Privacy policy

Who we are

Lystro (“we”, “us”) provides an online editor for creating eBay listing descriptions. We are the data controller for the personal data described here. You can reach us through our contact form.

What we collect

• Account details: your email address and a securely hashed password.
• Your content: the designs, listings and store profile you create. Your photos stay on your own image host; we only store their links.
• Plan details: your plan, trial dates and billing records handled by our payment provider, Stripe. We never see or store your card details.
• Messages: what you send us through the contact form or the Message us chat in your account, and our replies.
• Usage: anonymous page-view statistics (see Analytics below), basic server logs used to keep the service secure, and which page each open browser tab is on (a random id for the tab, and your account if you're signed in), kept for a day so we can see how many people are using the site right now.
• Security activity: which templates you open and when you export, so we can spot scraping. For visitors who aren't signed in we store a one-way scrambled form of the IP address, never the address itself. This record is kept for 30 days.

Why we use it (and our legal basis)

• To provide your account and save your work (performing our contract with you).
• To send essential emails, like confirming your email address or a reminder that your trial is ending (contract and legitimate interests).
• To answer your messages (legitimate interests).
• To keep the service secure and prevent abuse (legitimate interests).
• To meet legal obligations, such as keeping billing records.

We don't sell your data, and we don't use it for advertising.

Who we share it with

We use a small number of trusted providers to run the service, under data processing agreements:

• Supabase: database, sign-in and file storage (hosted in the EU).
• Vercel: website hosting.
• Resend: sending emails.
• Stripe: taking payments and managing subscriptions.
• Plausible Analytics: privacy-friendly, cookie-free visitor statistics.

Some providers may process data outside the UK. Where they do, appropriate safeguards (such as the UK International Data Transfer Addendum or standard contractual clauses) are in place.

Cookies and local storage

We only use what's needed to make the site work: a sign-in cookie to keep you logged in, and your browser's local storage to keep unsaved editor drafts and preferences on your device. Our analytics don't use cookies and don't track you across sites, so there's no cookie banner.

Listings you share

If you switch on a View Live link, anyone with the link can see that listing preview. It isn't listed in search engines, and you can switch it off at any time.

How long we keep it

We keep your account data while your account is open. When you delete your account, your designs, listings, images, profile and security activity are deleted straight away. Backups are cleared within 30 days. Billing records are kept for as long as the law requires.

Your rights

Under UK and EU data protection law you can:

• access the data we hold about you, and download it (Account → Download my data);
• correct it;
• delete it (Account → Delete account);
• object to or restrict some uses of it;
• move it to another service.

To use any of these rights, use your Account page or contact us. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before the change takes effect.