Privacy Policy

DoneListing (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use https://donelisting.com (the “Service”).

Information We Collect

We only collect the absolute minimum data necessary to provide the Service:

• Account information (email and authentication data, handled by Clerk)
• Payment information (processed securely by Stripe — we never see your card details)
• Temporary processing data: The product photo and short description you upload are processed in real-time to generate your Etsy listing.
• Operational subscription records: your Clerk account ID, Stripe customer and subscription IDs, plan, subscription status, billing period, and generation quota counters.
• Short-lived abuse-prevention counters using a one-way hash of an account ID or network address. We do not store prompts, images, or a raw IP address in these counters.

DoneListing does not persist uploaded photos, product descriptions, or generated listings in its own database after the generation request completes.

We do NOT use your uploaded images, prompts, or any user data to train DoneListing AI models.

Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on:

• Performance of a contract (to provide the Service)
• Legitimate interests (to improve the Service and prevent abuse)
• Legal obligations (tax and accounting)

How We Use Your Information

• To generate your Etsy-optimized listing using a third-party AI provider
• To process your subscription payment via Stripe
• To manage your account and send important service updates
• To enforce generation quotas and protect the Service from fraud, abuse, and excessive automated use

Data Sharing and International Transfers

We do not sell your personal data.

We share information only when strictly necessary with:

• OpenRouter and the selected third-party AI model provider — to generate a listing from the submitted image and description
• Stripe — for payment processing
• Clerk — for authentication
• Vercel and Neon — to host the Service and store the operational subscription and quota records described above

OpenRouter states that prompts and responses are not retained by default, but selected model providers may have different retention or training practices. Where a provider processes data outside the EU/EEA, its applicable data-transfer safeguards and privacy terms apply. A current sub-processor list is available on request.

Data Retention

DoneListing does not retain uploaded photos, descriptions, or generated listings after processing. Abuse-prevention counters expire automatically within 24 hours. An essential browser cookie stores a random trial ID so an anonymous visitor can use one free generation.

We retain account and operational subscription records while an account is active, and billing records for any period required by applicable law.

Your Rights (GDPR)

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and to data portability.

To exercise these rights, use our data request instructions or email donelisting@gmail.com.

You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI): https://vdai.lrv.lt

Cookies & Tracking

We use only the cookies and similar technologies that are strictly necessary to provide the Service: authentication (Clerk), payment security (Stripe), and basic routing (Vercel). We do not use any analytics, advertising, or marketing cookies. No data is sold or shared with third parties for advertising purposes.

Children's Data

The Service is not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy. We will notify you of material changes by updating the “Last updated” date.

Controller & Contact

The data controller for this Service is DoneListing, based in Lithuania. For privacy requests, contact donelisting@gmail.com.