> Canonical page: https://www.sellready.eu/en/privacy # Privacy policy ## Controller The controller for personal data on sellready.eu and in the SellReady application is [Company name], [Address], email: hallo@sellready.eu. All details are in the [imprint](https://www.sellready.eu/en/imprint). We have not appointed a data protection officer because there is no legal obligation to do so. [Obligation to be confirmed by counsel] ## Our roles For your customer account, billing and our communication with you, we are the controller within the meaning of the GDPR. For your Etsy shop data imported through the Etsy connection and for uploaded documents, we act as a processor on your behalf. For this we conclude a [data processing agreement](https://www.sellready.eu/en/dpa) with you. ## Visiting this website - Server logs: when you visit, our hosting provider processes IP address, time, requested address and technical browser details to deliver the website securely. The legal basis is Art. 6(1)(f) GDPR. Logs are deleted after 30 days. - Cookies: we only set technically necessary cookies – for sign-in and, if you switch languages, for your language choice (up to 12 months). The legal basis is § 165(3) TKG 2021 and § 25(2) TDDDG together with Art. 6(1)(b) and (f) GDPR. - Statistics: we use Vercel Web Analytics without cookies and without any cross-site identifier. Only aggregated page views are evaluated. The legal basis is Art. 6(1)(f) GDPR. - Fonts and third-party content: fonts are served from our own server. We do not embed videos, maps or chat widgets from third parties. ## Registration and customer account For your account we process your email address, a password hash where applicable, passkey keys, two-factor settings, as well as company name, country and your confirmation that you act as a business. We store neither IP address nor browser identifier with sessions. The purpose is providing the contract; the legal basis is Art. 6(1)(b) GDPR. If you sign in with Google, we receive your email address and name from Google; Google processes data under its own responsibility. ## Connecting Etsy When you connect your Etsy shop, we use the permissions shops_r and listings_r to read shop data and listings (title, description, tags, materials, category, images). SellReady does not read orders – so your buyers’ data never reaches us. This processing takes place on your behalf. If you disconnect, we delete access keys and imported raw data immediately. Etsy, Inc. processes data on its platform under its own responsibility. ## Documents and profiles Manufacturer and responsible person profiles as well as uploaded documents may contain contact details of third parties, such as a contact person in a certificate. We process them on your behalf, store every version unchanged and delete them according to the periods agreed with you. ## Payment and invoices For paid plans we process name or company, billing address, VAT ID and payment method details via Stripe. Only Stripe receives card data. The legal bases are Art. 6(1)(b) GDPR and – for keeping invoices – Art. 6(1)(c) GDPR together with § 132 of the Austrian Federal Fiscal Code (BAO). ## Emails We send sign-in codes, confirmations and account notices via Amazon SES (EU region, Frankfurt) in a dedicated AWS account (Art. 6(1)(b) GDPR). Summaries of open tasks are sent on the basis of our legitimate interest (Art. 6(1)(f) GDPR); you can unsubscribe in your settings at any time. ## Error monitoring To detect errors, we send technical error reports to Sentry (EU region). Personal data such as email addresses or access keys are removed before sending. The legal basis is Art. 6(1)(f) GDPR; reports are deleted after about 90 days. ## AI suggestions For suggestions on how to classify your products, we send the title, description, tags, materials and category of individual listings via Vercel AI Gateway to a language model operated by Amazon Web Services (Bedrock) in Frankfurt – without images, without buyer data, without storage beyond the request and without training models. This processing takes place on your behalf. Suggestions are only used after you confirm them; the check status is determined exclusively by our rule set. You can switch AI suggestions off for your shop in the settings at any time. ## Recipients and processors These services process data on our behalf. The current list is also available under [subprocessors](https://www.sellready.eu/en/subprocessors). - **Vercel** — Vercel Inc. (US, fra1) - **Supabase** — Supabase Inc. (US, eu-central-1) - **Stripe** — Stripe Payments Europe Ltd. / Stripe, Inc. (US, EU) - **Amazon SES** — Amazon Web Services EMEA SARL / Amazon.com, Inc. (US, eu-central-1) - **Sentry** — Functional Software, Inc. (Sentry) (US, de.sentry.io) - **Vercel AI Gateway** — Vercel AI Gateway → Amazon Web Services (Bedrock) (US, eu-central-1) ## Transfers to third countries For every service we use the EU region wherever the provider offers one; the location of each service is listed on the subprocessors page. Some providers are based in the US; access from there cannot be ruled out. For these cases we rely on the European Commission’s standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework. ## Retention periods - Account data, checks, tasks and profiles: for the duration of the contract; after deleting your account, 14 days to reconsider, then final deletion. - Imported raw Etsy data and access keys: until you disconnect, then immediately. - Server logs: 30 days. Export files: 72 hours. In-app notifications: 180 days. - Invoices: 7 years from the end of the calendar year (§ 132 BAO); locked until then and used for that purpose only. ## Your rights You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can trigger export and deletion directly in your settings; for everything else, an email to hallo@sellready.eu is enough. You can lodge a complaint with a supervisory authority – in Austria the Data Protection Authority, Barichgasse 40–42, 1030 Vienna ([dsb.gv.at](https://dsb.gv.at)) – or with the authority where you live or work. ## Obligation to provide data To register, we need an email address and your confirmation that you act as a business; for paid plans also billing details. Without this data we cannot conclude the contract. All other details are voluntary but improve the check. ## Automated decisions The check assesses products against a rule set, not people. We do not make automated decisions within the meaning of Art. 22 GDPR that have legal effect on you. ## Changes We update this policy when our processing changes. We inform customers of material changes by email in advance.