Privacy Policy

We collect the following categories of information:

Account information

• Your name and email address.
• A securely hashed version of your password (we never store passwords in plain text).
• Your account role (for example, regular user or administrator).
• Whether your email has been verified, and a short-lived verification token used during sign-up.

Product and listing data you submit

• Reference product information you import or paste in (titles, descriptions, prices, specifications, supplier details, image URLs).
• Edits you make to AI-generated drafts.
• Listings you save, publish, or share through the service.

AI generation data

• The prompts and inputs sent to AI providers on your behalf.
• The AI Output produced for your account, including titles, descriptions, keywords, tags, and generated images.
• Aggregate counts of generations performed (text generations, image generations, input/output token totals, and similar usage metrics).

Connection and integration data

• When you connect a third-party account (for example, a social or marketplace platform), we store the access tokens and account identifiers needed to perform the actions you authorize through the integration. Tokens are used only for the scopes you grant during connection and are encrypted at rest.
• We do not store the passwords of your third-party accounts.

Technical data

• IP address (used to apply rate limits and detect abuse).
• Browser/user-agent and basic request metadata.
• Application logs and error reports needed to operate and debug the service.

We use your information to:

• Create and operate your account, including verifying your email address.
• Provide the core features of the service - generating, editing, saving, and publishing listings.
• Send the AI inputs you submit to the relevant AI provider so the requested output can be generated.
• Apply usage limits and rate limits.
• Send transactional emails (verification, password-related notices, and important service updates).
• Diagnose, debug, and improve the service, including investigating bugs and abuse.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use it for third-party advertising or cross-context behavioral advertising.

We rely on a small number of third-party providers to operate Sactiv. These providers act as our processors/sub-processors: they handle data only on our documented instructions, only for the purposes for which we engage them, and are bound by contractual confidentiality and security obligations. They include, by category:

• Database hosting (currently MongoDB) - stores your account, listings, and connection records.
• Transactional email (currently Resend) - delivers verification and notification emails.
• AI model providers - receive the prompts and content you submit so they can generate the requested output. Their handling of that data is governed by their own terms, and where required by law we have data processing agreements in place with them.
• Hosting and infrastructure providers - run the application servers and supporting services.
• Social or marketplace platforms - receive content and metadata when you choose to publish through their APIs, under authorization you grant at connection time.

We send only the minimum data needed for each provider to perform its function. We will update this list if our sub-processors change in a way that materially affects how your data is handled.

We use a small number of browser storage mechanisms:

• An httpOnly authentication cookie (auth_token) used to keep you logged in and to gate access to protected pages. This cookie is the sole carrier of your session - your authentication token is not accessible to client-side JavaScript and is not stored in localStorage.
• Limited operational data such as your selected extension ID, where applicable.

We do not use third-party advertising or tracking cookies. You can clear cookies at any time through your browser settings; doing so will sign you out.

Sactiv acts as a data processor with respect to any competitor reference data, specifications, descriptions, or product images that you import or submit using our tools - we store and process this data to provide the service, but we do not review it for intellectual property or legal compliance before you use it.

• You remain the data controller for, and the party legally responsible for the lawful basis behind, all reference data you submit or import.
• Sactiv does not review, verify, own, or assume liability for the copyright, trademark, or proprietary status of reference products or designs you import.
• By importing or modifying any reference data, you are responsible for ensuring that your processing and subsequent publishing of it is legally authorized and does not violate any third party's intellectual property or privacy rights.

This section describes the allocation of responsibility for data handling between you and Sactiv. It does not, on its own, shield Sactiv from claims a third party brings directly against us - see our Terms of Service for how liability is allocated between you and Sactiv contractually.

We keep your account information for as long as your account is active. If you delete your account or request deletion, we will remove or anonymise your personal data within a reasonable period (typically within 30 days), except where we are required to retain it for legal, accounting, security, or fraud-prevention reasons.

Email verification tokens are short-lived (currently 24 hours) and are deleted as soon as they are used or replaced.

Generated listings and historical generation records are kept for the lifetime of your account so that you can revisit and reuse them. You can request their deletion at any time.

We use a layered set of safeguards to protect your data, including:

• Passwords stored only as bcrypt hashes.
• Encryption of third-party platform access tokens at rest.
• Authentication via signed JWTs delivered through httpOnly cookies (no Bearer tokens are accepted from the browser).
• Per-IP rate limiting on sensitive endpoints (login, sign-up, email resend).
• Input validation and SSRF protection on server-side fetches.
• Transport encryption (HTTPS) for all browser–server traffic in production.

No system can be made perfectly secure, and we do not guarantee that unauthorized access, hardware failure, or other data loss will never occur. If you discover a vulnerability, please report it responsibly to support@sactiv.com. In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

Depending on where you live, you may have some or all of the following rights over the personal data we hold about you:

• Access - request a copy of the personal data we hold about you.
• Correction - ask us to correct inaccurate or incomplete data.
• Deletion - ask us to delete your personal data, subject to legal retention requirements.
• Portability - request your data in a portable format.
• Restriction or objection - ask us to limit or stop certain processing.
• Withdraw consent - where processing is based on consent, withdraw it at any time without affecting processing that already occurred.
• Opt out of sale or sharing - we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of in that respect; if this changes, we will update this policy and provide an opt-out mechanism before doing so.
• Non-discrimination - we will not deny you service or charge you a different price for exercising these rights.

To exercise any of these rights, contact us at support@sactiv.com. We may need to verify your identity before acting on the request, and we will respond within the timeframe required by applicable law.

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a supervisory authority for data protection, you also have the right to lodge a complaint with that authority. If you are a California resident, you have rights under the CCPA/CPRA as described above and may also designate an authorized agent to make a request on your behalf.

Sactiv and several of our service providers operate in jurisdictions that may differ from your own, including outside the European Economic Area, the United Kingdom, or your country of residence. By using the service, you understand that your information may be transferred to and processed in those jurisdictions. Where required by applicable law, we use appropriate safeguards for such transfers, such as standard contractual clauses.

Sactiv is a business-to-business tool and is not directed at children. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, please contact us at support@sactiv.com and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, notify you (for example, by email or an in-app notice) before the changes take effect. Continued use of the service after the changes take effect constitutes acceptance of the revised policy.

For privacy questions, data-rights requests, or complaints, please contact us at support@sactiv.com.