1. General information
Protecting your personal data is important to us. We process personal data confidentially and in accordance with applicable data protection laws and this privacy policy.
Controller:
Andy Shek
c/o Impressumservice Dein-Impressum
Stettiner Str. 41, 35410 Hungen
E-Mail: [email protected]
2. Hosting & infrastructure
Vercel Inc.
We host our application with Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. To provide the website, connection data (e.g. IP address and browser information) is processed. This is based on our legitimate interest in secure and efficient service delivery (Art. 6(1)(f) GDPR).
3. Data storage & backend
Supabase
We use Supabase as backend and database provider. Project-related data is primarily stored on servers in Frankfurt (EU). A data processing agreement is in place with the provider.
4. Authentication
Clerk
We use Clerk for sign-in and account management. During registration/login, required data (e.g. email address, password hashes, login timestamps) is processed. Legal basis is Art. 6(1)(b) GDPR (contract performance).
5. AI processing & analysis
OpenAI API
We use the OpenAI API for product image analysis and listing text generation.
- No training: Submitted data (images, texts) is not used for OpenAI model training (according to API privacy policies).
- Purpose: Exclusively to provide requested analysis functions (Art. 6(1)(b) GDPR).
These statements apply to the OpenAI API used by CrowFlip. Your own ChatGPT conversations and the ChatGPT connection described below are subject to the privacy rules and settings of your ChatGPT account.
6. Payment processing
Lemon Squeezy
Orders and payments are processed by our Merchant of Record, Lemon Squeezy. Payment data is processed directly by that provider; we do not store full credit card details on our servers.
7. Your rights
You have the right to access, rectification, restriction, and deletion of your personal data within the scope of applicable law.
You can request deletion of your account on the account page under “Delete account”, or contact us by email at [email protected].
8. Google user data (Google API Services)
If you choose "Sign in with Google", CrowFlip receives access to certain Google user data. To comply with the Google API Services User Data Policy, we disclose:
- Data accessed: Primary email address, name, and profile image.
- Data usage: Account creation, secure authentication, and system-relevant notifications.
- Storage & sharing: Secure storage via Clerk. No sale of data and no sharing for advertising purposes.
- Limited Use compliance: Usage follows the Google API Services User Data Policy including Limited Use requirements. Google API Services User Data Policy
9. Cookies, consent and optional services
Essential storage supports features such as sign-in and remembering your cookie preferences. Your choice is saved locally in this browser until you change it or clear website data. Usage analytics and affiliate attribution can be allowed or declined separately. Optional services do not start without consent. You can change your choice and withdraw consent for the future using Cookie settings in the footer. Withdrawal does not affect processing lawfully carried out beforehand.
Optional storage access and associated processing rely on your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. Strictly necessary storage access follows Section 25(2) TDDDG. Declining optional services does not affect sign-in, payment processing or necessary operational and security logs.
Usage analytics
No optional usage analytics service is currently enabled for this website. Analytics events are therefore not sent to Google Analytics or PostHog.
Affiliate attribution by Lemon Squeezy
Only with your separate consent do we load Lemon Squeezy affiliate attribution. For a referred visit, it processes the partner or click identifier, visited URL, referring page, and browser and device characteristics used to create a visitor identifier. It may set the ls_aff_ref cookie with an expiry determined by the provider and add attribution to checkout links. This supports partner commissions and is not required to make a purchase.
Withdrawal removes the accessible affiliate cookie. If the feature was already loaded, open CrowFlip pages reload; settings warn you to save unsaved input beforehand. Further information: Lemon Squeezy Privacy Policy.
These providers may also process data outside the EU or EEA. Their linked privacy notices describe recipients, retention and safeguards. Contact [email protected] with questions about the services used by CrowFlip.
10. Optional connection with ChatGPT
If you connect your CrowFlip account to ChatGPT, authorized tools can retrieve selected account information for your requests. The first version of this connection supports read access and market research only. It does not create paid AI jobs, change drafts or publish listings. You do not need this connection to use the CrowFlip website.
Data processed and purposes
- To verify your authorization, CrowFlip processes the account identifier verified by Clerk, OAuth permissions and access-token validity. Sign-in takes place through Clerk; ChatGPT tools do not request passwords or vault keys.
- Depending on the tool invoked, data retrieved includes your available or reserved credits; draft identifiers with title previews, price estimates, status and timestamps; and job identifiers with processing status, technical error codes and timestamps. Access is limited to the connected account and the permissions granted.
- For price research, CrowFlip processes the search term and, where supplied, a product identifier (GTIN). Research sends the search term or GTIN to eBay and returns price ranges and the titles, listing links, prices and conditions of comparable active listings. These results do not establish completed sales.
CrowFlip receives the inputs needed for a tool call, such as a search term or job identifier. ChatGPT may also send standard technical connection data and a summary of your current context and intent. These tools do not give CrowFlip access to your full ChatGPT conversation history. The connection does not send stored product photos, complete encrypted listing content, full descriptions, vault keys or payment data to ChatGPT. Title previews and prices are explicitly among the data available through the connection. A link opens the CrowFlip website to edit complete drafts.
Recipients
Retrieved results are sent to ChatGPT/OpenAI and can become part of your conversation. Clerk processes sign-in and OAuth authorization. Hosting and database providers described above support delivery and data retrieval. eBay processes market research; if an existing connected eBay account is used for this purpose, the request uses that account's authorization. For abuse prevention, Upstash Redis receives your CrowFlip account identifier, the time window and request counters, but no search terms, draft text or photos from this connection.
These providers may also process data outside the EU or EEA. Further information about their processing and safeguards: OpenAI Privacy Policy, Clerk Privacy Policy, eBay Privacy Notice, Upstash Privacy Policy.
Retention and controls
CrowFlip does not create an additional conversation or research history through this connection. Inputs, access tokens and results are processed for each call; responses are not cached for later retrieval. Redis counter windows used for rate limiting expire automatically 121 seconds after creation. Necessary technical connection and operational data can still be processed by the infrastructure and authentication providers named above; their privacy notices describe their respective storage practices.
Underlying CrowFlip data exists independently of the ChatGPT connection: drafts remain stored until deleted in the dashboard or until account deletion. Job status records remain until account deletion; deleting a draft does not automatically remove its associated job status. Account deletion through the account page removes these records from the application database and initiates deletion of your stored files and Clerk identity. You can also contact [email protected] for access or deletion requests.
You can manage and disconnect the connection under Plugins in ChatGPT settings. Disconnecting does not delete your CrowFlip drafts or data already sent to ChatGPT conversations. CrowFlip verifies access-token validity; disconnection does not guarantee that already issued tokens become invalid immediately before expiry. Manage and delete content already sent to ChatGPT separately within ChatGPT.
The statement about no model training through the OpenAI API in section 5 does not automatically apply to ChatGPT conversations. Their retention and possible use for model improvement depend on your ChatGPT account, data controls and, where applicable, workspace rules. Information about model training, export and deletion is available in ChatGPT data controls.