ShopFlow turns your Etsy orders into production checklists. To do that across your devices, some order information is stored on our servers — and this policy explains exactly what, why, what we deliberately never collect, and how you delete it. We aim to collect the minimum we need and nothing more.
Using ShopFlow requires a ShopFlow account, separate from your Etsy account. We do not log into Etsy or access your Etsy credentials.
To back up your work and let you pick up where you left off after a reinstall or on another device, ShopFlow stores a working copy of your production data on its servers, associated with your shop. This is a current-state snapshot — it is overwritten with your latest state on each sync, not kept as accumulated history.
ShopFlow does not read or store buyer shipping addresses, email addresses, phone numbers, or any payment or card data. The extension does not read those fields from Etsy at all. We collect buyer names and order-level details only to the extent needed to build and sync your production checklists.
Earlier versions of ShopFlow kept all order data on your device only. To support signing in across multiple devices and using the web dashboard as a working surface (not just the extension), a working copy of the order and learning data described above is now stored on our servers. You remain in control of it and can delete it at any time (Section 9).
ShopIQ uses Claude by Anthropic to interpret personalization text — the instructions buyers leave when they order. For this, ShopFlow sends only the personalization text itself, plus the product title and item count needed to interpret it correctly.
{
"personalization": "Bag 1 Ashley with heart icon, Bag 2 Emma bow",
"title": "Custom Makeup Bag",
"setSize": 2
}
Data sent to Anthropic is governed by Anthropic's Privacy Policy. Anthropic does not use data submitted via their API to train their models.
ShopFlow records anonymized vocabulary and formatting patterns toward a shared learning layer that will help improve parsing as more shops contribute. Today, the layer is in its recording phase — anonymized patterns from each shop are added to a shared pool. As more shops contribute, patterns that meet the gating criteria below will propagate, helping future parses across all participating shops.
All shared vocabulary is tagged by craft vertical (embroidery, jewelry, candles, etc.) and capped at roughly 60 characters per term — so even short phrases stay short.
Noise tokens (short phrases sellers flag as commentary rather than design) and alias pairs (typo → fix) are technically derived from buyer text — for example, a "rush order" phrase a seller marked as noise, or a misspelled name paired with its correction. So a small amount of buyer-derived vocabulary (short, anonymized, no identity, no design or personalization content) can be part of the pooled vocabulary. We highlight this so the disclosure is precise: cross-shop learning involves anonymized vocabulary patterns, never personalization, names, design content, or shop identity — but the vocabulary itself can include short tokens derived from how buyers and sellers describe things.
Because shared patterns are anonymized and aggregated, they cannot be linked back to your shop. As a result, they are retained even after you delete your account. We cannot selectively remove your contribution from the collective pool because we no longer know which contributions came from you. This pool contains no personalization content, no buyer or shop identity, and nothing that identifies a specific order.
ShopFlow uses the following third-party services to deliver the product. Each has its own privacy policy.
| Service | What it does | What we send |
|---|---|---|
| Supabase Privacy policy ↗ |
Account authentication (email magic-link, delivered via Resend) and storage of account/subscription records | Your email address and subscription identifiers/status |
| Resend Privacy policy ↗ |
Delivers your sign-in (magic-link) emails | Your email address and the sign-in link only — no buyer data. |
| Stripe Privacy policy ↗ |
Subscription payment processing | Email and billing details you enter at checkout. We never see your full card number — Stripe handles it directly. |
| Anthropic Privacy policy ↗ |
ShopIQ uses Claude to parse personalization text | Personalization text only — never buyer names, addresses, or order IDs (Section 4) |
| Vercel & Upstash Vercel ↗ |
Hosting for the website, the ShopFlow API, and the server-side store of your production and learning data | Standard web request logs (IP, browser type) for the site; your server-stored order and learning data (Section 3) for the API and data store; and the anonymized diagnostic/usage events described in Section 3 |
| Loops Privacy policy ↗ |
Transactional and marketing emails (trial reminders, billing notices) | Your email address only. You can unsubscribe at any time. |
The ShopFlow Chrome extension requests the following permissions, each used only for the purpose described:
| Permission | Why ShopFlow uses it |
|---|---|
| activeTab | To read the Etsy orders page you're currently viewing, so it can parse your orders when you click Sync |
| storage | To save your production state, parsed orders, learned rules, and your extension connection credential locally in your browser |
| scripting | To read the DOM of the Etsy orders page when you sync |
| sidePanel | To display the ShopFlow production sheet as a side panel next to your Etsy orders |
| Host permission for etsy.com | So ShopFlow only runs on Etsy and nowhere else |
ShopFlow does not request access to other tabs, browsing history, bookmarks, downloads, or any other sensitive Chrome data.
ShopFlow has three categories of data, each with different retention behavior.
Your email, subscription identifiers, status, and extension token hash. Retained while your account is active; deleted when you delete your account (Section 9), except where law requires retaining certain billing records.
The production and learning data described in Section 3, stored under your shop. It is overwritten with your current state on each sync (not accumulated as history); automatically expires after 90 days of inactivity; and is deleted immediately when you delete your account (Section 9).
Orders, checkbox state, learned rules, and the raw personalization text those rules were learned from live in your browser's local storage. This persists until you uninstall the extension or use the in-app Reset. On a plain sign-out, your active orders are cleared from the device, but the learned rules (and the personalization snippets they were learned from) are intentionally kept so you don't have to re-teach ShopFlow when you reconnect — use Reset ShopFlow or delete your account to remove them.
As described in Section 5, these are aggregated and cannot be linked back to your shop, so they are retained indefinitely and cannot be individually removed. They contain no personalization content, no order or transaction details, no shop or buyer identity, and nothing that could be tied to a specific person or shop.
Depending on where you live, you have rights to access, correct, export, or delete your personal information. ShopFlow honors these rights for all users regardless of jurisdiction.
You can delete your account yourself at any time from the Settings panel in the ShopFlow web app. Deletion is immediate and permanent. When you delete your account, we:
This action cannot be undone. The only things retained are anonymized cross-shop patterns (Section 5), which contain no personalization, names, design content, or shop identity, and cannot be linked to you; any billing records the law requires us to keep; and the customer record held by our payment processor, Stripe — when you delete your account we cancel your subscription, but Stripe keeps its customer/payment record, which we use to prevent repeated free-trial abuse (so the same email cannot claim a new free trial after deleting). If you prefer, you can also request deletion by emailing privacy@getshopflow.app from your account email, and we will complete it within 30 days.
In the ShopFlow side panel Settings, use Reset ShopFlow to permanently delete all ShopFlow data on that device, including learned patterns and the raw personalization text they were learned from.
Email privacy@getshopflow.app for a machine-readable copy of your server-stored data, or to access or correct what we hold.
For California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of any sale of personal information. ShopFlow does not sell personal information.
For UK and EU residents (GDPR): Our lawful basis for processing is the performance of our contract with you (operating the service you subscribe to) and our legitimate interest in improving it. You have rights to access, rectification, erasure, restriction, portability, and objection. Contact privacy@getshopflow.app. Note that anonymized cross-shop patterns (Section 5) cannot be removed once aggregated.
ShopFlow takes reasonable steps to protect your data:
No system is 100% secure. In the event of a data breach affecting your account, we will notify affected users via email within 72 hours of discovery, as required by applicable law.
ShopFlow is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe we have, contact privacy@getshopflow.app and we will delete it.
ShopFlow's servers are hosted in the United States. By using ShopFlow, you consent to the transfer of your data to the United States, which may have different data protection rules than your country of residence. We honor the rights described in Section 9 for all users.
We may update this policy as the product evolves or as required by law. When we make material changes, we'll update the "Last updated" date and notify users by email at least 14 days before the changes take effect. For significant changes — such as new data collection or expanded sharing — we'll seek renewed consent where required. Your continued use after changes take effect constitutes acceptance of the updated policy.
Questions about this policy, your data, or your rights? We read every email.
ShopFlow is not affiliated with, endorsed by, or sponsored by Etsy, Inc. "Etsy" is a registered trademark of Etsy, Inc.