1. Who is responsible for your data
Ava Lily Studio, operating Draft Sprite and The Draft Nook in the United Kingdom, is the controller for the personal data described in this notice.
Contact: hello@thedraftnook.com.
2. What we collect
- Account data: email address, authentication identifier, verification and session information, password-reset events and, if Google sign-in is enabled and chosen, basic Google account information returned through Supabase Auth.
- Etsy connection data: Etsy shop ID, shop name and icon, OAuth access and refresh tokens, connected listing and shop information, listing profiles, inventory and delivery settings, catalogue data and shop-performance information needed for the features you use.
- Your content: artwork, mockup assets, optional PSD files, shop logos, prompts, listing copy, saved profiles, prices, settings, saved drafts and generated output files.
- Product-use data: pages and limited feature events, an anonymous browser identifier when optional analytics is allowed, error and security logs, browser and device information, and stored preferences.
- Support data: messages, screenshots and any information you choose to provide when asking for help.
Some Etsy data may relate to customers or transactions. Draft Sprite requests the Etsy permissions needed for its seller tools. Do not copy unrelated customer personal data into prompts or listing content.
3. Why we use it
| Purpose | Typical data | UK GDPR basis |
|---|---|---|
| Create and secure your account | Email, authentication and session data | Contract and legitimate interests in account security |
| Connect Etsy and create editable drafts | Etsy tokens, shop, listing and profile data | Contract, at your request |
| Generate listing copy, mockups and digital files | Artwork, prompts, shop context and selected settings | Contract, at your request |
| Save your workspace and preferences | Profiles, drafts, line-ups and settings | Contract and legitimate interests in providing a usable service |
| Measure and improve the product | Limited feature events and anonymous identifier | Consent for browser analytics storage; legitimate interests for analysis after consent |
| Prevent abuse, diagnose faults and provide support | Security logs, error details and messages | Legitimate interests and, where relevant, contract |
| Meet legal requirements and defend claims | Relevant account, transaction or correspondence records | Legal obligation and legitimate interests |
Where processing relies on consent, you can withdraw it at any time. Withdrawing consent does not affect earlier lawful processing.
4. How AI processing works
When you ask Draft Sprite to analyse artwork, write listing content, research wording or generate optional creative material, the necessary prompt, image and shop context may be sent to an AI provider. The current product uses OpenAI and Anthropic services for different features.
Generated content is an aid, not a decision about you. Draft Sprite does not use automated processing to make decisions that produce legal or similarly significant effects. You review the result and decide whether to use it.
Avoid uploading confidential material or personal information that is not needed for the listing. You remain responsible for checking generated content for accuracy, ownership, policy compliance and suitable disclosures.
5. Who processes data for us
- Supabase: authentication, database and private file storage.
- Vercel: website hosting, server functions and operational logs.
- Render: image-compositing infrastructure for relevant mockup jobs.
- OpenAI and Anthropic: AI analysis and generation for the features you request.
- Etsy: shop connection, listing reads and draft creation through Etsy's API.
- Photopea: browser-based PSD processing when a Photopea-backed mockup or editor feature is used.
- Google: hosted fonts and, only if enabled and chosen, sign-in.
These providers receive only the data needed for their role. They may process data in the United Kingdom, European Economic Area, United States or other locations. Where restricted transfers occur, we rely on applicable adequacy arrangements and provider contractual safeguards where required.
We do not sell personal data and we do not use advertising cookies.
6. How long we keep data
- Temporary source artwork for standard mockup jobs is scheduled for deletion after 24 hours.
- Digital-listing source artwork and the five generated download packages are scheduled for deletion after 30 days.
- Artwork attached to a saved Draft Sprite draft remains until that draft is deleted or displaced by the saved-draft limit.
- Account settings, Etsy connection tokens, profiles and saved work remain while your account or connection is active, unless you delete them or ask us to do so.
- Optional product analytics are kept only for as long as needed to understand the beta and are reviewed for deletion or aggregation.
- Provider logs and backups follow the relevant provider's operational retention schedule. Some records may be kept longer where necessary for security, legal obligations or disputes.
Disconnecting an Etsy shop removes its stored access tokens and connected-shop record. Some user-created shop copy and settings may remain so they are not accidentally lost. Contact us if you want all account data removed.
7. Security
Customer source artwork and generated digital packages use private storage with time-limited access links. Access to account workspaces is authenticated, application tables are protected from browser access, and Etsy tokens are kept server-side.
No online service can promise absolute security. Use a unique password, keep your email account secure and contact us promptly if you believe your account has been accessed without permission.
8. Your rights
Depending on the circumstances, UK data-protection law may give you the right to access, correct, erase or restrict your data, object to certain processing, withdraw consent and receive portable data.
Send requests to hello@thedraftnook.com. We may need to verify your identity. You can also complain to the Information Commissioner's Office.
9. Changes to this notice
We will update this notice when the product, providers or legal requirements change. Material changes will be brought to account holders' attention before new processing begins where required.