Privacy Policy

Last updated: October 4, 2026

SellMate AI ("SellMate", "we", "us") is a browser extension and web service that helps online sellers create marketplace listings by analyzing a product photo with AI and auto-filling the listing form on supported marketplaces (Vinted, Etsy, eBay). This policy explains what data we process, why, and your rights. We sell listings tools — we do not sell your data.

1. Who we are (Data Controller)

SellMate AI is the controller of the personal data described here. Contact: privacy@sellmate.store. Our full legal entity and postal address are listed in our Imprint.

2. Data we collect

• Account data — email address and name, received from Google Sign-In when you create an account.
• Product photos — images you choose to upload for AI analysis. They are sent to our AI provider to generate listing text and are not retained by us after the analysis is returned.
• Listing & usage data — the listing fields generated for you, number of analyses, subscription tier, and credit balance, so we can provide the service and enforce quotas.
• Payment data — handled by Stripe. We never see or store your full card number; we store only a Stripe customer/subscription reference.
• Device & technical data — an anonymized device fingerprint, IP address, and browser/user-agent, used solely for abuse prevention and rate limiting (e.g. blocking mass free-account farming).

We do not collect your marketplace passwords. The extension fills listing forms on pages you are already logged into; it never reads or transmits your Vinted, Etsy, or eBay credentials.

3. How we use your data

• Generate listing content from your photos (our core feature).
• Authenticate you, manage your subscription, and enforce usage quotas.
• Process payments and prevent fraud/abuse.
• Provide support and send service-related emails (e.g. payment receipts, account notices).

Legal bases (GDPR Art. 6): performance of our contract with you (service, payments), our legitimate interest (security, abuse prevention), and your consent where required.

4. Third-party services we use

• Google — Sign-In (authentication).
• Stripe — payment processing and subscription billing.
• MiniMax — AI vision model that analyzes your uploaded product photo to generate listing text. Photos are processed to return a result and are not stored by us afterwards.
• Ably — real-time relay that delivers a photo from your phone to your desktop session.
• Vercel — application hosting.
• Supabase — managed PostgreSQL database hosted in Frankfurt, Germany (account, subscription, usage records).
• OpenRouter — routes requests to third-party AI models, used only in the browser extension to locate a form field on a listing page when the page layout has changed. For this the extension sends a description of the page's interactive elements — element types, labels, placeholder texts and the visible captions of buttons and options, which can include a category, size or tag you have selected or the account name the marketplace shows. The content of the title, description and price fields is never sent. No photos are sent to OpenRouter.
• APIYI — AI image-generation service that creates every AI image: it enhances the photo you submit for enhancement (e.g. white background, lifestyle or close-up scenes) and creates model try-on images from your product photo and a synthetic preset model.
• APIYI — also processes buyer try-on requests: your own full-body photo (stored only in your browser extension) and the listing photo are sent to APIYI (servers in China) solely to generate the try-on image and are deleted immediately after generation. We do not store your photo or the result.
• Upstash — Redis cache that briefly holds an uploaded photo while it is relayed to your session (deleted automatically after at most one hour), and stores rate-limit and usage counters.
• Cloudflare — Turnstile bot check when you register or request a sign-in link (your IP address and a challenge token).
• Brevo — delivery of account emails such as verification, sign-in links, receipts and service notices (your email address and the message content).

Each provider processes data only to perform its function for us. We do not sell or rent your personal data to anyone.

5. International data transfers

Some processing — notably AI photo analysis (MiniMax), AI image generation (APIYI), form-field location requests via OpenRouter, the Turnstile bot check (Cloudflare) and email delivery (Brevo) — may occur outside the EU/EEA. Where data is transferred internationally, we rely on appropriate safeguards (such as Standard Contractual Clauses) and minimize what is sent. If you prefer not to have a photo analyzed, simply do not upload it.

6. Browser extension permissions

The SellMate AI extension requests only the access it needs to fill listing forms:

• Access to Vinted, Etsy, and eBay pages — to read the listing page and fill the listing form. Our own site sellmate.store is also accessed, to sign you in. No other websites are accessed.
• Storage — to keep your login session, preferences, and the generated listing data locally in your browser.
• Tabs / scripting — to detect the marketplace tab you're on and enter the generated fields into the form.
• Alarms — to refresh your subscription status periodically.
• Offscreen — to process/resize product images in the background.

7. Data retention

Account and subscription data is kept while your account is active. Uploaded photos are held only transiently to run the analysis and are automatically deleted from our servers within one hour; we do not store them afterwards or use them to train models. Abuse-prevention device records are kept only as long as needed for that purpose. When you delete your account, we erase your personal data and cancel any Stripe subscription; some records may be retained where law requires.

8. Your rights (GDPR)

You have the right to access, rectify, erase, restrict, and port your data, and to object to processing. You can delete your account and export your data from your account page, or email privacy@sellmate.store. You may also lodge a complaint with your local data protection authority.

9. Cookies & local storage

The website uses essential cookies for sign-in and session management. The extension stores your session and settings in your browser's local storage. We use a privacy-preserving device fingerprint for abuse prevention only — not for advertising or cross-site tracking.

10. Children's privacy

SellMate AI is not directed to children under 16 and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy; material changes will be reflected by the "Last updated" date above and, where appropriate, notified by email.

12. Contact

Questions? Email us at privacy@sellmate.store.