1. Information We Collect

• Identity & contact data: full name and email address provided during registration.
• Store connection data: OAuth tokens and store credentials for platforms you connect (Etsy, Shopify, Printify). Details of the Etsy data we access are described in Section 5 (Etsy Integration).
• Facebook & Instagram data: when you connect a Facebook Page and/or Instagram Business account, we access — strictly within the permissions you grant during the Facebook login — your Page and Instagram account identifiers, access tokens, and basic account metadata (such as Page name and username). This is used solely to publish the content you create and schedule to your own connected accounts. We do not access your private messages, friends list, or personal profile content.
• Content data: prompts, uploads, designs, and automation configurations you create.
• Billing data: subscription plan, transaction metadata, and last four digits of your payment card. Full card details are handled exclusively by Stripe and are not stored by us.
• Usage data: feature usage, automation logs, AI credit consumption, and session activity.
• Technical data: IP address, browser type, device type, and referral URL collected automatically.

2. How We Use Information

• To create, maintain, and secure your account.
• To provide the Service, including automation, listing generation, and mockup features.
• To process payments and manage your subscription via Stripe.
• To enable third-party integrations you authorize (Etsy, Shopify, Printify).
• To create draft listings and upload listing images (such as product mockups and size or color charts) to the Etsy shop you connect, only when you instruct us to do so.
• To publish content on your behalf to the Facebook Page and Instagram Business account you connect — creating and posting the images and Reels you have created and scheduled within PallFlow. We do not use your Facebook or Instagram data for advertising, profiling, or resale.
• To send transactional and service-related communications.
• To improve the Service and prevent fraud and abuse.
• To comply with applicable legal obligations.

3. Legal Bases

Where applicable law (such as the GDPR) requires it, we process personal data on the bases of performance of a contract, our legitimate interests in operating and securing the Service, your consent, and compliance with legal obligations.

4. Facebook & Instagram Permissions

To publish on your behalf, PallFlow requests only the Meta permissions necessary for that function, which may include pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, and instagram_content_publish. We use these permissions exclusively to identify your connected accounts and to publish the content you schedule. You grant these permissions during the Facebook login flow and can revoke them at any time (see "Disconnecting & Data Deletion" below). Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.

5. Etsy Integration

PallFlow offers an optional integration with Etsy that lets you manage listings in your own Etsy shop. This section explains what Etsy data we access and how we handle it.

Data we access

When you connect your Etsy shop, you authorize PallFlow through Etsy's official OAuth process. We request only the following permissions: shops_r, listings_r, and listings_w. With them we access only:

• Your Etsy shop ID and shop name, to identify the connected shop.
• Your shop's listings and listing images, so you can create draft listings and upload images you design in PallFlow.
• OAuth access and refresh tokens issued by Etsy, so we can act on your shop on your instruction.

We do not access order, transaction, buyer, payment, or messaging data, and we never ask for or store your Etsy password.

How we use it

Etsy data is used only to provide the listing features you request inside PallFlow. We do not use it for advertising, profiling, market research, or any purpose unrelated to your use of PallFlow, and we do not combine it with data from other Etsy shops. We do not scrape Etsy or access Etsy data by any means other than the Etsy Open API.

Sharing

We do not sell, rent, or share Etsy data with third parties. It is processed only by the cloud infrastructure providers that host PallFlow, under confidentiality obligations.

Storage and retention

Etsy OAuth tokens are stored encrypted. Listing data retrieved from Etsy is cached only as long as needed to display or update your listings, in line with Etsy's API Terms of Use. When you disconnect your Etsy shop or delete your PallFlow account, we delete your Etsy tokens immediately and any cached Etsy data within 30 days.

Your control

You can disconnect your Etsy shop at any time from your PallFlow settings, or revoke PallFlow's access from the Apps section of your Etsy account settings. Revoking access stops all further access by PallFlow to your shop. For data access or deletion requests, contact us at [email protected].

Trademark notice

The term "Etsy" is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

6. Sharing & Disclosure

We do not sell personal data. We share data only with: service providers acting on our behalf (including Stripe for payments, Google for AI features, Meta for publishing to your connected accounts, and cloud infrastructure providers); third-party platforms you choose to connect; and authorities where required by law or to protect rights and safety. Data received from Etsy is never shared with third parties, as described in Section 5.

7. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. Billing records are retained for 7 years as required by financial regulations. Technical logs are retained for up to 12 months. Store credentials are deleted upon disconnection or account deletion. Cached data retrieved from Etsy is deleted within 30 days of disconnection or account deletion. You may request earlier deletion as described below.

8. Disconnecting & Data Deletion

You are in control of the accounts you connect. You may disconnect your Facebook Page or Instagram account at any time from within PallFlow settings, or from Facebook under Settings & Privacy → Settings → Business Integrations — removing PallFlow there immediately revokes our access and deletes the associated tokens.

You may disconnect your Etsy shop at any time from within PallFlow settings, or revoke PallFlow's access from the Apps section of your Etsy account settings. Disconnecting deletes your Etsy tokens immediately.

To request deletion of all personal data associated with your account or your Facebook login, email [email protected] with the subject line "Data Deletion Request". We will confirm and complete the deletion within 30 days, except where retention is required by law.

9. Security

We use technical and organizational measures including TLS encryption in transit, encryption at rest for third-party access tokens, hashed account passwords, and strict access controls. No method of transmission or storage is completely secure. Please notify us at [email protected] immediately if you suspect unauthorized access.

10. Your Rights

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, contact us at [email protected]. We will respond within 30 days. You may also lodge a complaint with your local data protection authority.

11. Cookies

We use strictly necessary cookies for authentication and session management, and limited analytics to understand usage patterns. You can control cookies through your browser settings; disabling essential cookies may impair the Service.

12. International Transfers

CS Digital Wonders LLC is incorporated in Wyoming, United States. Your data may be processed in the United States or other countries where our service providers operate. Where required, we apply appropriate safeguards such as standard contractual clauses for international transfers.

13. Children

The Service is not intended for individuals under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us data, contact us at [email protected] and we will promptly delete it.

14. Changes

We may update this Policy. Material changes will be notified through the Service or by email at least 14 days before taking effect, and the dates above will be revised.

15. Contact

Privacy questions and requests: [email protected]