← Back to Home

Privacy Policy — Zetlis

Effective Date: May 31, 2026  |  Last Updated: October 9, 2026

1. Introduction

Zetlis (“we”, “us”, “our”) operates zetlis.com and provides an AI-powered eBay listing automation service. This policy explains how we collect, use, and protect your information.

2. Information We Collect

  • Account: email and encrypted password via Supabase Auth.
  • Product Photos: stored so your saved listings stay complete in Listing History, and processed by Anthropic Claude AI only to generate listing content. Photos are kept for as long as you keep the listing — we do not delete them on a schedule. You can remove them at any time by deleting the listing, or your account.
  • eBay Access Tokens: short-lived tokens used to talk to eBay while you are using Zetlis. They are held as HttpOnly cookies in your browser and kept in memory on our servers only for the moment a request needs them. We never store them in our database.
  • eBay Authorization Credential: while your eBay account is connected, we keep one long-lived eBay authorization credential (your OAuth refresh token) on our servers, encrypted, so we can carry out eBay operations you have authorized — including keeping your listings in sync with eBay in the background, without you having to be signed in. It is encrypted with AES-256-GCM before it is saved, and the encryption key is held outside the database, so the stored value is not readable from the database alone. No security measure is absolute, but this credential only ever permits the eBay permissions you granted at connection, and you can revoke it at any time from eBay or by disconnecting in Zetlis. Disconnecting your eBay account, or deleting your Zetlis account, deletes it. If eBay tells us your eBay account was deleted, we delete it then too.
  • eBay Account Data: when you connect your eBay account, we store a one-way (SHA-256) hash of your eBay user ID and your eBay username in our database. If eBay notifies us that you deleted your eBay account, we erase your eBay username per the eBay Marketplace Account Deletion program; the anonymized hash is retained to maintain the integrity of the service.
  • Promoted Listings: if you turn on eBay Promoted Listings for a listing, we store the eBay campaign ID, the eBay listing ID, the ad rate you chose, and the promotion's status, so we can create and manage the ad on your behalf and show you its current status. This is optional and off by default — nothing is stored unless you turn it on. The first time you do, eBay asks for one additional, one-time authorization for advertising. Advertising fees are charged by eBay, not Zetlis. eBay charges advertising fees on qualifying sales. Zetlis does not charge or collect these fees.
  • Sales Records (Sold tab): while your eBay account is connected, we periodically read your eBay orders through eBay's Fulfillment API so that the Sold tab can show which of your listings have sold. For each order line item we store the eBay order and line-item identifiers, the marketplace, the SKU, the item ID and variation, the listing title as eBay reported it at the time of sale, the quantity, the price and currency, the order's fulfillment, payment and cancellation status, the sale date and last-modified date, the date Zetlis first saw the sale, and which Zetlis listing the sale was matched to, if any. This applies to all orders on the connected eBay account, starting from up to 90 days before your first synchronization, and includes sales of listings that were not created with Zetlis: those are stored with the same fields, appear in the Sold tab only as a count, and are re-checked on later synchronizations in case they match a Zetlis listing. We do not store any buyer information — no name, username, email, address, phone number or payment details — and we do not store the raw order data that eBay returns.
  • Seller Profile: the settings you enter in a Seller Profile (store and brand name, niche, writing tone, keywords, description footer, eBay marketplace, ships-from country and postal code, default size list and package details) are saved to your account on our servers so they follow you across devices. They are deleted with your account. Your browser also keeps a local copy so the app can show them immediately; clearing your browser's site data removes that copy.
  • Usage Logs: IP address, browser type, timestamps via Vercel — retained ~30 days.
  • Payments: processed by Paddle, our payment provider. Your card details are handled by Paddle and are never stored on our servers.

3. How We Use Your Information

To operate the service, process photos with AI, publish to eBay on your behalf, manage Promoted Listings campaigns you choose to run, show you your own eBay sales in the Sold tab, authenticate you, send service updates, and comply with legal obligations.

4. AI Processing

Photos are sent to Anthropic's API solely to generate listing content. We do not use your data to train AI models. We keep our copy of your photos only so your saved listings stay complete — see Data Retention below.

5. Zetlis Photo Collector (Browser Extension)

This section describes the Zetlis Photo Collector browser extension only. It is separate from how the zetlis.com website and the signed-in Zetlis app behave, which the rest of this policy covers. Photo Collector does not require a Zetlis account, and you can use it without having one.

The extension sends nothing to Zetlis

Photo Collector does not send the images you collect, the pages you visit, your browsing history, or any usage or analytics data to Zetlis or to any other service. It contains no analytics, no tracking, and no remote code. The images you select are saved by your own browser directly to your device.

What is stored, and where

The extension stores a small amount of data locally in your browser, using Chrome's extension storage: the product names and image addresses you have collected but not yet downloaded, your output preference (Original or JPG) and image-quality setting, and a record that you accepted the first-use notice. This never leaves your device. Removing the extension, or clearing your browser's extension data, deletes it.

Access to web pages

The extension has no standing access to any website. It reads a page only when you click its toolbar icon on that page, and only that tab — this is Chrome's “activeTab” model. It requests no host permissions and does not run in the background on the sites you browse. Its permissions are limited to acting on the tab you invoked it on, saving files you have chosen to download, and storing the local settings described above.

Network requests

When you download or convert an image, your browser fetches that image from the website hosting it, exactly as it would if you saved the picture yourself. Those requests go to that website, never to Zetlis. Visiting zetlis.com from a link in the extension is a normal visit to our website and is covered by the rest of this policy.

6. Third-Party Services

  • Supabase — authentication and storage
  • Vercel — hosting
  • Anthropic — AI processing
  • eBay — listing API
  • Paddle — payment processing
  • Google — website analytics (Google Analytics)

7. Data Sharing

We do not sell your data. We share only with the service providers above, strictly to operate the service.

8. Data Retention

  • Account data and Seller Profiles: retained while your account exists; deleted with your account.
  • Product photos: retained for as long as you keep the listing they belong to, on every plan including Free. They are not deleted on a schedule. Deleting a listing, or your account, removes them; photos from uploads never saved to a listing are cleared automatically once they are no longer referenced.
  • eBay access tokens: temporary. Held in your browser and, briefly, in memory on our servers while a request runs. Never stored in our database.
  • eBay authorization credential: stored encrypted only while your eBay account is connected. Deleted when you disconnect eBay, when you delete your Zetlis account, or when eBay notifies us your eBay account was deleted.
  • eBay account data: hashed user ID and username retained while your eBay connection exists; username erased on eBay account deletion notification.
  • Promoted Listings data: retained for as long as your Zetlis account exists. Deleting a listing, or disconnecting your eBay account, does not stop an ad already running on eBay — manage or stop it directly in eBay Seller Hub. Deleting your Zetlis account deletes this data.
  • Sales records: retained for as long as your Zetlis account exists, so your sales history stays complete even after you delete the matching listing from History or disconnect your eBay account (disconnecting stops further synchronization but does not remove records already stored). Deleting your Zetlis account deletes them.
  • Buyer data: we do not store any information about your buyers.
  • Logs: ~30 days via Vercel.

9. Your Rights

EU / GDPR

Access, correct, delete, restrict, or export your data. Withdraw consent. File a complaint with your local data protection authority.

US / CCPA

Know what we collect, delete your data, and opt out of data sale (we do not sell data).

To exercise any right, contact [email protected].

10. Cookies

We set the following cookies ourselves:

  • eBay connection (HttpOnly, only while your eBay account is connected): ebay_token (your current eBay access token; expires when the token does, normally within 2 hours), ebay_refresh, ebay_username and ebay_uid (up to 540 days), and ebay_oauth_state (a one-time security value used only during the connection step; 10 minutes). They are required to act on eBay for you and are cleared when you disconnect eBay or delete your account.
  • zx_lang — the interface language you chose, so it is kept on your next visit. Set only when you pick a language; 30 days.
  • zx_cc — the two-letter country code our hosting provider derives from your IP address, used to show plan prices in the currency for your country. Nothing else is stored in it; 30 days.
  • zx_ref — the referral code from a link you arrived through, so the referral can be credited when you sign up. 30 days; removed as soon as it has been applied.
  • zetlis_auth_hint — a 1/0 flag recording whether you were signed in on your last visit, so a returning user is shown the app rather than a flash of the homepage. It grants no access and contains no credentials; 30 days, removed when you sign out.

zetlis.com also uses Google Analytics to measure how the site is used. Google sets its own cookies for this (names beginning with _ga); how Google handles that data is described in Google's privacy policy. We do not use advertising cookies.

11. Security

We use HTTPS, HttpOnly cookies, Supabase Row Level Security (RLS) to keep each account's data separate, and automatic clean-up of uploaded files that are no longer attached to any of your listings. Your stored eBay authorization credential is encrypted with AES-256-GCM before it is written, and its encryption key is kept outside the database in our hosting provider's environment configuration. No system can be guaranteed completely secure, but this means database access on its own does not reveal the credential.

12. International Transfers

Service is operated from the United States. EU data may be transferred to the US under standard contractual clauses with our service providers.

13. Children

Service is not directed to users under 16. Contact [email protected] if concerned.

14. Changes

We may update this policy from time to time. Continued use of the Service constitutes acceptance of the updated policy.

15. Contact