Privacy policy

The controller responsible for processing personal data on this website is:

When you open the public pages, we process the data your browser sends: IP address, date and time, the address requested and browser identification. This is technically necessary to deliver the page and keep it secure. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and stable operation of the service.

Using the service requires an account. We store your email address, a user identifier from the authentication provider, your plan and the time the account was created. Sign-in itself is handled by Clerk. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

When you add an Etsy shop, we store its name, its public Etsy shop identifier and the time of the last retrieval. No Etsy sign-in is required for this; only publicly available data is retrieved.

From the shop’s publicly visible reviews we produce weekly reports. We store a sentiment score, the themes found together with their counts, a summary, and verbatim excerpts from individual reviews. Names, identifiers or other details about the people who wrote those reviews are not stored. The review texts themselves are not kept — they are processed only for the duration of the analysis. The legal basis is Art. 6(1)(b) GDPR towards you as a user, and Art. 6(1)(f) GDPR with regard to the publicly available reviews; the legitimate interest is the evaluation of publicly published feedback on behalf of the shop’s operator.

We additionally record publicly available shop figures each week — views, favourites, number of sales, and the title, address, price and stock of the most-viewed listings. These figures concern the shop, not individual buyers.

The substantive analysis of the reviews is performed automatically by an AI language model. For this, the shop name and the review texts of the relevant period are transmitted to the provider named in section 7. The resulting reports are AI-generated content and are identified as such.

No automated decision-making in individual cases, including profiling, within the meaning of Art. 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you.

The paid plan is handled through Stripe. You enter your payment details directly with Stripe; we do not receive full payment credentials. We store only the customer and subscription identifiers and the plan booked. The legal basis is Art. 6(1)(b) GDPR.

We use the following service providers. Data processing agreements under Art. 28 GDPR are in place with them.

An email delivery provider is additionally planned for sending the weekly notification. This policy will be updated once that is active.

The providers listed in section 7 process data wholly or partly in the United States. Such transfers take place on the basis of an adequacy decision of the European Commission under Art. 45 GDPR where the provider has certified under the EU-US Data Privacy Framework, and otherwise on the basis of standard contractual clauses under Art. 46(2)(c) GDPR.

The United States does not offer a level of data protection equivalent to European law. In particular, authorities there may access data under certain conditions without effective legal remedies necessarily being available.

Account, shop and report data are stored for as long as your account exists. After deletion they are removed unless statutory retention obligations apply; invoicing data is subject to commercial and tax retention periods of up to ten years. Server logs are retained by our hosting provider according to its own policy.

We use no cookies for analytics or advertising and embed no tracking services. Signing in requires technically necessary cookies set by the authentication provider. Your choice between the light and dark appearance is stored locally in your browser and is not transmitted to us.

Subject to the statutory conditions, you have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)

A message to support@lippi.dev is enough to exercise them. Any consent you have given can be withdrawn at any time with effect for the future.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for the controller is the Hamburg Commissioner for Data Protection and Freedom of Information.

We update this policy when the processing described here or the providers used change. The version published on this page is the one that applies.