Privacy Policy

Last updated: October 23, 2026 · Effective: October 23, 2026

1. Who We Are

Growtsy ("we", "us", "our") operates growtsy.com, an AI-powered tool for Etsy sellers. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our website and service.

Growtsy is operated by an independent developer based in Istanbul, Türkiye. Payments are processed by Paddle, our Merchant of Record.

For privacy inquiries, contact: hello@growtsy.com.

2. Information We Collect

2.1 Information you provide

• Account data: email address and password (stored hashed by our authentication provider), or the identifiers, name and profile picture Google shares when you sign in with Google.
• Profile data: name, country, language, Etsy shop name, product category and other optional details you choose to provide.
• Content you submit: product photos, Etsy listing links, shop names, product descriptions, keywords, and any text you submit for analysis, plus the results we generate for you.
• Support communications: in-app support requests, messages sent through the contact form on our website, and emails to hello@growtsy.com.
• Testimonials (only if you submit one): the statement you write, the name you choose to show with it (optional), the places you allow us to show it (our website, our pricing page, social media, marketing emails), any evidence links you add for a number in it, and a record of your consent: the time, the version of the consent text you agreed to, your browser's user-agent and a keyed one-way hash of your IP address (not the address itself).

2.2 Information collected automatically

• Usage data: features used, analyses run, credits consumed, timestamps, and feature-level interactions (used to run the product, enforce plan limits and improve Growtsy).
• Our own website measurement: our pages send a small first-party measurement record to our server: a random visitor ID kept in your browser's local storage, a session ID, the page address, the referring page, campaign parameters in the link (such as utm tags or a Google ad click ID), device type, browser and operating system family, screen width, browser language and, on the home page, page-load timings. It sets no cookies. Our host adds the country derived from your IP address; we do not store the IP address in these records.
• IP address: when you create an account, our server reads your IP address and stores only a keyed one-way hash of it with your account, to prevent abuse of free credits and referrals. The hash cannot be turned back into the IP address and is not shared with any third party. Our rate limiter keeps your most recent IP address for up to 7 days to stop abuse.
• Approximate location: the country, region and city that our host derives from your IP address are saved to your profile if those fields are empty, so the app can start from your country (for example for Etsy fee figures and publish-time suggestions). You can change them in Settings.

2.3 Your Etsy shop

• We do not connect to your Etsy account. We hold no Etsy password, login or access token, and we cannot change anything in your shop.
• When you give us an Etsy listing link or a shop name, we read that listing's or shop's public data (for example title, tags, photos, prices, active listings and the shop's sales count) through Etsy's public Open API, using Growtsy's own API key. If you save a shop name in Growtsy, we use it the same way for the "Your Etsy shop" panel on your Dashboard and for the shop findings in our reminder emails.
• We do not store payment card details. All payments are processed by Paddle.
• We do not sell your data.

3. How We Use Your Information

We use personal data to:

• Provide, operate, and maintain the Growtsy service.
• Process your submitted content through AI providers to generate listings, analyses, and images.
• Enforce plan limits, credits, and subscription entitlements.
• Send account emails (payment problems, replies to your support requests).
• Send product emails to account holders (welcome, tips, reminders, product news). Every product email has a one-click unsubscribe link, and you can also turn them off in Settings → Account → Notifications → New features.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Measure and improve the product.
• Comply with legal obligations (tax, accounting, law enforcement requests).

We do not sell your personal data. We do not use your content to train AI models.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland, we process your personal data on the following legal bases under Article 6 of the GDPR:

Purpose	Legal basis
Delivering the service you requested (account, analyses, payments, account emails)	Performance of a contract — Art. 6(1)(b)
Product improvement, our own first-party measurement, fraud and abuse prevention, service security	Legitimate interest — Art. 6(1)(f)
Product emails to account holders	Legitimate interest — Art. 6(1)(f); you can object at any time with the unsubscribe link or in Settings
Google Analytics and Google Ads cookies	Consent — Art. 6(1)(a), given or refused in the cookie banner
Publishing a testimonial you submit	Consent — Art. 6(1)(a), given in the testimonial form
Tax, accounting, legal recordkeeping	Legal obligation — Art. 6(1)(c)

You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal: for cookies, with the Cookie settings button; for a testimonial, by emailing hello@growtsy.com or sending a request from Help in the app.

5. Data Retention

We keep personal data as follows:

Data category	Retention period
Account and profile data	As long as your account exists. Removed when you delete your account.
Uploaded product photos and generated images (Photo Studio, Listing, VisualKit)	Stored in Supabase Storage as long as your account exists, and deleted when you delete your account. Removing an item from your Library removes it from your Library but does not delete the stored image file. Image files are stored at long, hard-to-guess web addresses; anyone who has the exact address can open the file.
Saved listings, analyses and other results	As long as your account exists, or until you delete the item
Usage records	As long as your account exists. Page-navigation records are deleted after 180 days; measurement sessions of visitors who never created an account are deleted after 90 days.
Rate-limit and abuse-prevention records (user ID, last IP address)	Expire automatically, generally within 7 days. An IP address blocked for abuse is kept for the length of the block.
"Your Etsy shop" panel snapshots (shop name and the public findings)	Expire automatically after 60 days
Testimonials and their consent record	As long as your account exists, and deleted when you delete your account. If you withdraw consent, we stop showing the testimonial and keep the record of your consent and its withdrawal as proof.
Support requests and contact-form messages	As long as your account exists, or until you ask us to delete them
Billing and payment records	Kept by Paddle under its own policy and applicable tax law

When you delete your account from Settings → Account, we delete your account (sign-in), profile, saved work, stored image files and usage records, and cancel an active subscription. Our database provider's daily backups can contain deleted data for up to 7 days. Paddle keeps its own transaction records as the seller of record. Cancelling on deletion takes effect immediately and unused subscription time is not refunded automatically. To stop free credits from being claimed again by deleting and re-creating an account, we keep a minimal record: a one-way hash of your email address and of any connected shop name, the number of free analyses already used and the names of one-time bonuses already claimed. It contains no name, email address or IP address.

6. Third-Party Services (Sub-processors)

We share personal data only with the following service providers, and only for the purposes shown:

Provider	Purpose and data	Location
Supabase	Database, sign-in and file storage (all account data and content)	EU (Frankfurt)
Vercel	Website hosting and server functions; derives approximate location from your IP address	United States
Anthropic (Claude API)	Text analysis and generation, photo understanding (the photos, links and text you submit)	United States
fal.ai	AI image generation (your product photo and the scene instructions)	United States
Paddle	Payments, subscriptions and invoicing as Merchant of Record. Paddle's script runs on our home page and app for checkout and for Paddle Retain (payment recovery for subscribers whose payment failed).	United Kingdom and United States
Resend	Sending our emails (your email address and the email content)	United States
Upstash	Rate limits and short-lived caches (user ID, IP address, shop name)	United States
Google	Google Analytics 4 and Google Ads tags (see Section 10); for a purchase that started from a Google ad click, the ad click ID, purchase value, currency and plan are sent from our server to Google Ads through Zapier; Google Fonts loaded by the app and some pages (Google sees your IP address when the font loads)	United States
Zapier	Relays a purchase conversion (Google ad click ID, purchase value, currency, plan, order ID and time) from our server to Google Ads, only for a purchase that started from a Google ad click. No email address or name is sent.	United States
Etsy (Open API)	Reading public listing and shop data for the links and shop names you submit. Etsy receives the listing ID or shop name, not your email or account details.	United States
Slack	Internal notifications to our team about new support requests and contact-form messages (your email address and message) and system alerts	United States
Natro	Hosting of our mailbox hello@growtsy.com (emails you send us)	Türkiye
ipapi.co	Only if our own location lookup returns nothing during profile setup, your browser asks ipapi.co for your approximate location (ipapi.co sees your IP address)	Provider's servers
cdnjs (Cloudflare) and jsDelivr	Public code libraries your browser downloads when you convert an iPhone (HEIC) photo or download images as a ZIP (they see your IP address)	Global

Each provider has its own privacy policy. We do not sell your personal data to any party.

7. International Data Transfers

Some of our providers are located outside the EEA, the UK, and Türkiye (primarily the United States). When we transfer your personal data outside these jurisdictions, we rely on appropriate safeguards.

7.1 Transfers from the EEA and the UK (GDPR)

For transfers from the EEA or UK, we rely on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission.
• UK International Data Transfer Agreement (IDTA) where applicable.
• EU–US Data Privacy Framework certification of the relevant provider, where available.

7.2 Transfers from Türkiye (KVKK)

For users in Türkiye, your personal data may be transferred to providers located outside Türkiye (primarily in the United States and the European Economic Area). Under Article 9 of the Turkish Personal Data Protection Law No. 6698 (KVKK), as amended by Law No. 7499 (March 2024), we rely on the following grounds for international transfers in the absence of a Personal Data Protection Board ("Kurul") adequacy decision for the destination country:

• Performance of a contract between you and Growtsy (KVKK Art. 5(2)(c) and Art. 9(6)(b)) — transfers strictly necessary to deliver the Service you requested;
• Your explicit informed consent (KVKK Art. 9(6)(a)) for occasional transfers where appropriate safeguards are not feasible, after we inform you of the relevant risks.

The countries where your data may be processed include the United States (Anthropic, fal.ai, Vercel, Resend, Upstash, Google, Zapier, Etsy, Slack), the United Kingdom (Paddle), Germany / EEA (Supabase Frankfurt region) and Türkiye (Natro, our mailbox host).

You may exercise your rights under KVKK Article 11 (information, access, correction, deletion, etc.) by emailing hello@growtsy.com. We will respond within 30 days.

7.3 Transfers from other jurisdictions

Where local data protection law requires specific safeguards, we apply equivalent protections to those described above.

8. Data Security

We apply technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS) and at rest for stored images and database records.
• Passwords stored using one-way cryptographic hashing — we never see your plaintext password.
• Row-level security on the database to isolate each user's data.
• Principle of least privilege for internal access to production systems.

No method of transmission or storage is 100% secure. If we become aware of a personal data breach affecting your data, we will notify the relevant supervisory authority within 72 hours (per GDPR Article 33) and notify you without undue delay where required by GDPR Article 34.

9. Your Rights

9.1 Rights under GDPR (EEA / UK residents)

You have the following rights regarding your personal data:

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data.
• Right to restriction — limit how we process your data in certain situations.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interest, including product emails.
• Right to withdraw consent — where processing is based on consent.
• Right to lodge a complaint with your local supervisory authority.

9.2 Rights under CCPA / CPRA (California residents)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, and disclosed.
• Access a copy of your personal information.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information. Growtsy does not sell personal information. Our Google Ads tag measures whether an ad click led to a signup or purchase, which may count as "sharing" under the CCPA; you can turn the tag off in your browser with the Cookie settings button. For a purchase that started from a Google ad click, our server also reports the conversion to Google Ads (see Section 6); the cookie choice does not cover that report, so email hello@growtsy.com to opt out of it.
• Non-discrimination for exercising these rights.

9.3 Rights under KVKK (Türkiye residents)

If you are located in Türkiye, you have the following rights under Article 11 of the Personal Data Protection Law (KVKK):

• To learn whether your personal data is being processed.
• To request information if your personal data has been processed.
• To learn the purpose of processing and whether the data is used for that purpose.
• To know the third parties (in Türkiye or abroad) to whom your data has been transferred.
• To request correction of incomplete or inaccurate data.
• To request deletion or destruction of your personal data within the conditions of KVKK Article 7.
• To request notification to third parties of any correction, deletion, or destruction.
• To object to outcomes that arise from automated processing of your data alone.
• To request compensation for damages resulting from unlawful processing.

9.4 How to exercise your rights

In the app, Settings → Account lets you download a copy of your data and delete your account (deleting your account also cancels an active subscription). Product emails have a one-click unsubscribe link. For any other request, email hello@growtsy.com with the subject "Privacy Request". We will respond within 30 days (GDPR / KVKK) or 45 days (CCPA) of verified receipt.

10. Cookies and Similar Technologies

• Strictly necessary storage: your sign-in session (kept in your browser's local storage), your language and cookie choices, and a copy of your profile cached on your device for up to 24 hours to open the app faster (removed when you sign out).
• Our own measurement: the first-party records described in Section 2.2. They use local and session storage, not cookies, and go only to our own server.
• Google Analytics 4 and Google Ads: Google's tag loads on our home page, the app, the pricing and tools pages, and many comparison, fee and guide pages, and can set cookies such as _ga and _gcl_aw. Analytics measures how our site is used; the Ads tag measures whether a click on a Growtsy ad led to a signup or purchase. In the EEA, the UK and Switzerland these cookies stay off until you choose "Accept" in our cookie banner; "Reject" keeps them off. Elsewhere they are on by default.
• Paddle: Paddle's script runs on our home page and app for checkout and Paddle Retain, and may set its own cookies when you interact with it.

You can change your choice at any time: Cookie settings

11. AI Processing Disclosure

Content you submit (listing links, product photos, descriptions, keywords) is sent to our AI providers (Anthropic and fal.ai) through their commercial APIs to generate the output you requested. We do not use your content to train AI models. Each provider's own terms describe how long it keeps API inputs.

AI outputs are provided as recommendations. You are responsible for reviewing AI-generated content before publishing to Etsy or using commercially.

11.1 Photos containing people

Before Photo Studio generates images, an AI model (Anthropic) checks your photo and returns yes/no flags, including whether an identifiable person's face is present and whether the photo appears to show a well-known public figure (a likeness and intellectual-property risk). If a face is present, generation uses framing that leaves the face out. This check does not extract, store, transmit, or generate any of the following:

• Facial geometry templates or "faceprints"
• Mathematical representations of facial features that could uniquely identify an individual
• Biometric identifiers as defined under the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14)
• Special-category biometric data as defined under GDPR Article 9 or KVKK Article 6

We do not use facial information to identify you or any other person, and we do not share it with third parties beyond the AI providers needed to deliver the requested output.

If you do not wish to upload photos containing identifiable persons, you can simply use product-only photographs. If a photo containing a person's face is uploaded, you confirm under Section 8.4 of our Terms of Service that you have any necessary permissions from the depicted person.

11.2 EU AI Act transparency

For users located in the European Union, we provide the following transparency disclosure under Article 50 of Regulation (EU) 2024/1689 (AI Act), as it begins to apply on 2 August 2026:

• Listing analyses, keyword research, copywriting, and photo generation features in Growtsy are powered by generative AI systems. You are interacting with AI, not with a human writer or photographer.
• Images produced by Photo Studio and VisualKit are AI-generated (synthetic).
• If your use of an AI-generated image triggers your own disclosure obligations (for example, where a synthetic depiction of a human model qualifies as a "deep fake" under Article 3(60) and is published outside your own product listing), those disclosure obligations are your responsibility under Article 50(4).

For full details, see Section 8.6 of our Terms of Service.

12. Children's Privacy

Growtsy is not intended for children. We do not knowingly collect personal data from users under 13 (United States) or under 16 (European Economic Area and United Kingdom). If we learn that we have collected personal data from a child without verified parental consent, we will delete it promptly. If you believe a child has provided us with personal data, email hello@growtsy.com.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. If changes are material and reduce your rights, we will notify you by email or via an in-app notification at least 30 days before they take effect. Changes that only describe what we already do or add protections take effect when posted. The "Last updated" date at the top of this page always reflects the current version.

14. Contact and Complaints

Growtsy is operated by an independent developer based in Istanbul, Türkiye.

Privacy questions, requests, or complaints: hello@growtsy.com. We aim to respond within 72 hours.

EEA / UK residents may also lodge a complaint with their national data protection authority. A list of EU authorities is available at edpb.europa.eu.

Türkiye residents may lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) at kvkk.gov.tr, after first applying to us under KVKK Article 13.