Your data, explained plainly.

1. Who is responsible for your data

Ava Lily Studio, operating DraftSprite in the United Kingdom, is the controller for the personal data described in this notice.

Contact: hello@draftsprite.com.

2. What we collect

• Account data: email address, authentication identifier, verification and session information, password-reset events and, if Google sign-in is enabled and chosen, basic Google account information returned through Supabase Auth.
• Optional Etsy connection data: shop ID and name, encrypted OAuth access and refresh tokens, shop sections, delivery profiles and processing profiles needed to create a draft. With your authorisation through Etsy, the connection requests shops_r, listings_r and listings_w. Enabled existing-listing tools fetch your connected shop's own listing titles, descriptions, tags, status, prices, inventory, variations and supported media so you can select listings, edit them and review the exact changes before approval.
• Your content: artwork, mockup assets, optional PSD files, shop logos, prompts, listing copy, saved profiles, prices, settings, saved drafts and generated output files.
• Draft activity: the first image, title, connected shop, listing ID and creation time for unpublished Etsy drafts successfully created through DraftSprite. This supports the restricted owner-only operations view described below.
• Product-use data: pages and limited feature events, an anonymous browser identifier when optional analytics is allowed, error and security logs, browser and device information, and stored preferences.
• Support data: messages, screenshots and any information you choose to provide when asking for help.

DraftSprite does not provide Etsy shop-performance analytics or collect Etsy customer, order, transaction, payment, review, favourite or billing data. It does not delete Etsy listings or request listings_d. Do not copy unrelated personal data into prompts or listing content.

Customer access to existing-listing tools requires a verified sign-in, ownership of the connected shop, Commercial Access and the approved listing-management rollout to be enabled. Existing connections without listings_r must be re-authorised through Etsy before existing listings can be loaded.

3. Why we use it

Where processing relies on consent, you can withdraw it at any time. Withdrawing consent does not affect earlier lawful processing.

4. How AI processing works

The support FAQ helper uses prepared answers and does not send your questions to an AI provider. If you send a message to James, your recent FAQ conversation, message, current page and optional screenshot are saved privately for support. Screenshot metadata is removed during preparation.

When you ask DraftSprite to analyse artwork, write listing content, research wording or generate optional creative material, the necessary prompt, image, seller input and saved listing profile may be sent to an AI provider. The current product uses OpenAI and Anthropic services for different features.

When you choose Quick update SEO and confirm the credit total, the current title, description and tags of each selected listing in your own connected shop are supplied to OpenAI solely to prepare replacement copy for your review. Listing photos, buyer data and other shops’ listings are not supplied. This information is not used to train AI models or for shop analytics. Generation checkpoints retain proposed output for retries; the source text is not added to a shared research cache. New mock-ups require your original artwork, and DraftSprite blocks Etsy-hosted images from its URL-import route.

Generated content is an aid, not a decision about you. DraftSprite does not use automated processing to make decisions that produce legal or similarly significant effects. You review the result and decide whether to use it.

Avoid uploading confidential material or personal information that is not needed for the listing. You remain responsible for checking generated content for accuracy, ownership, policy compliance and suitable disclosures.

5. Who processes data for us

• Supabase: authentication, database and private file storage.
• Resend: delivery of support and account email notifications.
• Vercel: website hosting, server functions and operational logs.
• Render: image-compositing infrastructure for relevant mockup jobs.
• OpenAI and Anthropic: AI analysis and generation for the features you request.
• Etsy: OAuth authentication, shop-setting reads, creation of new unpublished drafts and seller-approved management of the connected shop's own existing listings where the integration and approved rollout are enabled. DraftSprite never publishes a listing automatically; new drafts remain unpublished for the seller to review and publish in Etsy. Renewal of an expired listing requires separate, explicit confirmation.
• Photopea: browser-based PSD processing when a Photopea-backed mockup or editor feature is used.
• Google: hosted fonts and, only if enabled and chosen, sign-in.

These providers receive only the data needed for their role. They may process data in the United Kingdom, European Economic Area, United States or other locations. Where restricted transfers occur, we rely on applicable adequacy arrangements and provider contractual safeguards where required.

We do not sell personal data and we do not use advertising cookies.

6. How long we keep data

• Temporary source artwork for standard mockup jobs is scheduled for deletion after 24 hours.
• Digital-listing source artwork and the five generated download packages are scheduled for deletion after 30 days.
• Artwork attached to a saved DraftSprite draft remains until that draft is deleted or displaced by the saved-draft limit.
• Support conversations and screenshots remain available while your account is active and are removed when the account is deleted. Delivered emails and provider backups follow the relevant provider’s retention arrangements.
• Account settings, profiles and saved work remain while your account is active. If the optional Etsy connection is enabled, its encrypted tokens remain only while that connection is active, unless you delete them or ask us to do so.
• Existing listing data used by the approved listing-management tools is fetched live and is not retained as a DraftSprite listing catalogue. Other displayed Etsy content is refreshed within 24 hours; stale shop sections, names and icons are withheld while a background refresh runs and remain withheld if it fails.
• Legacy listing copies imported by an earlier DraftSprite version are quarantined for 30 days, hidden from the product and never reused for AI, Canva or new listing creation. Reusable product settings are recovered into a clean setup without the imported copy, tags or materials. The quarantined original is then deleted automatically, or immediately when the Etsy shop is disconnected.
• Optional product analytics are kept only for as long as needed to understand and improve the service and are reviewed for deletion or aggregation.
• Provider logs and backups follow the relevant provider's operational retention schedule. Some records may be kept longer where necessary for security, legal obligations or disputes.

If an Etsy connection is enabled, disconnecting the shop removes its stored access tokens and connected-shop record from DraftSprite immediately. Etsy does not offer a way for an app to revoke that token on Etsy's own side, so if you want to be certain the authorisation itself is cancelled as well, remove DraftSprite from Etsy directly: Etsy account settings → Apps → Connected apps → Revoke (see Etsy's How to Use Apps to Manage Your Shop). Some user-created shop copy and settings may remain so they are not accidentally lost. Contact us if you want all account data removed.

7. Security

Customer source artwork and generated digital packages use private storage with time-limited access links. Access to account workspaces is authenticated, application tables are protected from browser access, and Etsy tokens, if the optional integration is enabled, are encrypted at rest and kept server-side.

Authorised DraftSprite administrators can access a limited, read-only preview of DraftSprite-created Etsy drafts for service operation, quality assurance, fault investigation and support. The view is restricted to the first listing image and basic draft metadata, and each opened preview is recorded in the admin audit log. It does not expose Etsy buyers, orders, messages, revenue, payment details or account tokens.

No online service can promise absolute security. Use a unique password, keep your email account secure and contact us promptly if you believe your account has been accessed without permission.

If Etsy member data is compromised or suspected to be compromised, we will notify Etsy and the affected Etsy seller as soon as possible and no later than 24 hours after discovery.

8. Your rights

Depending on the circumstances, UK data-protection law may give you the right to access, correct, erase or restrict your data, object to certain processing, withdraw consent and receive portable data.

You can erase your own account and everything in it at any time from Account settings, without waiting on us — this deletes your shops, drafts, history, mock-ups, digital listing files and Etsy connection tokens, then removes your login. For any other request, or if you can't sign in, send it to hello@draftsprite.com. We may need to verify your identity. You can also complain to the Information Commissioner's Office.

9. Changes to this notice

We will update this notice when the product, providers or legal requirements change. Material changes will be brought to account holders' attention before new processing begins where required.