This policy explains how ConnectMyShop (“ConnectMyShop”, “we”, “us”) handles personal information when you visit connectmyshop.app or use the ConnectMyShop service (the “Service”). The Service connects an Etsy shop you authorize to AI assistants you choose. We act on your behalf as your service provider for your shop data.
The short version
- We collect only what we need to run the connection you asked for.
- We never sell your data and never use your shop data to train AI models.
- Your Etsy access tokens are encrypted and never shared with any AI assistant.
- You can disconnect, export or delete your data at any time.
Information we collect
Account information. Your Etsy user and shop identifiers, account settings, any email address you provide to our waitlist or support, and the email address of your own Etsy account, which Etsy shares with us when you connect your shop (Etsy permission email_r). We use that address only to send you emails about your ConnectMyShop account, such as setup help when you join, occasional emails about your plan, product news and limited-time offers. New accounts receive these by default; you can turn them off anytime in your dashboard (Shop & security → Email), with the unsubscribe link in any such email, or by replying “no thanks”. We never receive or use your buyers’ email addresses, and we never share or sell your email. If you add a passkey, we store its credential identifier, public key, usage counter and creation date. The private key and your fingerprint, face or device PIN stay with your device or passkey provider; we do not receive them.
Etsy connection data. When you connect a shop through Etsy’s sign-in, Etsy gives us your shop and user identifiers, the permissions (scopes) you granted, and access and refresh tokens. We store tokens encrypted.
Shop data you ask us to access. Depending on the permissions you grant, this can include listing content (titles, descriptions, tags, prices, inventory, images, download files, personalization questions and category attributes), shop details and settings (such as your shop title, announcement, messages to buyers and shop sections), and, only if you enable order access, order information such as items and their options, totals, order and ship-by dates, the destination country and shipping status. Buyers’ names, addresses, contact details and personalization answers are never passed to AI assistants. We access this data only to answer requests from AI assistants you connected, or to show and carry out changes you approve. Where we show listing information, we link back to the listing on Etsy.
Shipping details you add. If you ask an AI assistant to mark orders as shipped, the carrier, tracking numbers and any note to the buyer are shown to you for approval and sent to Etsy only when you approve (Etsy then emails the buyer). They are kept with that request in your approval history.
Files you add to listings. When you add a photo to a listing or a download file to a digital listing through an AI assistant (a file you attached in the chat, a file on your computer, or a public image link) or on an approval card, we fetch the file and keep a temporary copy in our hosting provider’s storage until you decide on that request. When you approve, we upload it to Etsy and delete our copy straight away. If you decline or the request expires, our copy is deleted automatically within 7 days. Files you upload on a ConnectMyShop upload page go straight to Etsy and we don’t keep a copy. We only check a file’s type and size; we don’t use its contents for anything else. The file name, size and listing are kept in your approval and activity history.
Problem reports. If you ask your AI assistant to send us a bug report, feature request or question (the report_issue tool), it sends the type of report, a short summary and details written by the assistant (it is asked to include what you were trying to do and any error message, and never buyer information), and optionally the ID of the change the report is about. We save the report with your account, your shop identifier and the name of the AI assistant, and email it to the ConnectMyShop team together with your shop name, plan and account email, so we can look into it and reply. Only the ConnectMyShop team sees reports. Nothing is changed on Etsy.
AI connection data. Which AI assistants you connected, the permissions you gave each one, hashed connection keys, and the requests they made.
Approvals and activity history. Proposed changes, before-and-after previews, your decisions, and the results of approved actions.
Homepage showcase (optional). If you turn on “Show my shop on the ConnectMyShop homepage” in your dashboard (off by default), we show your public Etsy shop name and shop icon on our website and record when you turned it on. Turning it off removes your shop right away.
Technical and security data. IP address, browser type, timestamps and error logs, used to keep the Service secure and working. When your AI app connects, we also record its user agent, the app name and version it reports, the names of technical request fields and headers it sends (and the values of non-personal ones, such as app or connector identifiers; never account, session, location or device identifiers), the id of the plugin it was installed through (if it sends one), and the install source in the connection address (for example ?src=directory), so we can tell which apps and install routes sellers use.
Website analytics. We count visits with Cloudflare Web Analytics, which is cookieless. We also use Google Analytics, loaded through Google Tag Manager, to understand how visitors move through this website (pages viewed, buttons and links clicked, sections reached, how far a page is read). It sets first-party cookies (_ga, _ga_*), and Google processes this data for us as our service provider; Google Analytics does not store IP addresses. Its advertising features are off: no remarketing, Google signals or ad personalization, no link to Google Ads, and this data is not shared for advertising. In the EEA, the UK and Switzerland, Google Analytics loads only after you accept it in the cookie banner, and nothing is sent to Google before that; elsewhere it is on by default. You can accept or refuse it at any time from Cookie settings at the bottom of every page; refusing also deletes its cookies. Google Analytics data is kept for 14 months. It runs only on this public website, never in your dashboard or the connector, and never receives your Etsy data. When you arrive from a link we shared (for example ?ref=linkedin) or another website, we remember that source in a first-party cookie for 30 days and save it with your account if you sign up, so we know which channels bring new sellers. Once you sign in to your dashboard, a first-party cookie marks this browser as a customer for 400 days (it stays after you sign out, and refusing Google Analytics deletes it), so Google Analytics can tell visits by existing customers from visits by new visitors; it carries no account or shop details. If you arrive from one of our Google ads, we keep the ad’s click ID in a first-party cookie for 90 days and, if you connect a shop or subscribe, report that click ID and the event back to Google Ads so we can tell which ads work.
Partner (referral) links. If you open a link from a member of our partner program (for example ?ref=jane-doe), we keep that partner’s code in a first-party cookie for 30 days (a newer partner link replaces it) and, if you sign up, save it with your account so the partner can earn a commission on your subscription payments. We count visits per partner per day as a plain number, without IP addresses or other visitor data. Partners only see aggregate numbers (visits, sign-ups, paying customers and their earnings), never your shop name, email or any other detail about you.
Early-access sign-ups. If you join the waitlist, your email address and the optional answers you give (such as which AI assistant you use).
We do not use advertising trackers or sell data to data brokers.
How we use information
- To connect your Etsy shop to the AI assistants you choose and enforce the permissions you set.
- To show you proposed changes and carry out only the ones you approve.
- To keep an activity history you can review.
- To look into and answer problem reports, questions and feature requests you send us.
- To secure the Service, prevent abuse and respect Etsy’s API limits and policies.
- To provide support and send essential service messages (for example security or billing notices).
- To send early-access updates, if you asked for them. You can unsubscribe at any time.
- To comply with legal obligations.
Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (running the Service), our legitimate interests (security, abuse prevention and improving reliability), your consent (early-access emails, which you can withdraw), and legal obligations.
AI assistants you connect
You direct every request from your own AI account. When an AI assistant you connected makes a request, we return the shop information that its permissions allow. That information is then processed by the AI provider under your agreement with them (for example Anthropic or OpenAI) and their privacy policy. We don’t control how AI providers handle data you share with them, so choose permissions with that in mind. We never give an AI assistant your Etsy password or Etsy access tokens.
What we never do
- Sell or rent your personal information or shop data.
- Use your shop data or conversations to train AI or machine-learning models.
- Use Etsy data for advertising, profiling or analytics beyond operating the Service for you.
- Access your shop for any purpose other than the Service you requested.
Sharing
We share information only:
- With Etsy, when we call the Etsy API on your behalf.
- With AI assistants you connect, limited to the permissions you set.
- With service providers who host and operate the Service for us (such as cloud hosting, database, email delivery and error monitoring), under contracts that restrict their use of the data. A current list is available on request at privacy@connectmyshop.app.
- When required by law, or to protect the rights and safety of our users or the public.
- With a successor if the business is merged or sold, subject to this policy.
Retention
- Cached listing data: refreshed from Etsy within 6 hours and deleted when no longer needed.
- Other cached Etsy data: refreshed or deleted within 24 hours.
- Etsy tokens: deleted immediately when you disconnect your shop or delete your account.
- Approval and activity history: kept for up to 12 months so you can review what happened, then deleted.
- Files you add to listings: our temporary copy is deleted as soon as the file is sent to Etsy, and within 7 days if the request is declined or expires. Upload page links expire after 24 hours.
- Problem reports: kept for up to 12 months, then deleted, and deleted earlier if you delete your account. Report emails in the team’s inbox are kept only as long as needed to handle the report.
- Technical request logs: which tools your AI app called, when, the Etsy listing and order IDs a call referred to or listed, and any error message (no listing content or buyer data), kept for 30 days to fix problems and improve the service.
- Account data: kept while your account is open; deleted within 30 days of account deletion.
- Backups: encrypted backups roll off within 35 days.
- Your account email: kept while your account is open, updated each time you connect with Etsy, and deleted with your account.
- Waitlist emails: kept until launch communications end or you ask us to remove them.
Security
We use encryption in transit (HTTPS) and at rest for sensitive data such as Etsy tokens, hashed connection keys, least-privilege access and per-action approvals. No system is perfectly secure, but we work hard to protect your data. If a breach affecting your data occurs, we will notify you promptly — within 24 hours of confirming it — as well as Etsy and the relevant authorities as required. Read more on our security page.
Your rights and choices
Depending on where you live (including under Canada’s PIPEDA, the EU/UK GDPR and California’s CCPA/CPRA), you may have the right to:
- Access the personal information we hold about you and receive a copy.
- Correct inaccurate information.
- Delete your information (see how to delete your data).
- Object to or restrict certain processing, and withdraw consent.
- Data portability.
- Complain to your data-protection authority — in Canada, the Office of the Privacy Commissioner of Canada.
Email privacy@connectmyshop.app to exercise any of these rights. We respond within 30 days and won’t treat you differently for exercising them. We do not sell or “share” personal information for cross-context behavioral advertising as defined by California law.
International transfers
We are based in Canada and our service providers may process data in Canada, the United States or other countries. Where required, we use appropriate safeguards such as standard contractual clauses.
Children
The Service is for sellers who are old enough to hold an Etsy seller account and is not directed at children under 16.
Changes
We’ll post updates here and change the date above. For material changes, we’ll notify account holders by email before they take effect.
Contact
Privacy questions: privacy@connectmyshop.app
ConnectMyShop, Ontario, Canada
The term “Etsy” is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.