1. Who is responsible for your data
Ava Lily Studio, operating DraftSprite in the United Kingdom, is the controller for the personal data described in this notice.
Contact: hello@draftsprite.com.
2. What we collect
- Account data: email address, authentication identifier, verification and session information, password-reset events and, if Google sign-in is enabled and chosen, basic Google account information returned through Supabase Auth.
- Optional Etsy connection data: shop ID and name, encrypted OAuth access and refresh tokens, shop sections and delivery profiles needed to create a draft. During Personal Access testing, the configured developer account and its allowlisted shop may also use owner-only existing-listing tools, which can fetch that shop's own listing titles, descriptions, tags, status and images. For the initial Commercial Access rollout, new seller connections request only shops_r and listings_w; existing-listing data will not be fetched for commercial customers unless Etsy separately approves that functionality and the corresponding rollout switch is deliberately enabled.
- Your content: artwork, mockup assets, optional PSD files, shop logos, prompts, listing copy, saved profiles, prices, settings, saved drafts and generated output files.
- Draft activity: the first image, title, connected shop, listing ID and creation time for unpublished Etsy drafts successfully created through DraftSprite. This supports the restricted owner-only operations view described below.
- Product-use data: pages and limited feature events, an anonymous browser identifier when optional analytics is allowed, error and security logs, browser and device information, and stored preferences.
- Support data: messages, screenshots and any information you choose to provide when asking for help.
DraftSprite does not collect Etsy customer, order, transaction, payment, review, favourite or billing data. Do not copy unrelated personal data into prompts or listing content.
3. Why we use it
| Purpose | Typical data | UK GDPR basis |
|---|---|---|
| Create and secure your account | Email, authentication and session data | Contract and legitimate interests in account security |
| Optionally connect Etsy and create a new unpublished draft | Encrypted tokens, shop sections, delivery profiles and seller-approved listing content | Contract, at your explicit request |
| Display or update an existing Etsy listing during owner-only Personal Access testing, or later only if Etsy separately approves the Commercial Access rollout | Listing title, description, tags, state and images fetched from the authenticated shop | Contract, at the seller's explicit request |
| Generate listing copy, mockups and digital files | Artwork, prompts, shop context and selected settings | Contract, at your request |
| Save your workspace and preferences | Profiles, drafts, line-ups and settings | Contract and legitimate interests in providing a usable service |
| Operate, secure and improve DraftSprite, investigate faults and provide support | A limited read-only preview of the first Etsy draft image, title, shop, listing ID and creation time | Contract and legitimate interests in service operation, security, quality assurance and support |
| Measure and improve the product | Limited feature events and anonymous identifier | Consent for browser analytics storage; legitimate interests for analysis after consent |
| Prevent abuse, diagnose faults and provide support | Security logs, error details and messages | Legitimate interests and, where relevant, contract |
| Meet legal requirements and defend claims | Relevant account, transaction or correspondence records | Legal obligation and legitimate interests |
Where processing relies on consent, you can withdraw it at any time. Withdrawing consent does not affect earlier lawful processing.
4. How AI processing works
When you ask DraftSprite to analyse artwork, write listing content, research wording or generate optional creative material, the necessary prompt, image, seller input and saved listing profile may be sent to an AI provider. The current product uses OpenAI and Anthropic services for different features.
Content obtained through the Etsy API is not supplied to an AI provider or used for machine-learning purposes. If you want AI-generated copy or mock-ups for an existing product, you must upload the original artwork independently. DraftSprite blocks Etsy-hosted images from its URL-import route.
Generated content is an aid, not a decision about you. DraftSprite does not use automated processing to make decisions that produce legal or similarly significant effects. You review the result and decide whether to use it.
Avoid uploading confidential material or personal information that is not needed for the listing. You remain responsible for checking generated content for accuracy, ownership, policy compliance and suitable disclosures.
5. Who processes data for us
- Supabase: authentication, database and private file storage.
- Vercel: website hosting, server functions and operational logs.
- Render: image-compositing infrastructure for relevant mockup jobs.
- OpenAI and Anthropic: AI analysis and generation for the features you request.
- Etsy: OAuth authentication, limited shop-setting reads and creation of new unpublished drafts where the integration is approved and enabled. Owner-only existing-listing operations are confined to the configured Personal Access test account and will remain unavailable to commercial customers unless Etsy separately approves that functionality and it is deliberately enabled.
- Photopea: browser-based PSD processing when a Photopea-backed mockup or editor feature is used.
- Google: hosted fonts and, only if enabled and chosen, sign-in.
These providers receive only the data needed for their role. They may process data in the United Kingdom, European Economic Area, United States or other locations. Where restricted transfers occur, we rely on applicable adequacy arrangements and provider contractual safeguards where required.
We do not sell personal data and we do not use advertising cookies.
6. How long we keep data
- Temporary source artwork for standard mockup jobs is scheduled for deletion after 24 hours.
- Digital-listing source artwork and the five generated download packages are scheduled for deletion after 30 days.
- Artwork attached to a saved DraftSprite draft remains until that draft is deleted or displaced by the saved-draft limit.
- Account settings, profiles and saved work remain while your account is active. If the optional Etsy connection is enabled, its encrypted tokens remain only while that connection is active, unless you delete them or ask us to do so.
- Existing listing data used by the configured Personal Access owner tool is fetched live and is not retained as a DraftSprite listing catalogue. Commercial customers do not receive that access unless Etsy separately approves its rollout. Other displayed Etsy content is refreshed within 24 hours; stale shop sections, names and icons are withheld while a background refresh runs and remain withheld if it fails.
- Legacy listing copies imported by an earlier DraftSprite version are quarantined for 30 days, hidden from the product and never reused for AI, Canva or new listing creation. Reusable product settings are recovered into a clean setup without the imported copy, tags or materials. The quarantined original is then deleted automatically, or immediately when the Etsy shop is disconnected.
- Optional product analytics are kept only for as long as needed to understand and improve the service and are reviewed for deletion or aggregation.
- Provider logs and backups follow the relevant provider's operational retention schedule. Some records may be kept longer where necessary for security, legal obligations or disputes.
If an Etsy connection is enabled, disconnecting the shop removes its stored access tokens and connected-shop record from DraftSprite immediately. Etsy does not offer a way for an app to revoke that token on Etsy's own side, so if you want to be certain the authorisation itself is cancelled as well, remove DraftSprite from Etsy directly: Etsy account settings → Apps → Connected apps → Revoke (see Etsy's How to Use Apps to Manage Your Shop). Some user-created shop copy and settings may remain so they are not accidentally lost. Contact us if you want all account data removed.
7. Security
Customer source artwork and generated digital packages use private storage with time-limited access links. Access to account workspaces is authenticated, application tables are protected from browser access, and Etsy tokens, if the optional integration is enabled, are encrypted at rest and kept server-side.
Authorised DraftSprite administrators can access a limited, read-only preview of DraftSprite-created Etsy drafts for service operation, quality assurance, fault investigation and support. The view is restricted to the first listing image and basic draft metadata, and each opened preview is recorded in the admin audit log. It does not expose Etsy buyers, orders, messages, revenue, payment details or account tokens.
No online service can promise absolute security. Use a unique password, keep your email account secure and contact us promptly if you believe your account has been accessed without permission.
If Etsy member data is compromised or suspected to be compromised, we will notify Etsy and the affected Etsy seller as soon as possible and no later than 24 hours after discovery.
8. Your rights
Depending on the circumstances, UK data-protection law may give you the right to access, correct, erase or restrict your data, object to certain processing, withdraw consent and receive portable data.
You can erase your own account and everything in it at any time from Account settings, without waiting on us — this deletes your shops, drafts, history, mock-ups, digital listing files and Etsy connection tokens, then removes your login. For any other request, or if you can't sign in, send it to hello@draftsprite.com. We may need to verify your identity. You can also complain to the Information Commissioner's Office.
9. Changes to this notice
We will update this notice when the product, providers or legal requirements change. Material changes will be brought to account holders' attention before new processing begins where required.