Privacy Policy

Who we are

Emporium Edge LLC operates StoreSum. We are the controller of the data described below. Contact: support@storesum.com.

What we receive from Etsy

When you connect your Etsy account, and only for the shop you connect, we receive:

• your shop's listings, including titles, tags, descriptions, images, inventory and prices;
• your orders and their transactions, including the buyer name and delivery address needed to fulfil and ship the order, and the buyer's personalisation notes where they left any;
• your payment ledger, fees, refunds and payouts;
• your shipping profiles, shop sections and policies;
• reviews left on your shop and listings.

We do not receive or store your Etsy password. Access is by an OAuth token that you can revoke from your Etsy account at any time.

Why we are allowed to process it

Where UK or EU data protection law applies, we rely on three bases:

• Performance of a contract — you have engaged us to work on your shop, and the data is what that work requires. This covers almost everything we do.
• Your consent — connecting your Etsy account. You give it at the Etsy authorisation screen and you can withdraw it from your Etsy account at any time.
• Our legitimate interests — keeping the service secure, preventing fraud and abuse of accounts, and keeping the records we need to run the business. We rely on this only where it does not override your rights.

For the small amount of buyer personal data that reaches us inside your orders, we act as a processor on your behalf; you remain the controller of your buyers' data, as you are on Etsy.

What we use it for

Solely to provide the service to you: showing you your shop's orders, listings and finances; preparing listing changes you approve; sending shipping and tracking back to Etsy; and reporting on your own shop's performance to you. Buyer details are used to fulfil the order they belong to and for nothing else — no marketing, no profiling, no resale.

Where we use an AI service to draft listing text, it receives the listing information needed for that draft. It does not receive buyer names, addresses or payment details.

If you pay for a StoreSum subscription, the fee is for the dashboard features we build and run — it is not a charge for access to your own Etsy data. We keep the record of what you were charged and when. We do not take card details through this application and we do not store a card number.

What we never do

• We do not sell, licence, rent or otherwise transfer your data or Etsy member data to any third party.
• We do not combine one seller's shop data with another's, or show one seller anything about another seller's shop.
• We do not use your data to train AI models.
• We do not contact your buyers except through Etsy, as part of fulfilling their order.

Who can see it

Your shop's data is visible to you, and to the members of our staff assigned to work on your shop. Access is restricted by role, and every account's access is limited to the shops it has been granted. Our infrastructure providers process data on our behalf under contract and only to host the service.

Who processes data for us

We use a small number of providers, each under contract and only to run the service:

• Hostinger — hosting, databases and email, for this site and the application.
• Cloudflare — DNS and network protection in front of the application.
• Amazon Web Services (SES) — outbound email we send you.
• An AI provider — receives only listing information when drafting listing text, and never buyer names, addresses or payment details.

None of them is permitted to use your data for their own purposes.

Where your data is held

Data is processed in the United States and the European Union. Where data moves between them, it does so under the standard contractual clauses approved for that purpose, which are part of our data processing agreements with the providers above.

How long we keep it

We keep your shop's data for as long as your account with us is active, because the service is a history of your shop's performance and finances. When you disconnect the Application we stop retrieving new data immediately. You may ask us to delete the data we already hold, and we will do so unless we are required to keep specific records for tax or accounting reasons.

When you close your account we delete your shop's data. We remove the Etsy listing, order, ledger and review data we hold for your shop, and the authorisation tokens for it, within 30 days of the account being closed. What we keep after that is only the records law requires us to keep — invoices and payment records for tax and accounting — and those contain no Etsy buyer data.

Your rights

You may ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Write to support@storesum.com and we will respond. Buyers whose details reach us through your orders may exercise the same rights; if a buyer contacts us directly we will work with you as the seller of record.

In full, you may: know what we collect and why; get a copy of it; correct it; have it deleted; receive it in a portable form; object to a use of it; ask us to restrict a use of it; and be treated no differently for exercising any of these. We will not refuse you service, change your price or downgrade your account because you made a request.

If you are in California

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either, and we take no money from anyone for access to your data. There is therefore nothing for you to opt out of, but the rights listed above — to know, to access, to correct, to delete, to a portable copy, and to equal service — are yours under California law and you exercise them the same way, by writing to us.

We do not knowingly collect or sell the personal information of anyone under 16.

Making a request

Write to support@storesum.com. We reply within 5 business days, and usually sooner. Where a request takes work — putting together a copy of your data, or deleting it — we complete it within 30 days, which is the limit data protection law sets. We will ask you to confirm you control the Etsy shop the request concerns before we act — a request about a shop is a request about that shop's orders and buyers, so we check. You may also complain to your local data protection authority.

Someone acting for you. An agent may make a request on your behalf if they send us written authority signed by you, and we may still ask you to confirm it directly. We do this because a request about a shop is a request about that shop's orders and its buyers.

Repeated or excessive requests. Data protection law lets us charge a reasonable fee for, or decline, a request that is clearly unfounded or excessive — for example the same request made over and over. If we ever do that we will tell you why and how to challenge it. We have not had to.

Cookies

This website sets no cookies at all — no analytics, no advertising, no tracking.

The application at app.storesum.com sets one cookie of its own. It keeps you signed in, it expires seven days after your last visit, and it holds nothing but a random session identifier. It is not used to track you anywhere else. Signing out ends it immediately. Cloudflare, which protects the application from attack, may set its own short-lived cookie to tell automated traffic from real visitors; it is not used for advertising and we do not read it.

Security

Etsy asked us to set out how we protect seller data. Every measure below is in place today — we have not listed anything we intend to do later.

Your Etsy authorisation. We never receive, ask for or store your Etsy password. Access is by an OAuth token, and both the access and refresh tokens are encrypted before they are stored, using AES-256-GCM. The encryption key is held outside the application's code and is not in our code repository. The same encryption protects every other credential we hold for you. A token is never displayed back to anyone, not even to our own staff, and you can revoke it from your Etsy account at any time without asking us.

In transit. The site and the application are HTTPS only; a plain HTTP request is redirected before it reaches the application. Every call we make to Etsy is over HTTPS.

Who can reach what. Signing in is required for everything. Each account is granted access to named shops, and a request for a shop outside that list is refused by the server, not merely hidden in the interface. What a staff member may do within a shop is decided by role permissions, so being able to see a shop and being able to send something to Etsy on its behalf are separate grants. Passwords are stored only as one-way hashes. Session cookies are marked secure and HTTP-only, so they are not readable by scripts in the browser.

Record of what was done. Privileged actions — revealing a credential, changing a shop's settings, sending something to Etsy on your behalf — are written to an audit log naming the account and the time. Forms that change data carry a token that stops another website submitting them on your behalf, and sign-in attempts are rate limited.

What we deliberately do not do. We do not copy your data into third-party analytics or advertising tools, and one seller's data is never pooled with another's. The limits in What we never do, above, are enforced here and not only promised.

If something goes wrong. If we become aware of a breach affecting your shop's data we will tell you, and Etsy at dpo@etsy.com, without undue delay and in any event within 24 hours of discovering it — the deadline Etsy's API Terms of Use set — with what we know, what we are doing about it, and what you may need to do — including anything you may need to report to your own data protection authority. If buyer data is involved you are the controller of it, so we will give you what you need to make that decision.

Who is responsible for this

Huzaifa Ali is accountable for how seller data is handled here, including every request and every complaint about this policy. Reach him directly at huzaifa@storesum.com, or use support@storesum.com and say it is a data protection matter.

Children

StoreSum is a tool for people running a business and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

Changes

If we change this policy materially we will tell connected sellers before the change takes effect.