Privacy Policy
Who we are
CleverSheetsCo is run by 3rd Prints LLC, a Massachusetts limited liability company. In this policy "we" and "us" mean that company. You can reach us about anything on this page at privacy@cleversheetsco.com.
What CleverSheetsCo does
CleverSheetsCo builds a website for an Etsy shop. A seller signs in with Etsy and gives us read-only access to their shop. We read the shop's details and listings from Etsy and publish a fast, search-friendly storefront for them. Every product link sends the buyer to that seller's Etsy listing. We do not sell anything ourselves, and we never handle a buyer's order or payment.
What we hold about you
This table lists every kind of personal data our service holds, where it comes from, and why we use it.
| Data | What it includes | Why we use it |
|---|---|---|
| Your account | From you, or from Google or Apple if you sign in with them: your name, email address, whether the email address is confirmed, profile picture, and a hash of your password if you set one. We also record which version of the terms you accepted and when, when your free trial was used, and when your shop was claimed. | To run your account and sign you in. We need it to provide the service you signed up for. |
| Sign-in with Google or Apple | From Google or Apple, if you choose them: your account id with that company, your email address (Apple may give a private relay address instead), your name, and the sign-in tokens Google or Apple return, with their expiry times and the permissions granted. Google also gives us your profile picture. Apple sends your name only the first time you sign in. | To sign you in with the company you chose. We need it to provide the service. |
| Sessions and cookies | From your browser when you sign in: a session record with your IP address, your browser's user agent, and when the session started and when it expires. Your browser holds one session cookie for our dashboard address. During a Google or Apple sign-in it also holds a short-lived sign-in state cookie. We also keep short records for password resets and for the limit on resending confirmation emails. | To keep you signed in and to protect your account. We need it to provide the service, and we have a legitimate interest in keeping accounts secure. |
| Bot check | From your browser when you send our sign-in, sign-up, password or early-access forms: Cloudflare Turnstile receives your IP address to check that a person is sending the form. We do not store it. | To keep automated abuse out of our forms. We have a legitimate interest in protecting the service. |
| Etsy connection | From Etsy, with your permission: your Etsy user id, your shop id, the access and refresh tokens Etsy issues (sealed before we store them), when the access expires, and the permissions you granted. While you are connecting, we also hold a one-time state value and a sealed code verifier for up to 10 minutes. | To read your shop from Etsy on your behalf. We need it to provide the service. |
| Shop and listings | From Etsy: your shop name, shop address on Etsy, shop id, shop icon and active listing count; for each listing, its title, price, currency, images and image descriptions, tags, materials, category, weight and size, description, whether it is available (we do not store the quantity), its Etsy link and its dates. From you: your subdomain, your shop story, your keyword collections and any custom domain you add. | To publish your storefront. We need it to provide the service. |
| Shipping and inventory | From Etsy, read with your permission: shipping cost, currency and origin country, handling and delivery days, the lowest and highest variant price, up to 20 variant labels with their prices, and when Etsy last changed the listing. | To show buyers accurate prices and delivery times on your storefront. We need it to provide the service. |
| Click-outs | From storefront visitors: which listing was clicked, on which shop, when, and the address of the page the visitor came from (shortened). No IP address, no browser details and no cookie. | To show you how many visitors your storefront sends to Etsy. We need it to provide the service to you, and we have a legitimate interest in counting visits. |
| Early-access requests | From the form on our home page: your email address, the shop you typed, any notes you added, and the date. No IP address and no browser details. If we invite you, we keep the invited email address and the date. | To reply to your request and invite you. You ask us to, and we have a legitimate interest in running the waiting list. |
| Billing | From Stripe: your Stripe customer and subscription ids, your plan, your subscription status, when the current period ends, whether it is set to cancel, and the ids of checkout sessions and billing events. No card data. | To know whether your site should stay online. We need it to provide the service you pay for. |
| Logs | From every request to our service, recorded by Cloudflare Workers Logs: the request method and address and details of the response, which may include IP address and browser details, plus our own event records. Our event records never contain an email address, a link, a token or an Etsy user id. | To find and fix faults and abuse. We have a legitimate interest in keeping the service working. |
| Analytics | From visitors to storefronts at cleversheetsco.com addresses and to our own marketing pages, recorded by Cloudflare Web Analytics: the page address, the referring page, browser, operating system and device type, country, page-load timing, and a random id for that one page load. No cookies and no local storage. | To count page views and keep pages fast. We have a legitimate interest in knowing how the service is used. |
What we read from Etsy
When you connect your shop, you grant us two read-only Etsy permissions: shops_r and listings_r. We never see your Etsy password.
To be plain about what shops_r means: it lets an app read shop information that is not public. We use it to read only your shipping profiles and your listing inventory. listings_r lets us read your listings.
For the data we read from Etsy, we act on your behalf and use it only to provide the service. We make these commitments about your Etsy data:
- We do not sell it or give it to anyone to sell.
- We do not send it to advertising or marketing platforms.
- We do not use it to train AI models.
Cookies and analytics
When you sign in, your browser stores one session cookie. It is set only for our dashboard address, so the shop sites we host cannot read it. During a Google or Apple sign-in, your browser also holds a short-lived sign-in state cookie, which is cleared when the sign-in finishes.
Storefront pages and our marketing pages set no cookies.
We count page views with Cloudflare Web Analytics. It runs on storefronts at cleversheetsco.com addresses and on our own marketing pages: the home, about, pricing, privacy and terms pages. It sets no cookies and uses no local storage. It does not run on the dashboard, on sign-in pages, or on a seller's own domain. We use no advertising trackers.
When someone visits a storefront
A storefront is public, and visiting one involves three things:
- When a visitor clicks a product link, we record a click-out: the listing, the shop, the time and the page they came from. We do not record their IP address, their browser details or a cookie.
- Product images load from Etsy's image servers (i.etsystatic.com). Etsy receives the visitor's IP address and browser details when the images load.
- When a visitor follows a product link, we send them to the Etsy listing, and Etsy sees the address of the storefront page they came from.
Email we send you
We send only email about your account and your site. It goes out from noreply@cleversheetsco.com through Cloudflare Email Service:
- confirming your email address;
- resetting your password;
- telling you your custom domain is live;
- telling you your Etsy connection stopped working;
- telling you your shop was claimed by its verified Etsy owner;
- warning you 7 days before a paused site is deleted;
- confirming your account was deleted;
- telling you when this policy or our terms change.
We do not send marketing email. Stripe or Link may email you payment receipts and payment notices under their own policies.
Who else handles your data
These companies handle personal data when you use CleverSheetsCo.
| Company | Role | What they get | Their privacy policy |
|---|---|---|---|
| Cloudflare | Service provider (processes data for us) | Everything we store, IP addresses as requests pass through, the Turnstile bot check, our logs, the email we send, and Web Analytics. | cloudflare.com/privacypolicy |
| Etsy | Independent company (its own policy applies) | We receive your Etsy data from Etsy with your permission. Etsy receives storefront visitors' IP address and browser details when images load, and the storefront page address when a visitor follows a link to Etsy. | etsy.com/legal/privacy |
| Independent company (its own policy applies) | If you sign in with Google: your Google account id, email address, name and profile picture, and the sign-in tokens Google returns. | policies.google.com/privacy | |
| Apple | Independent company (its own policy applies) | If you sign in with Apple: your Apple account id, your email address or private relay address, your name on the first sign-in, and the sign-in tokens Apple returns. | apple.com/legal/privacy |
| Stripe | Service provider (processes data for us) | Your account email address, your account and shop ids, and your subscription status. | stripe.com/privacy |
| Link | Merchant of record (sells you the subscription) | Your checkout and payment details. Your card details go to Link and Stripe and never reach us. | link.com/privacy |
Our service providers may process your data in the United States and other countries. Cloudflare, Stripe and Google rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and Standard Contractual Clauses; Apple relies on Standard Contractual Clauses.
How we protect your data
These are the measures we have in place:
- Etsy access and refresh tokens are sealed with AES-GCM encryption before we store them. The key is held as a Cloudflare Worker secret, not in our database.
- We never write tokens to our logs.
- Connecting to Etsy uses PKCE and a single-use state value.
- We ask Etsy only for the read-only shops_r and listings_r permissions.
- If we suspect that Etsy data we hold has been compromised, we will tell you and Etsy within 24 hours of finding out.
We do not claim any security certification, external audit or written security programme. No service can promise that data is perfectly safe.
How long we keep it
| Data | How long we keep it |
|---|---|
| Your account, password hash and Google or Apple sign-in | Until you delete your account. |
| Sessions, including IP address and browser user agent | 7 days, extended while you use it. Deleted when you sign out, reset your password or delete your account. Our 30-minute job deletes expired sessions. |
| Sign-in state cookie | Cleared when the Google or Apple sign-in finishes. |
| Password-reset and email-resend records | Until they expire. Our 30-minute job deletes expired records. |
| Etsy tokens and Etsy user id | Deleted at once when you disconnect, when Etsy refuses to renew our access, when you delete your account, or when your shop is deleted. |
| Etsy connection in progress | Up to 10 minutes. |
| Listings | Refreshed every 30 minutes while your site is live. A listing removed on Etsy is deleted at the next successful sync, and its page then tells visitors it is gone. |
| Shipping and inventory facts | Deleted at once when you disconnect or when Etsy access ends. |
| Your shop, listings, collections, click-outs, custom domain and billing record | Deleted with your shop: when you delete your account; 30 days after your site pauses, with a warning email 7 days before; or 7 days after an onboarding you did not finish. |
| Click-outs | 90 days. |
| Early-access requests | Until we invite you, or 12 months. |
| Invites | Until you create and later delete an account, or ask us to remove it. |
| Billing records at Stripe and Link | Our copy is deleted with your shop. Stripe and Link keep their own records under their own policies. |
| Bot check IP address | Not stored by us. |
| Logs | Up to 7 days. |
| Analytics | Kept by Cloudflare under its Web Analytics retention: full data for 7 days, then a sample of about 10%, viewable for up to 6 months. |
Deleting your account is immediate. You do it from your dashboard. We cancel your subscription, remove your custom domain, delete your account, your shop and everything under it, sign you out, and email you a receipt.
You can end our Etsy access in two ways, and they work differently:
- Disconnect from your dashboard. We delete your Etsy tokens and your shipping and inventory facts at once. Your site pauses. Your billing continues until you cancel it in Billing. You can reconnect the same Etsy shop at any time. If your site stays paused for 30 days, we delete your shop, and we email you 7 days before.
- Revoke our access in Etsy (Account settings → Apps → Connected apps → Revoke). The next time we try to renew our access, Etsy refuses. We then delete your Etsy tokens and your shipping and inventory facts, and email you. Your site stays live with your public listing data for as long as your subscription is active.
Your rights
Wherever you live, you have the same rights over your personal data. You can ask us to:
- give you a copy of the data we hold about you (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- stop using it for a purpose based on our legitimate interests (objection);
- give it to you in a format you can take elsewhere (portability).
Where we rely on your consent, you can withdraw it at any time. You can also complain to a data protection supervisory authority, for example the one where you live.
Email privacy@cleversheetsco.com to use any of these rights. We may ask you to send the request from your account's email address. We reply within one month.
US state privacy laws: we do not sell or share your personal information.
Children
CleverSheetsCo is a business tool for Etsy sellers. It is not meant for children under 16.
Changes to this policy
If we change this policy, we publish the new version on this page with a new effective date at the top. When we do, we email everyone with an account, and we ask you to accept the updated terms the next time you open your dashboard.
Contact us
Privacy questions and requests go to privacy@cleversheetsco.com, addressed to 3rd Prints LLC.
Our postal address:
3rd Prints LLC150 Grossman Drive STE 205A PMB 7002Braintree MA 02184-4947United States