1. Introduction
Zetlis (“we”, “us”, “our”) operates zetlis.com and provides an AI-powered eBay listing automation service. This policy explains how we collect, use, and protect your information.
2. Information We Collect
- Account: email and encrypted password via Supabase Auth.
- Product Photos: stored so your saved listings stay complete in Listing History, and processed by Anthropic Claude AI only to generate listing content. Photos are kept for as long as you keep the listing — we do not delete them on a schedule. You can remove them at any time by deleting the listing, or your account.
- eBay Access Tokens: short-lived tokens used to talk to eBay while you are using Zetlis. They are held as HttpOnly cookies in your browser and kept in memory on our servers only for the moment a request needs them. We never store them in our database.
- eBay Authorization Credential: while your eBay account is connected, we keep one long-lived eBay authorization credential (your OAuth refresh token) on our servers, encrypted, so we can carry out eBay operations you have authorized — including keeping your listings in sync with eBay in the background, without you having to be signed in. It is encrypted with AES-256-GCM before it is saved, and the encryption key is held outside the database, so the stored value is not readable from the database alone. No security measure is absolute, but this credential only ever permits the eBay permissions you granted at connection, and you can revoke it at any time from eBay or by disconnecting in Zetlis. Disconnecting your eBay account, or deleting your Zetlis account, deletes it. If eBay tells us your eBay account was deleted, we delete it then too.
- eBay Account Data: when you connect your eBay account, we store a one-way (SHA-256) hash of your eBay user ID and your eBay username in our database. If eBay notifies us that you deleted your eBay account, we erase your eBay username per the eBay Marketplace Account Deletion program; the anonymized hash is retained to maintain the integrity of the service.
- Promoted Listings: if you turn on eBay Promoted Listings for a listing, we store the eBay campaign ID, the eBay listing ID, the ad rate you chose, and the promotion's status, so we can create and manage the ad on your behalf and show you its current status. This is optional and off by default — nothing is stored unless you turn it on. The first time you do, eBay asks for one additional, one-time authorization for advertising. Advertising fees are charged by eBay, not Zetlis. eBay charges advertising fees on qualifying sales. Zetlis does not charge or collect these fees.
- Sales Records (Sold tab): while your eBay account is connected, we periodically read your eBay orders through eBay's Fulfillment API so that the Sold tab can show which of your listings have sold. For each order line item we store the eBay order and line-item identifiers, the marketplace, the SKU, the item ID and variation, the listing title as eBay reported it at the time of sale, the quantity, the price and currency, the order's fulfillment, payment and cancellation status, the sale date and last-modified date, the date Zetlis first saw the sale, and which Zetlis listing the sale was matched to, if any. This applies to all orders on the connected eBay account, starting from up to 90 days before your first synchronization, and includes sales of listings that were not created with Zetlis: those are stored with the same fields, appear in the Sold tab only as a count, and are re-checked on later synchronizations in case they match a Zetlis listing. We do not store any buyer information — no name, username, email, address, phone number or payment details — and we do not store the raw order data that eBay returns.
- Seller Profile: the settings you enter in a Seller Profile (store and brand name, niche, writing tone, keywords, description footer, eBay marketplace, ships-from country and postal code, default size list and package details) are saved to your account on our servers so they follow you across devices. They are deleted with your account. Your browser also keeps a local copy so the app can show them immediately; clearing your browser's site data removes that copy.
- Blog Article Feedback: if you answer “Was this article helpful?” at the end of a blog article, we store the article, its language, your yes/no answer, any comment you choose to write, and the date. This is optional and needs no account. We do not store your name, email address, IP address or browser details with it; your IP address is used only to prevent abuse, for up to one hour, and is never saved with your feedback. So that each reader is counted once per article, your browser keeps a random ID in its local storage (created only when you answer), together with a note of your answer; we store only a one-way (SHA-256) hash of that ID combined with the article, which does not identify you. Please do not include personal information in comments.
- Usage Logs: IP address, browser type, timestamps via Vercel — retained ~30 days.
- Payments: processed by Paddle, our payment provider. Your card details are handled by Paddle and are never stored on our servers.
3. How We Use Your Information
To operate the service, process photos with AI, publish to eBay on your behalf, manage Promoted Listings campaigns you choose to run, show you your own eBay sales in the Sold tab, authenticate you, send service updates, and comply with legal obligations.
4. AI Processing
Photos are sent to Anthropic's API solely to generate listing content. We do not use your data to train AI models. We keep our copy of your photos only so your saved listings stay complete — see Data Retention below.
6. Third-Party Services
- Supabase — authentication and storage
- Vercel — hosting
- Anthropic — AI processing
- eBay — listing API
- Paddle — payment processing
- Google — website analytics (Google Analytics)
7. Data Sharing
We do not sell your data. We share only with the service providers above, strictly to operate the service.
8. Data Retention
- Account data and Seller Profiles: retained while your account exists; deleted with your account.
- Activity history after account deletion: a record of what you did in Zetlis (event types such as saving a Seller Profile, connecting eBay, analyses and publishing, with their times and outcomes) is kept for 30 days after you delete your account, to help us understand and fix problems, and then deleted automatically. It does not include your email address, profile contents, listings, photos or eBay credentials.
- Free-trial record: when an account receives the introductory free analyses, we store a keyed one-way fingerprint (HMAC-SHA256) of its email address — never the address itself — so the same email cannot receive them again. It contains nothing else, cannot be used to identify or contact you, and is kept after you delete your account.
- Product photos: retained for as long as you keep the listing they belong to, on every plan including Free. They are not deleted on a schedule. Deleting a listing, or your account, removes them; photos from uploads never saved to a listing are cleared automatically once they are no longer referenced.
- eBay access tokens: temporary. Held in your browser and, briefly, in memory on our servers while a request runs. Never stored in our database.
- eBay authorization credential: stored encrypted only while your eBay account is connected. Deleted when you disconnect eBay, when you delete your Zetlis account, or when eBay notifies us your eBay account was deleted.
- eBay account data: hashed user ID and username retained while your eBay connection exists; username erased on eBay account deletion notification.
- Promoted Listings data: retained for as long as your Zetlis account exists. Deleting a listing, or disconnecting your eBay account, does not stop an ad already running on eBay — manage or stop it directly in eBay Seller Hub. Deleting your Zetlis account deletes this data.
- Sales records: retained for as long as your Zetlis account exists, so your sales history stays complete even after you delete the matching listing from History or disconnect your eBay account (disconnecting stops further synchronization but does not remove records already stored). Deleting your Zetlis account deletes them.
- Buyer data: we do not store any information about your buyers.
- Blog article feedback: kept for as long as it helps us improve our articles. It is not linked to any account; to have a comment removed, email support@zetlis.com with the article and the text of the comment.
- Logs: ~30 days via Vercel.
9. Your Rights
EU / GDPR
Access, correct, delete, restrict, or export your data. Withdraw consent. File a complaint with your local data protection authority.
US / CCPA
Know what we collect, delete your data, and opt out of data sale (we do not sell data).
To exercise any right, contact support@zetlis.com.
10. Cookies
We set the following cookies ourselves:
- eBay connection (HttpOnly, only while your eBay account is connected):
ebay_token (your current eBay access token; expires when the token does, normally within 2 hours), ebay_refresh, ebay_username and ebay_uid (up to 540 days), and ebay_oauth_state (a one-time security value used only during the connection step; 10 minutes). They are required to act on eBay for you and are cleared when you disconnect eBay or delete your account. zx_lang — the interface language, so it is kept on your next visit. On your first visit it is set from the country derived from your IP address (for example Italian for Italy, English where Zetlis does not offer your language); after that it changes only when you pick a language. 1 year, renewed when you visit.zx_cc — the two-letter country code our hosting provider derives from your IP address, used to show plan prices in the currency for your country. Nothing else is stored in it; 30 days.zx_ref — the referral code from a link you arrived through, so the referral can be credited when you sign up. 30 days; removed as soon as it has been applied.zetlis_auth_hint — a 1/0 flag recording whether you were signed in on your last visit, so a returning user is shown the app rather than a flash of the homepage. It grants no access and contains no credentials; 30 days, removed when you sign out.
zetlis.com also uses Google Analytics to measure how the site is used. Google sets its own cookies for this (names beginning with _ga); how Google handles that data is described in Google's privacy policy. We do not use advertising cookies.
11. Security
We use HTTPS, HttpOnly cookies, Supabase Row Level Security (RLS) to keep each account's data separate, and automatic clean-up of uploaded files that are no longer attached to any of your listings. Your stored eBay authorization credential is encrypted with AES-256-GCM before it is written, and its encryption key is kept outside the database in our hosting provider's environment configuration. No system can be guaranteed completely secure, but this means database access on its own does not reveal the credential.
12. International Transfers
Service is operated from the United States. EU data may be transferred to the US under standard contractual clauses with our service providers.
13. Children
Service is not directed to users under 16. Contact support@zetlis.com if concerned.
14. Changes
We may update this policy from time to time. Continued use of the Service constitutes acceptance of the updated policy.