Privacy Policy

1. Controller

The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) is:

Maxim Henkel
Ernst-Hochholzer-Straße 3
81825 Munich, Germany
Email: support@palotagz.com

Palotagz is an independent third-party tool that connects to marketplace and print-on-demand APIs (including Etsy and Printify) to help sellers bulk-manage listings and products.

DISCLAIMER: THIS APPLICATION IS SOLELY PROVIDED BY PALOTAGZ AND IS NOT ENDORSED, CERTIFIED, OR APPROVED BY ETSY, INC. THIS APPLICATION USES THE ETSY API BUT IS NOT ENDORSED OR CERTIFIED BY ETSY.

2. Visiting the Website (Server Logs)

When you open palotagz.com, our hosting provider Vercel automatically processes technical data your browser sends: IP address, date and time, requested page, referrer, browser and operating system. This is necessary to deliver the website and protect it against abuse (Art. 6(1)(f) GDPR, our legitimate interest in secure, stable operation). Log data is deleted by Vercel after a short period, generally within 30 days.

3. Account, Subscription, and Service Data

• Account data (email, name, subscription plan, preferences, onboarding answers, GPSR details you enter): processed to provide your account and the service (Art. 6(1)(b) GDPR).
• Etsy data (listings, images, videos, titles, descriptions, tags, prices): temporarily cached in your browser for up to 6 hours and never stored on our servers longer than 24 hours. For scheduled publishing we store only the listing ID and the publish time until the job has run.
• Printify, Gelato, Shopify, eBay, Amazon, and Pinterest data (products, variants, IDs, scheduled pins): stored in your Palotagz account so you can view, edit, and re-upload your catalog.
• Uploaded and generated files (designs, mockups, AI images): stored until you delete them or your account.
• OAuth tokens for connected services: stored encrypted and deleted when you disconnect or delete your account.
• Usage records (feature usage counts, activity history, plan limits): needed to enforce plan limits and show your history (Art. 6(1)(b) GDPR).
• Error reports: when an error occurs or you submit a report, we store the error message, the page, and, if signed in, your account email to fix the problem (Art. 6(1)(f) GDPR).

When you use AI features, the listing, product, image, and prompt data needed to produce the requested result is sent to OpenAI as our processor. AI output is returned to PaloTagz for your review; it is not published to a marketplace unless you request that.

We share data with connected marketplaces and print providers only when needed for an action you request, such as updating an Etsy listing or creating a Printify product (Art. 6(1)(b) GDPR). We never sell your data.

4. Payments

Payments and subscriptions are processed by Stripe. Stripe receives your email, billing address, and payment details; we do not see full card numbers (Art. 6(1)(b) GDPR). Invoices and billing records are kept for the statutory retention periods under German commercial and tax law, generally up to 10 years (Art. 6(1)(c) GDPR).

5. Emails and Contact

We send necessary account, security, and billing emails via Brevo (Art. 6(1)(b) GDPR). Messages you send through the contact form, support, or email are stored to answer you and document the business relationship (Art. 6(1)(b) or (f) GDPR) and deleted when no longer needed.

After you have used PaloTagz for a while we may email you once to ask for a review (Art. 6(1)(f) GDPR, our legitimate interest in customer feedback). You can object at any time using the link in the email.

Optional marketing emails. You can optionally request POD tips, tutorials, product updates, and occasional offers. Creating or using an account does not require this. We record your email, choice, date, source, and the consent wording shown (Art. 6(1)(a) GDPR). You can withdraw at any time via the unsubscribe link or by contacting support@palotagz.com. This choice does not enable cookie tracking.

6. Cookies & Tracking

On first visit a consent banner lets you accept all, reject non-essential cookies, or choose by category. All optional categories are off until you switch them on. Non-essential technologies are not loaded until you agree (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), and you can change or withdraw your choice anytime via Cookie settings in the footer. Your choice is stored in a cookie on your device for up to 6 months.

• Strictly necessary: sign-in session (Supabase authentication) and your cookie preference. Always active (§ 25(2) no. 2 TDDDG).
• Analytics: PostHog (EU hosting), used to understand how the site is used. Only with your consent.
• Marketing: Google Tag Manager for marketing measurement, and a creator referral cookie. If you arrive via a creator's referral link, the cookie records that visit for 30 days so the creator can be credited and you can receive the referral discount. Only with your consent; without it, you can still enter a referral code manually.

We also use cookieless measurement (Vercel Analytics and Speed Insights) that counts page views and performance without identifying you or tracking you across sites (Art. 6(1)(f) GDPR).

YouTube videos are embedded in privacy-enhanced mode (youtube-nocookie.com) and only load after you click play. At that point Google receives your IP address and video interaction data.

7. Chrome Extension

The Palotagz Chrome extension stores the following data locally in your browser using chrome.storage.local:

• Auth tokens, email, and subscription plan: to keep you signed in to the extension.
• User preferences (e.g., which stats to display).
• Saved listings: synced to your Palotagz account so you can access them across devices.
• Etsy listing data (views, favorites, listing age): publicly available information fetched directly from Etsy to display on search pages. Not stored on our servers.

The extension does not collect browsing history, track pages outside of Etsy.com, or transmit data to third parties.

8. Processors and International Transfers

We use the following service providers, bound by data processing agreements (Art. 28 GDPR):

• Vercel Inc. (USA) – hosting, server logs, cookieless analytics
• Supabase Inc. (USA) – authentication and database
• Stripe Payments Europe Ltd. (Ireland) – payments
• Sendinblue SAS / Brevo (France) – email delivery
• OpenAI (USA) – AI generation
• Cloudflare Inc. (USA) – file storage (R2)
• PostHog Inc. (EU hosting) – analytics, with consent
• Google Ireland Ltd. – Tag Manager and YouTube, with consent
• Ping Labs Inc. / UploadThing (USA) – legacy file storage, being phased out; no new uploads

Where data is transferred to the USA or another country without an EU adequacy decision, the transfer relies on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

9. Retention

We keep personal data only as long as needed for the purpose it was collected for. Account, listing, image, and connection data is deleted when you delete it or your account. Etsy data is purged within 24 hours. Billing records are kept for statutory retention periods. Support messages are deleted once no longer needed to handle the request or document the business relationship.

10. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data deleted (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent at any time with effect for the future (Art. 7(3))
• lodge a complaint with a supervisory authority (Art. 77), for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach

You can delete your entire account, including all stored catalog data and files, at any time under Settings → General → Delete account. For all other requests, email support@palotagz.com.

Providing your data is not legally required, but an account email is needed to use PaloTagz. We do not use automated decision-making within the meaning of Art. 22 GDPR.