Privacy Policy

Last updated: 12 September 2026

This policy explains what information Listawok handles, why we handle it, who we disclose it to, how long we keep it, how it is protected, and the choices and rights available to you.

1. Who we are and what this policy covers

Listawok ("Listawok", "we", "us", "our") provides a software-as-a-service listing management and optimization platform for online sellers. This policy applies to the Listawok website, the Listawok web application and the related services we operate (together, the "Service").

This policy does not apply to any third-party platform you connect to the Service, or to any website or service we link to. Those platforms operate under their own terms and privacy policies, and we do not control their practices.

Where you use the Service on behalf of an organization, that organization is responsible for the accounts and shops it authorizes and for informing the people it invites about this policy.

2. Information we handle

2.1 Account information

To create and operate an account we handle your email address, an authentication credential stored only as a one-way bcrypt hash, a display name where you provide one, the plan assigned to your account, and, for shops with more than one member, your role and team membership.

2.2 Connected shop information

When you connect a selling platform such as Etsy, you authorize the Service through that platform's own OAuth 2.0 flow. We never request, receive or store your password for a connected platform. We request only the permissions required by the features you use:

• Shop and listing information (shops_r, listings_r): shop name and profile details, listing titles, descriptions, tags, prices, images, inventory levels, category attributes and listing state.
• Listing write access (listings_w): used solely to apply changes you have reviewed and approved within the Service. We do not independently publish, edit, delete or relist items on your behalf.
• Transaction information (transactions_r): order receipts, line items, fee entries and payment-ledger records, used to produce the sales, revenue, fee and profit analytics shown to you for your own shop.

2.3 Information relating to your buyers

Order records returned by a connected platform may include a buyer's platform-assigned numeric identifier, order totals and the items purchased. We handle this information solely to produce analytics for the shop that received the order.

We do not request, retrieve or store buyer names, email addresses, postal or shipping addresses, or buyer payment details. We do not contact buyers, and we do not sell, rent, license or use buyer-related information for advertising or for any purpose unrelated to your own shop analytics. Buyer-related records are deleted together with the other information imported from that shop, as described in section 8.

2.4 Payment information

Paid plans and credit purchases are processed by Stripe, our payment processor. Payment details are collected and processed by Stripe on its own hosted checkout pages. Card numbers, security codes and full payment instruments are never transmitted to, processed by, or stored on our systems.

We retain only what is needed to operate your subscription and entitlements: a payment-processor customer identifier, a subscription identifier, the plan and its status, renewal dates, and a record of credit grants and charges. Stripe handles payment information under its own Privacy Policy.

2.5 Content you create in the Service

We handle the drafts, templates, notes, saved research, product ideas, shop profile answers and revision history you create or store in the Service, together with a record of changes made to your listings so that you can review and restore earlier versions.

2.6 Technical and usage information

Operating the Service requires a limited amount of technical information:

• Session records: a one-way hash of your session token, the browser user-agent string presented at sign-in, and the creation, last-used and expiry times of the session, so that sessions can be shown and revoked.
• Network information: your network address is processed transiently by our servers and infrastructure providers to route requests, apply rate limits and protect against abuse.
• Product usage events: a first-party record of which areas of the application are used, consisting of an event name, the application path, the account and shop concerned, and a small set of predefined values. These records do not contain listing text, search terms or other free text you type.
• Diagnostic logs: operational logs used to detect, investigate and resolve errors.

Visit records: to understand how the website is used, we record which pages are opened, in what order, for how long, the website that linked to us, campaign tags on the link, the device class and screen width, and the browser's language setting. A random identifier stored in a cookie ties the pages of one visit together and, if you create an account, ties that visit to the account; it contains nothing about you or your device. Your IP address is not stored with these records, no advertising identifier is used, and nothing you type is recorded. Raw visit records are kept for 90 days; only daily totals are kept longer.

The Service does not use third-party advertising networks, cross-site tracking technologies or third-party analytics scripts. All usage measurement is performed by our own software on our own servers.

2.7 Additional connected platforms

The Service may offer optional integrations with further platforms, including Pinterest. Where you choose to enable such an integration, the following applies to it.

• The connection is established through that platform's own OAuth flow, requesting only the permissions required for the features offered. We do not request platform passwords or session cookies.
• Account, board and content information is accessed to identify the connection, display supported content and carry out the actions you select. Ordinary platform API responses are retrieved when a feature needs them rather than accumulated in our database.
• Each publishing action must be selected and approved by you. Establishing a connection is not authorization for any further action.
• Where you approve a publishing action, only the content required for that action is transmitted, such as the product image, title, description and destination link you selected. Order records, buyer identifiers, payment-ledger information and private analytics are not included.
• Content you publish to a third-party platform may become publicly visible under that platform's rules and the settings of the destination you chose, and may be saved or redistributed by other users of that platform. Review images, text and links before approving publication.
• We do not sell or share information obtained from these platforms with third parties, use it for off-platform advertising, or use it to train artificial-intelligence models.

Connecting one platform never automatically connects another, and never automatically publishes content.

3. Why we handle this information

We handle the information described above for the following purposes, and not for unrelated purposes without providing notice and obtaining any permission required by law:

• to create, authenticate and secure your account, and to operate team access;
• to provide the features you request, including listing audits, optimization suggestions, research and analytics for your own shop;
• to apply to a connected platform the changes you have approved;
• to process payments, manage subscriptions and credits, and prevent billing abuse;
• to send service communications such as confirmations, security notices, billing notices and any product summaries you have not opted out of;
• to maintain, troubleshoot, secure and improve the Service, including detecting and preventing fraud, abuse and violations of our Terms;
• to produce aggregated and de-identified statistics that do not identify any individual, account or shop, which we may use to operate and improve the Service; and
• to comply with legal obligations and to establish, exercise or defend legal claims.

Where data-protection law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in securing and improving the Service and preventing abuse, compliance with legal obligations, and your consent where consent is required and has been given. Where we rely on consent you may withdraw it at any time, without affecting processing already carried out.

4. Artificial-intelligence features

Certain features produce suggested text using third-party model providers. When you request such a suggestion, the relevant content — typically the listing title, description and tags, and the shop profile details you have provided — is transmitted to the configured provider in order to return a response.

• Platform credentials, authentication tokens and buyer-related information are never transmitted to model providers.
• We configure our provider accounts, and rely on the applicable provider terms, with the intention that content submitted through our accounts is not used to train third-party models. Processing content in order to return a response is distinct from model training, and providers may retain content for limited periods for their own operational, security and abuse-prevention purposes under their respective terms.
• Generated output is a draft. It is produced by statistical models, may be inaccurate, incomplete or unsuitable, and is not reviewed by us before you see it. You are responsible for reviewing output before approving it. See our Terms of Service.

5. Disclosure of information

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under applicable law. We disclose information only as described below.

5.1 Service providers

We engage service providers to perform functions on our behalf. They may handle information only to provide those functions to us, under contractual confidentiality and security obligations.

5.2 Other disclosures

• At your direction: to a connected platform, when you approve an action.
• Within your shop: to other members of a shop you have joined or invited, according to their role.
• Legal and safety: where we reasonably believe disclosure is required by law, legal process or a governmental request, or is necessary to enforce our Terms, investigate a suspected violation, or protect the rights, property or safety of Listawok, our users or the public.
• Business transfers: in connection with a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honour this policy, and we will give notice where required by law.

6. International transfers

We and our service providers may process information in countries other than the one in which you are located, and data-protection laws in those countries may differ from those in your own. Where such a transfer is subject to legal transfer requirements, we rely on an appropriate transfer mechanism, such as standard contractual clauses or an equivalent safeguard recognised under applicable law.

7. Security

We maintain technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration and loss. These include:

• encryption of traffic in transit using HTTPS with TLS 1.2 or higher;
• encryption at rest of platform access tokens, API keys and integration secrets using authenticated symmetric encryption (Fernet, AES-128-CBC with HMAC), isolated per connected shop;
• storage of authentication credentials and session tokens as one-way hashes rather than in any recoverable form;
• server-side handling of application secrets, which are not embedded in code delivered to the browser and are excluded from diagnostic logs;
• access controls limiting internal access to what is required to operate and support the Service; and
• logical separation of connection credentials from content data.

No method of transmission over the internet and no method of electronic storage is completely secure. While we work to protect information, we cannot and do not guarantee absolute security, and you provide information at your own risk. You are responsible for keeping your account credentials confidential and for activity that occurs under your account. If we become aware of a security incident affecting your personal information, we will notify you and any regulator as and where required by applicable law.

8. Retention and deletion

We retain information for as long as your account is active and for as long as necessary to provide the Service, and after that only as needed to comply with our legal obligations, resolve disputes, prevent abuse and enforce our agreements.

8.1 Connected shop information

• Information imported from a connected platform is cached only as permitted by that platform's applicable API terms, refreshed when you synchronize and invalidated when you edit or disconnect.
• Disconnecting a shop immediately deletes the stored access tokens for that shop, after which the Service can no longer access it.
• At the point of disconnection you may choose to purge all imported listings, orders and analytics for that shop immediately.
• If you do not purge at disconnection, you may request deletion at any time and we will permanently delete the associated information within 30 days of a verified request.

Step-by-step instructions are on our Data Deletion page.

8.2 Additional connected platforms

Disconnecting an additional platform removes its stored connection credentials, stops further access and publishing through that connection, and cancels any pending publishing work. You may also revoke the authorization in that platform's own account settings. Content already published to a third-party platform is not removed by disconnecting the Service and must be managed on that platform.

8.3 Your account

You may request deletion of your account and its information by contacting us. We may take reasonable steps to verify that a request comes from the account holder; we will never ask you for a platform password or access token in order to do so. Where law requires us to retain particular records we will tell you what is retained and why. Aggregated and de-identified information that can no longer be associated with you may be retained.

9. Your rights and choices

Depending on where you live, you may have the right to request access to the personal information we hold about you, to request correction of inaccurate information, to request deletion, to request a portable copy, to object to or request restriction of certain processing, to withdraw consent where processing is based on consent, and not to be discriminated against for exercising these rights.

To exercise a right, email support@listawok.com. We aim to respond within 30 days, or within any shorter or longer period permitted by applicable law, and we will tell you if we need an extension and why. We may need to verify your identity before acting, and we may decline a request where an exception applies, in which case we will explain the reason.

You can also manage several choices directly: disconnect a platform at any time from the Connect page, turn off non-essential product email in your account settings, and revoke active sessions. Messages about your account, security and billing are not optional while your account remains open.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.

10. Cookies and browser storage

The Service does not use advertising or cross-site tracking cookies. One first-party cookie, lw_vid, holds the random visit identifier described in section 2 for up to one year; it is set by our own server, is readable by no other site, and identifies neither you nor your device. The application also stores a small amount of information in your browser's local storage on the device you use, consisting of your session token and interface preferences such as theme, layout and dismissed notices. That information stays on your device, is not used to track you across other websites, and is cleared when you sign out or clear your browser storage.

11. Children

The Service is a business tool intended for adults operating a commercial shop, and is not directed to children. We do not knowingly collect personal information from children under 13, or under the minimum age required in your jurisdiction. If you believe a child has provided us with personal information, contact us and we will investigate and delete it as appropriate.

12. Independence from connected platforms

Listawok is an independent service and is not a partner, affiliate or agent of any platform it integrates with. Integration through a public API does not imply endorsement, certification or partnership. Each platform operates under its own terms and privacy policy, which govern your relationship with that platform.

13. Changes to this policy

We may update this policy to reflect changes to the Service, our practices or legal requirements. We will revise the "Last updated" date above, and where changes are material we will give additional notice by email or in the application before they take effect. Before using personal information for a materially different purpose we will update this policy and obtain any permission required by law. Your continued use of the Service after an update takes effect constitutes acceptance of the updated policy, to the extent permitted by law.

14. Contact

Privacy questions, requests and complaints: support@listawok.com
Website: listawok.com

We aim to resolve any concern directly. If you are not satisfied with our response, you may contact your local data-protection authority.