1. Who is responsible
Operator: Yalinkilic LLC
Location: United States
Privacy contact: berkayyalinkilic@outlook.com
For Etsy shop data processed to provide the service requested by a connected seller, the operator acts as a service provider to that seller under Etsy's API Terms. The seller remains responsible for its shop, products and listing content.
2. Information processed
Information received through Etsy OAuth and the Open API
- Etsy user and shop identifiers, shop name and connection status;
- listing identifiers, status, title, description, tags, materials and other supported listing fields;
- listing images selected or associated with a seller's listing;
- price, quantity, SKU and basic inventory information;
- relevant shipping and processing profile information; and
- OAuth access and refresh tokens used for authorized API requests.
The application does not receive the seller's Etsy password through OAuth and does not ask sellers for an Etsy developer API key or shared secret.
Information provided directly
Account name, email address, one-way password hash, product and listing information, image files, Product Creator artwork, the selected encrypted OpenRouter or fal.ai API key, model and product selections, Terms acceptance records and support communications that a user chooses to submit. If wallet funding is used, AutoMenax also stores the amount, currency, status, internal ledger entries, Stripe checkout/payment/refund/dispute identifiers, and bank-transfer request, payment-reference and reconciliation records. Plain-text account passwords and full payment-card details are not stored, and the full image-provider key is not returned to the browser after it is saved.
Technical and security information
IP address, request time, browser or device information, authentication events, error information and limited security logs needed to operate and protect the application. Secrets and full private listing payloads will be excluded from routine logs.
3. Why information is used
- Connect the shop authorized by the seller;
- display the seller's own shop and listing information;
- create new drafts, upload selected images and apply draft inventory after the seller explicitly confirms;
- manage seller-provided images and basic inventory for a draft;
- retrieve shop configuration required for listing forms;
- send user-selected Product Creator artwork, product context and prompts to the selected OpenRouter or fal.ai workflow for the requested model-generated draft;
- create and reconcile closed-loop wallet top-ups, apply verified credits or reversals, prevent duplicate payment effects and resolve payment disputes;
- secure and troubleshoot the application; and
- answer support and privacy requests.
Etsy member data will not be sold, used for advertising, unrelated profiling, browser scraping, content licensing or unrelated data-product development.
4. OAuth permissions
V1 requests listings_r, listings_w and shops_r. It does not request listings_d or shops_w. A purpose or permission change will require updated disclosure, any required Etsy approval and new user authorization.
5. Sharing
Information is shared with Etsy to perform the seller-confirmed operation. Railway provides the live application hosting and storage environment. Cloudflare may provide secondary web delivery and storage, Google provides the monitored support email service, and the selected OpenRouter or fal.ai workflow receives Product Creator prompts, model context and artwork only when the user requests generation. Stripe receives payment and checkout information when the user chooses Stripe funding; Stripe, not AutoMenax or EtsyOkulu, collects the full card details. EtsyOkulu sends a short-lived authenticated subject credential and requested narrow scope after validating local access, and AutoMenax independently verifies both identity and the active supplier entitlement before issuing its own five-minute token. AutoMenax then stores an owner-scoped identity mapping; EtsyOkulu does not receive the saved image-provider secret. These providers process information under their applicable service terms. Etsy member data is not disclosed to advertising networks, data brokers or unrelated applications.
6. Storage, freshness and retention
| Information | Publication rule |
|---|---|
| OAuth tokens | Until disconnect, revocation, account deletion or expiry; then deleted from active storage. |
| Displayed Etsy listing content | Fetched live in V1. If caching is introduced, it will be refreshed or discarded within six hours when displayed. |
| Other displayed Etsy content | Fetched live in V1. If caching is introduced, it will be refreshed or discarded within 24 hours when displayed. |
| Application drafts, profiles and image files | Until the seller deletes them or requests deletion of the application workspace. |
| Image-provider credential | The selected OpenRouter or fal.ai key is stored encrypted until the user removes or replaces it, or deletes the application workspace. The full secret is not included in routine logs or browser responses. |
| Product Creator artwork and generated drafts | Kept in owner-scoped storage until the user deletes the workspace or the configured product-data retention process removes them. Provider handling is governed separately by the selected provider and model terms. |
| Wallet, Stripe and bank-transfer records | Top-up, ledger, refund, dispute and reconciliation records are retained while the account is active and afterwards only as reasonably required for accounting, fraud prevention, dispute handling and applicable legal obligations. Full card details are held by Stripe, not AutoMenax. |
| Federated EtsyOkulu account mapping | The verified provider subject, observed email and last-verification time are retained while the AutoMenax account is active. Five-minute delegated token records store only a one-way token hash and expire automatically. |
| Member account and sessions | Account records are kept while the account is active. Sign-in sessions expire after seven days or are deleted at sign-out or account deletion. |
| Terms acceptance record | Kept while the account is active and as reasonably needed to demonstrate the accepted terms. |
| Support communications | Normally up to 12 months after the last message, unless a longer period is needed for security, legal or dispute handling. |
7. Security
The application uses encrypted transport, one-way password hashing with a unique salt, HttpOnly session cookies, server-side secret management, AES-GCM encrypted OAuth-token and image-provider-key storage, owner-scoped database queries, access controls and restricted logs. OAuth tokens, Etsy passwords and full API credentials are not exposed through browser responses.
If Etsy member data is compromised or suspected to be compromised, the operator will notify Etsy and the affected seller without undue delay and no later than 24 hours after discovery, as required by Etsy's API Terms.
8. Seller controls
A seller can decline authorization, disconnect in the application, revoke through Etsy's connected-app controls, remove or replace their image-provider credential, delete local drafts and images, and request access, export, correction or deletion by emailing the privacy contact. First-party users also have in-application account deletion. Federated EtsyOkulu users must use the privacy contact until a re-authenticated federated self-service deletion flow is available. Disconnecting deletes stored OAuth tokens and stops future Etsy API requests; it does not delete listings already submitted to Etsy. Some payment records may be retained where accounting, fraud, dispute or legal obligations require it.
9. International processing and legal details
The operator is located in the United States. Railway, Cloudflare, Google, OpenRouter, fal.ai and the selected model provider may process information through infrastructure in other countries. Where applicable, those providers use their contractual and legal safeguards for international transfers. Users should not submit artwork or personal data unless they are authorized to have it processed by the selected provider. Users may request access, correction, deletion, restriction or objection where applicable under the law governing their information.
10. Changes and contact
Material changes to data use or the application's Etsy API purpose will be disclosed and handled under Etsy's current approval and authorization requirements. Questions or requests can be sent to berkayyalinkilic@outlook.com.