How Courtesy handles information.

Information used by the service

Account features store an email address, a password hash, verification status, session-related records and hashed verification or reset tokens. Passwords are not stored as readable text.

When separately authorized, provider connections store encrypted access credentials and account/shop identifiers. Stock workflows process product titles, listing identifiers, variant identifiers, SKUs, prices, availability and related product metadata. Protection preferences, observations and attempted or confirmed actions are recorded to explain decisions and support recovery.

The current Etsy adapter requests read-only listing access. It is not active for customer use while approval and real connection testing remain outstanding. The current integration does not request buyer-order or payment access.

Why this information is used

To authenticate accounts, send requested account emails, connect authorized stores, evaluate stock, record protection decisions, diagnose failures and handle support or privacy requests. Data is not needed from an Etsy account merely to browse these information pages.

Service providers and communication

Render hosts the application and its datastores. Printify supplies connected product information and mediates publishing to Etsy; the planned Etsy connection supplies independent listing readback. Resend delivers account verification and password-recovery email, including the recipient address and message content. Support email is forwarded to the operator’s Gmail inbox.

These providers process information under their own terms and privacy practices. Their processing locations and the final customer-facing provider disclosures must be confirmed before customer launch. No payment processor is connected to a public Courtesy checkout.

Cookies and operational records

The private app uses cookies for access control and sign-in, plus server-side session and rate-limit records. Verification and reset tokens expire. These public information pages contain no advertising, analytics scripts or tracking pixels and do not set cookies. Hosting providers may process request metadata for service operation.

Retention and disconnecting

Disconnecting a provider removes its saved access credentials locally and stops monitoring; it does not erase account records, prior observations, pending actions or recovery evidence. You can also revoke authorized access through the provider.

There is not yet a fixed automated purge schedule or complete self-service account-deletion process. Retention periods, backup handling and a verified deletion process must be finalized before customer launch. We do not promise that disconnecting instantly removes all copies of information.

Requests and security

Contact support@getcourtesy.com to request access, correction or deletion, or to raise a security concern. Contact us to discuss your request; we may need to verify account ownership. A complete deletion procedure has not yet been established. Do not send credentials in email.

The implementation uses encrypted provider credentials, hashed passwords and access controls. These measures are not a guarantee against loss, misuse or unauthorized access, and no security certification is claimed.

Before this draft becomes effective

Courtesy initially intends to serve U.S. customers. Before this draft becomes effective, the operator must confirm any additional required contact details, applicable legal bases and regional rights, retention periods, provider processing arrangements and the deletion workflow. An effective date and change-notice process will accompany the finalized policy.