Privacy Policy

Last updated 13 August 2026

Draft. This policy reflects how Hovlist actually handles data today, but it has not been reviewed by a lawyer. Placeholders in [brackets] must be completed, and it should be checked against the privacy law that applies to you, before you rely on it.

This policy explains what Hovlist collects, why, who else processes it, and how to get it removed. Hovlist is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], who is the data controller for the purposes of this policy.

1. What we collect

Account data

Your email address, and — if you sign in with Google — the identity information Google returns for that sign-in. Passwords are handled by our authentication provider and are never stored by us in readable form.

Listing data

The product photos you upload and the listing content associated with them: titles, descriptions, tags, prices, quantities, alt text, quality scores, templates, scheduled publish times, and the record of which listing went to which shop.

Marketplace connections

When you connect Etsy or Shopify we store the OAuth access token for that shop, its shop identifier and name, and the granted scopes. Etsy connections request listings_r listings_w shops_r; Shopify connections request read_products write_products. Tokens are stored server-side with restricted column access and are never sent to your browser.

Billing data

Subscription status, plan, renewal date and the identifiers our payment provider gives us. We never receive or store your full card number.

Technical data

Standard server logs from our hosting provider (IP address, user agent, request paths, error traces) used to operate and debug the Service.

2. Why we process it

  • To provide the Service — generating, scoring, editing and publishing listings. (Performance of our contract with you.)
  • To bill you and manage your subscription. (Contract; legal obligation for tax records.)
  • To keep the Service working and secure — logging, rate limiting, abuse prevention. (Legitimate interests.)
  • To contact you about your account, billing, or a service problem. (Contract; legitimate interests.)

We do not sell personal data, and we do not use your listing content to train AI models.

3. Who else processes your data

We use the following subprocessors. Each receives only what it needs to do its job:

  • Supabase — authentication, database, and storage for uploaded photos.
  • Anthropic — generates listing text, alt text and design descriptions. Receives the photos and product details for a generation.
  • PhotoRoom — background removal and photo editing. Receives the image you edit.
  • Lemon Squeezy — payments, as merchant of record. Receives your email and payment details directly from you at checkout.
  • Etsy and Shopify — receive the listing content you choose to publish, plus the API calls needed to create, update and verify it.
  • Vercel — hosting and server logs.
  • Plausible Analytics — only when analytics is enabled on the deployment. Plausible is cookieless, collects no personal data and does not track you across sites.

Some of these providers operate outside your country. Where data leaves the UK/EEA it is transferred under the safeguards those providers offer, such as Standard Contractual Clauses.

4. Cookies

We set cookies only to keep you signed in and to protect against cross-site request forgery. There are no advertising or cross-site tracking cookies. Clearing them signs you out.

5. How long we keep it

  • Account and listing data — while your account exists, and deleted with it.
  • Marketplace tokens — until you disconnect the shop or delete your account, whichever is first. Disconnecting removes the stored token.
  • Billing records — as long as tax and accounting law requires, typically six years.
  • Server logs — for the retention period of our hosting provider, generally around 30 days.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your data, to receive a portable copy, and to withdraw consent where we rely on it. Under the CCPA/CPRA, California residents additionally have the right to know and to delete, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined there.

To exercise any of these, email support@hovlist.com. We will respond within 30 days. You may also complain to your local data protection authority.

7. Security

Data is encrypted in transit. Database access is enforced per-user at the row level, and marketplace tokens are held in restricted columns unreachable from the client. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.

8. Children

The Service is for business use by adults. It is not directed at anyone under 18, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will delete it.

9. Changes

We will update this policy as the Service changes — including whenever we add a subprocessor. Material changes will be notified by email or in the app, and the “Last updated” date above will change.

10. Contact

Privacy questions and requests: support@hovlist.com.