Privacy Policy — MyShopRender

Who we are

MyShopRender Ltd is a company registered in England and Wales (Company No. 17225592). We provide AI-powered listing automation tools for independent sellers on Etsy, eBay, Depop, Vinted, and Shopify.

We are the data controller for the personal data described in this policy, and we are registered with the UK Information Commissioner’s Office under registration reference ZC234505.

For any privacy-related enquiries, please contact us at: [email protected]

What information we collect

We collect the minimum information necessary to provide the service:

Email address: Collected when you sign in. Used to authenticate your account and send transactional emails (magic links, billing receipts, and account notices such as an inactivity warning).
Subscription and billing data: Your plan status and monthly usage count are stored in our database. Payment details (card numbers, billing address) are handled entirely by Stripe and are never stored on our servers.
Product photos: When you use the browser extension to generate a listing, the photos you submit are sent to our server and passed to Anthropic's Claude API to generate listing copy. We process them in memory and do not store them on our own systems. Anthropic holds them briefly as our service provider; see “Third-party services” below for how long.
Approximate location (country only): When you generate a listing, our network provider (Cloudflare) derives a two-letter country code from your IP address. We use it only to localise the generated listing for your market: currency, spelling, and marketplace wording. You can override it at any time with the Market setting in the extension. The country code is used for that single request and is not stored against your account.
Generated listing copy: The titles, descriptions, and tags we generate for you are stored against your account. We use them only to learn your writing style, so that later listings sound consistent with your earlier ones. We keep the ten most recent per marketplace and delete anything older than 24 months. This content is never pooled with other users’ content and is never used to train any third-party AI model.
IP address (free-trial abuse prevention): When a free trial is claimed, the claiming IP address is recorded so the free allowance cannot be claimed repeatedly. These records are kept separately, are not linked to your account profile, and are automatically deleted after 90 days.
Account activity dates: The date you last used your account (signing in, opening the extension panel while signed in, or generating a listing), and the date of any inactivity warning we sent you. Used only to apply the inactivity rule described under “How long we keep your data”.
Scrambled email of deleted free accounts: When a free account is deleted for inactivity, we keep a one-way scrambled form (a keyed hash) of its email address for 12 months, then erase it. It cannot be turned back into your address, but because we could check whether a given address matches it, we treat it as personal data. Our legal basis is our legitimate interest in preventing repeated use of the free trial. You can object to this at any time (see “Your rights”).

We do not collect your name, physical address, phone number, or any marketplace credentials.

Why we collect it

Each piece of data has a specific purpose:

Email address: Used to identify your account and deliver authentication links. We do not use it for marketing without your consent.
Subscription data: Used to enforce plan limits and display your account status on the dashboard.
Product photos: Used solely to generate AI listing copy via Anthropic's Claude API. They are never used for any other purpose, analysed by us manually, or shared beyond what is necessary to deliver the service.
Approximate location (country only): Used to write your listings in the right currency and dialect for your market. Nothing more.
IP address (free-trial claims): Used to prevent repeated claims of the free trial allowance. Deleted automatically after 90 days.
Account activity dates: Used to delete free accounts that are no longer used, so we do not keep personal data longer than needed, and to warn you 30 days before that happens.
Scrambled email of deleted free accounts: Used only to stop the same email address claiming the free trial again within 12 months. Nothing more.

Our legal basis for using your data

UK GDPR requires a legal basis for each way we use personal data. Ours are:

Providing the service you signed up for (contract): Your email address and sign-in, your subscription and usage, the product photos you submit, the country code, your generated listing copy, and the emails we send about your account.
Our legitimate interests: Preventing repeat claims of the free trial (IP address records and the scrambled email of deleted free accounts); deleting free accounts that are no longer used (account activity dates); keeping the service working, secure and recoverable (error reports and encrypted backups); understanding how our website is used (website analytics); and answering messages you send us. You can object to any of these (see “Your rights under UK GDPR”).
Legal obligation: Keeping financial records where the law requires it, and acting on requests you make under data protection law.

How we store and protect your data

Your account data (email address, subscription status, usage counts) is stored in a PostgreSQL database hosted on Railway, a cloud infrastructure provider based in the United States. Railway maintains industry-standard security practices including encryption at rest and in transit.

All data transmitted between your browser, the browser extension, and our servers is encrypted using TLS. We do not store payment card details — these are handled exclusively by Stripe.

Product photos are held in server memory only for the duration of a single API request and are not written to disk or any persistent storage.

Third-party services

We use the following third-party services to operate MyShopRender. Each has its own privacy policy and data processing terms:

Anthropic (Claude API): Your product photos and the listing copy request are sent to Anthropic's API to generate listing content. Anthropic's commercial terms state that it does not train models on customer content. Anthropic deletes API inputs and outputs within 30 days of receipt, except where a request is flagged under its usage policies, in which case it may retain them for up to two years. See anthropic.com/privacy.
Stripe: Handles all payment processing and subscription billing. Stripe stores your payment card details and billing information under their own privacy policy. See stripe.com/gb/privacy.
Railway: Hosts our server and database infrastructure. Your account data resides on Railway's cloud platform. See railway.app/legal/privacy.
Resend: Delivers transactional emails such as your login link. Your email address is passed to Resend for this purpose only. See resend.com/privacy.
Cloudflare: Provides our content delivery network and security layer. Traffic to myshoprender.com passes through Cloudflare, which derives the country code we use to localise your listings. See cloudflare.com/privacypolicy.
Google (Google Analytics): Measures page views on our website pages, in a cookieless mode, as our processor. It never receives your email address, photos or listings. See “Website analytics” below and policies.google.com/privacy.

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.

Where your data is processed

Our infrastructure and AI providers are based in the United States, so your personal data is transferred outside the United Kingdom. We rely on the following safeguards:

Transfers of UK personal data: Made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, entered into with each provider.
Transfers of EEA or Swiss personal data: Made under the EU-US or Swiss-US Data Privacy Framework where the recipient is certified, and otherwise under the EU Standard Contractual Clauses.

We have a signed data processing agreement in place with Railway, which hosts our database, and we rely on the published data processing terms of Anthropic, Stripe, Resend, Cloudflare, and Google.

How long we keep your data

Account data: Retained for as long as your account is active. Free accounts that have not been used for 90 days are deleted automatically: we email you 30 days beforehand, and signing in keeps the account. When that happens we keep only a one-way scrambled form of your email address for 12 months, so the free trial cannot be claimed twice. It cannot be turned back into your address, but we still treat it as personal data (see “Scrambled email of deleted free accounts” above). Accounts that have ever had a paid subscription are never deleted for inactivity. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law (for example, financial records required for HMRC compliance).
Product photos: Not retained by us. Processed in memory and discarded once the listing response is returned. Anthropic deletes them within 30 days, or retains them for up to two years where a request is flagged under its usage policies.
Generated listing copy: Retained for up to 24 months, and only the ten most recent per marketplace. Deleted automatically thereafter, and erased immediately if you delete your account. You may ask us to delete your listing history at any time.
Billing records: Stripe retains transaction records in accordance with their own retention policies and applicable financial regulations.
Backups: Our database is backed up daily in encrypted form, and each backup is kept for 14 days. Data we delete therefore disappears from our backups within 14 days.

Your rights under UK GDPR

As a UK resident, you have the following rights regarding your personal data:

Right of accessYou may request a copy of the personal data we hold about you at any time.
Right to rectificationYou may ask us to correct any inaccurate or incomplete data.
Right to erasureYou may request that we delete your account and associated personal data.
Right to restrict processingYou may ask us to limit how we use your data in certain circumstances.
Right to data portabilityYou may request a machine-readable copy of the data you have provided to us.
Right to objectYou may object to our processing of your data where we rely on legitimate interests as our legal basis.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113. If you are located in the European Economic Area or Switzerland, you may instead complain to your local data protection authority.

Cookies

MyShopRender uses a single session cookie (msr_session) to keep you logged in. This cookie is strictly necessary for the service to function and does not track you across other websites. It is set as httpOnly and sameSite=lax, meaning it is not accessible to JavaScript and is not sent on cross-site requests.

We do not use any advertising, analytics, or tracking cookies.

Website analytics

We use Google Analytics on our public website pages to understand how many people visit and which pages they use. It is deliberately configured in a cookieless mode, so it stores nothing on your device and cannot be used to recognise you when you return or to follow you across other websites. This is why no cookie banner is shown.

The information collected is limited to aggregate measurements such as page views, approximate country, referring website and browser type. Google acts as our processor for this data. We do not use it to build a profile of you, and we do not combine it with your account information.

If you would rather not be counted at all, you can install Google's opt-out browser add-on, or use any standard content blocker — both prevent the analytics script from loading, with no effect on your ability to use MyShopRender.

Analytics runs on our website pages, including the signed-in dashboard, but only ever measures page views. It has no access to your listings, your photos, your marketplace accounts or anything the extension does, and your email address is never sent to it.

Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email at least 14 days before the updated policy takes effect. Your continued use of the service after that date constitutes acceptance of the revised policy.