanent and confirmed by reply. Backups are overwritten on their normal cycle, which completes within 30 days.

10. How we protect it

All traffic is served over HTTPS. Sessions use signed, time-limited, httpOnly cookies. Database credentials with elevated privileges are held server-side only and are never exposed to the browser. Access to production data is limited to those who need it to operate the service. We do not handle card data.

No system is perfect. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it.

11. Your rights

Wherever you live, you may ask us to give you a copy of your data, correct it, delete it, or export it in a portable format. Export packs in CSV and JSON are built into the product and are always yours to take.

If the UK or EU GDPR applies to you, you also have the right to object to processing based on legitimate interests, to ask us to restrict processing, to withdraw consent at any time without affecting prior processing, and to complain to your local supervisory authority - in the UK, the Information Commissioner's Office.

If you are a California resident, you have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA as amended, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

To exercise any of these, email support@optimlister.ai from the address on your account. We respond within 30 days and will tell you if we need longer. We do not charge for this unless a request is manifestly unfounded or excessive.

12. If you are a business customer

Where you use Optimlister to process personal data contained in your own catalogue or customer material, we act as your processor. We will process that data only on your documented instructions, keep it confidential, apply the security measures in section 10, use only the subprocessors listed in section 6, assist you with data subject requests and breach notification, and delete or return the data when your account closes. If you need a signed data processing agreement, ask at support@optimlister.ai and we will provide one.

13. Cookies

We set one essential cookie, which holds your sign-in session. It is httpOnly, is not readable by scripts, and is not used for advertising or tracking. We also measure page views in a way that sets no cookie at all: our host, Vercel, records the page, the referring site and a coarse device type, with no identifier that follows you between sites and nothing that identifies you personally. Because it sets no cookie, there is nothing to consent to and no banner to click. If we ever switch on Google Analytics, which does set cookies, it will not load at all until you say yes to a banner; declining changes nothing about how the product works, and your answer is stored only in your own browser.

14. Children

Optimlister is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to support@optimlister.ai and we will delete it.

15. Changes

If we change this policy in a way that materially affects how we handle your data, we will email account holders before the change takes effect and update the date at the top of this page. Continuing to use Optimlister after that date means the updated policy applies.