← Back to Home

Privacy Policy — Zetlis

Effective Date: May 31, 2026  |  Last Updated: July 21, 2026

1. Introduction

Zetlis (“we”, “us”, “our”) operates zetlis.com and provides an AI-powered eBay listing automation service. This policy explains how we collect, use, and protect your information.

2. Information We Collect

  • Account: email and encrypted password via Supabase Auth.
  • Product Photos: stored so your saved listings stay complete in Listing History, and processed by Anthropic Claude AI only to generate listing content. Photos are kept for as long as you keep the listing — we do not delete them on a schedule. You can remove them at any time by deleting the listing, or your account.
  • eBay Access Tokens: short-lived tokens used to talk to eBay while you are using Zetlis. They are held as HttpOnly cookies in your browser and kept in memory on our servers only for the moment a request needs them. We never store them in our database.
  • eBay Authorization Credential: while your eBay account is connected, we keep one long-lived eBay authorization credential (your OAuth refresh token) on our servers, encrypted, so we can carry out eBay operations you have authorized — including keeping your listings in sync with eBay in the background, without you having to be signed in. It is encrypted with AES-256-GCM before it is saved, and the encryption key is held outside the database, so the stored value is not readable from the database alone. No security measure is absolute, but this credential only ever permits the eBay permissions you granted at connection, and you can revoke it at any time from eBay or by disconnecting in Zetlis. Disconnecting your eBay account, or deleting your Zetlis account, deletes it. If eBay tells us your eBay account was deleted, we delete it then too.
  • eBay Account Data: when you connect your eBay account, we store a one-way (SHA-256) hash of your eBay user ID and your eBay username in our database. If eBay notifies us that you deleted your eBay account, we erase your eBay username per the eBay Marketplace Account Deletion program; the anonymized hash is retained to maintain the integrity of the service.
  • Seller Profile: stored in your browser localStorage only, never on our servers.
  • Usage Logs: IP address, browser type, timestamps via Vercel — retained ~30 days.
  • Payments: processed by Paddle, our payment provider. Your card details are handled by Paddle and are never stored on our servers.

3. How We Use Your Information

To operate the service, process photos with AI, publish to eBay on your behalf, authenticate you, send service updates, and comply with legal obligations.

4. AI Processing

Photos are sent to Anthropic's API solely to generate listing content. We do not use your data to train AI models. We keep our copy of your photos only so your saved listings stay complete — see Data Retention below.

5. Zetlis Photo Collector (Browser Extension)

This section describes the Zetlis Photo Collector browser extension only. It is separate from how the zetlis.com website and the signed-in Zetlis app behave, which the rest of this policy covers. Photo Collector does not require a Zetlis account, and you can use it without having one.

The extension sends nothing to Zetlis

Photo Collector does not send the images you collect, the pages you visit, your browsing history, or any usage or analytics data to Zetlis or to any other service. It contains no analytics, no tracking, and no remote code. The images you select are saved by your own browser directly to your device.

What is stored, and where

The extension stores a small amount of data locally in your browser, using Chrome's extension storage: the product names and image addresses you have collected but not yet downloaded, your output preference (Original or JPG) and image-quality setting, and a record that you accepted the first-use notice. This never leaves your device. Removing the extension, or clearing your browser's extension data, deletes it.

Access to web pages

The extension has no standing access to any website. It reads a page only when you click its toolbar icon on that page, and only that tab — this is Chrome's “activeTab” model. It requests no host permissions and does not run in the background on the sites you browse. Its permissions are limited to acting on the tab you invoked it on, saving files you have chosen to download, and storing the local settings described above.

Network requests

When you download or convert an image, your browser fetches that image from the website hosting it, exactly as it would if you saved the picture yourself. Those requests go to that website, never to Zetlis. Visiting zetlis.com from a link in the extension is a normal visit to our website and is covered by the rest of this policy.

6. Third-Party Services

  • Supabase — authentication and storage
  • Vercel — hosting
  • Anthropic — AI processing
  • eBay — listing API
  • Paddle — payment processing

7. Data Sharing

We do not sell your data. We share only with the service providers above, strictly to operate the service.

8. Data Retention

  • Account data: retained while active.
  • Product photos: retained for as long as you keep the listing they belong to, on every plan including Free. They are not deleted on a schedule. Deleting a listing, or your account, removes them; photos from uploads never saved to a listing are cleared automatically once they are no longer referenced.
  • eBay access tokens: temporary. Held in your browser and, briefly, in memory on our servers while a request runs. Never stored in our database.
  • eBay authorization credential: stored encrypted only while your eBay account is connected. Deleted when you disconnect eBay, when you delete your Zetlis account, or when eBay notifies us your eBay account was deleted.
  • eBay account data: hashed user ID and username retained while your eBay connection exists; username erased on eBay account deletion notification.
  • Buyer and order data: we do not store any information about your buyers or your eBay orders.
  • Logs: ~30 days via Vercel.

9. Your Rights

EU / GDPR

Access, correct, delete, restrict, or export your data. Withdraw consent. File a complaint with your local data protection authority.

US / CCPA

Know what we collect, delete your data, and opt out of data sale (we do not sell data).

To exercise any right, contact support@zetlis.com.

10. Cookies

We use five HttpOnly cookies — ebay_token, ebay_refresh, ebay_oauth_state, ebay_username, and ebay_uid — required for eBay integration only. They are cleared when you disconnect eBay or delete your account. We do not use advertising or tracking cookies.

11. Security

We use HTTPS, HttpOnly cookies, Supabase Row Level Security (RLS) to keep each account's data separate, and automatic clean-up of uploaded files that are no longer attached to any of your listings. Your stored eBay authorization credential is encrypted with AES-256-GCM before it is written, and its encryption key is kept outside the database in our hosting provider's environment configuration. No system can be guaranteed completely secure, but this means database access on its own does not reveal the credential.

12. International Transfers

Service is operated from the United States. EU data may be transferred to the US under standard contractual clauses with our service providers.

13. Children

Service is not directed to users under 16. Contact support@zetlis.com if concerned.

14. Changes

We may update this policy from time to time. Continued use of the Service constitutes acceptance of the updated policy.

15. Contact