Privacy Notice

1. Data controller

The data controller is MESE Studios LLC, a limited liability company organized in the State of Wyoming, United States (referred to here as we or us). The software is developed by MNE Works (mneworks.com).

You can send any request about this notice to support@listorie.com. Requests sent to this address are handled directly by us.

2. Scope of this notice

This notice covers this website (listorie.com), the early-access waitlist and our email contact. Listorie is in early access: the web application is not yet available to the public.

When the application becomes available, the parts of this notice about the application and Etsy shop data (sections 3 and 5) will apply to it, and before launch we will update this notice with the service providers we use for it.

3. Data we collect

Early-access waitlist: your email address; optionally, the range of Etsy shops you run (for example 2-3); the language of the page you used; the date and time you gave your consent; and the date the entry was created. Sharing the shop range is optional.

Messages to us: if you email support@listorie.com we receive your email address, your message and any details you choose to include.

Technical data: when you load the site, our hosting provider receives your IP address, browser and device type, the pages you request and the time of each request. This is used to deliver the website and keep it secure. We do not use cookies, advertising, analytics or tracking tools, and fonts are served from the site itself.

Listorie application (once available): account details such as your name and email address, the workspace and settings you create, the Etsy shops you connect and, from Etsy and only within the permissions you grant, the data described in section 5, plus the technical records needed to run and secure the service.

4. Why we use your data and on what legal basis

Waitlist: to tell you when early access opens and to send you an invitation. Legal basis: your explicit consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)). You can withdraw it at any time without affecting what happened before. The optional shop range helps us plan invitations and the product.

Support and security: to answer your messages and to protect the website from abuse. Legal basis: our legitimate interest in running a secure service and helping the people who contact us (GDPR Art. 6(1)(f), KVKK Art. 5/2(f)) and, for application users, performance of the contract (GDPR Art. 6(1)(b), KVKK Art. 5/2(c)).

We do not sell your personal data, do not share it for advertising, do not use it to train artificial intelligence models and do not make decisions about you by automated means that have legal or similarly significant effects.

5. Etsy shop data (application)

Once the application is available, if you connect an Etsy shop we access that shop's listing, order and shop data through Etsy's official API, only within the permissions you grant on Etsy's own authorization screen. Orders can include buyer personal data that Etsy returns, such as name, address and order details, which we use only to show and manage your orders.

For this data we act as a service provider to you, the Etsy seller: we process it only to provide the service you asked for and in line with this notice and applicable law. As the seller, you remain responsible for the buyer data you decide to process with the application.

Data we receive from Etsy is shown to you no more than 6 hours older than on Etsy for listing content and no more than 24 hours older for other content, and is kept no longer than reasonably necessary to provide the service. Etsy shop data is never sold, rented, used for advertising or used to train artificial intelligence models.

You can disconnect a shop at any time in the application or in your Etsy account settings. After disconnection we stop accessing that shop and delete its data within 30 days, unless the law requires us to keep something longer. Access tokens are stored encrypted and are never shown in the application.

6. Who receives your data

We use service providers that process data on our behalf and under our instructions: Google (Google Sheets and Google Apps Script) stores the waitlist entries; Vercel hosts the website; Hostinger provides our domain, DNS and email. Before the application launches we will add the providers it needs (for example database, hosting and payment services) to this list.

If you connect an Etsy shop, Etsy, Inc. also receives and provides data as described in its own terms and privacy policy. We have no control over how Etsy handles data on its own services.

We disclose data to authorities, courts or professional advisers only when the law requires it or to establish, exercise or defend legal claims, and, in the event of a merger, sale or reorganization of the business, to the other party with the same protections.

7. International transfers

MESE Studios LLC is established in the United States and our providers operate in the United States and other countries, so your data is stored and processed outside Turkey and outside the European Economic Area. For the waitlist we ask for your explicit consent to this transfer in the sign-up form (KVKK Art. 9, GDPR Art. 49(1)(a)).

Where the law requires it, our providers rely on safeguards such as standard contractual clauses or equivalent mechanisms. You can withdraw your consent at any time, which means leaving the list.

8. How long we keep your data

Waitlist entries are kept until you withdraw your consent or, if you have not signed up for the service within 12 months after the product launches, until then. We then delete the entry.

Support emails are kept as long as needed to deal with your request and for up to 2 years afterwards, unless the law requires longer. Hosting provider logs are kept for the period set by the provider.

Application data is kept while your account is active and deleted within 30 days after you close it, except for records we must keep by law (for example billing and tax records).

9. Security and data breaches

We use encrypted connections (HTTPS) and limit access to personal data to the people who need it. For the application, we design the service so that each customer's data is kept separate and Etsy access tokens are stored encrypted. No system is completely secure, so we also collect only the data we need.

If a personal data breach affects Etsy member data, we notify Etsy (dpo@etsy.com) and the affected seller without undue delay and in any case within 24 hours of discovering it. For other breaches we notify the authorities and the people affected as the law requires.

10. Your rights

Under KVKK Art. 11 you can ask whether your data is processed, request information, learn the purpose and whether it is used appropriately, learn who it is transferred to in Turkey or abroad, request correction, request deletion or destruction, request that these actions be notified to recipients, object to a result against you arising from automated analysis, and claim compensation for damage caused by unlawful processing.

Under the GDPR you can also ask for access to your data and a copy of it, rectification, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent at any time. Withdrawing consent means leaving the list.

Send your request to support@listorie.com. We may ask you to confirm your identity and will answer within 30 days (45 days where California law applies; we will tell you if we need more time, as the law allows). You may also complain to the Turkish Personal Data Protection Authority (KVKK Kurumu) or to the data protection authority of your country, but we would appreciate the chance to resolve your concern first.

11. California privacy rights

If you are a California resident, you have the right to know what personal information we collect, use and disclose, to request deletion or correction, and not to be discriminated against for using these rights. You can also limit the use of sensitive personal information and opt out of the sale or sharing of personal information.

We do not sell or share personal information (as those terms are defined in the CCPA/CPRA) and do not collect sensitive personal information. Send requests to support@listorie.com.

12. Children

Our website and the application are intended for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

13. Cookies and tracking

This website does not set cookies and does not use advertising, analytics or tracking tools. Your visit is not reported to third parties other than our hosting provider, which receives the technical data described in section 3.

If we add cookies or similar tools in the future, we will update this notice and ask for your consent where the law requires it.

14. Changes to this notice

We update this notice when our practices change, and the date at the top shows the latest version. We will tell waitlist members and account holders by email about material changes before they take effect.