Last Updated: November 9, 2026

Privacy Policy

This Privacy Policy describes how ListPrelo, a product of 1849Project LLC ("we," "us," or "our") collects, uses, shares, and protects information when you use our website at listprelo.com and related services (collectively, the "Service"). By using the Service you agree to the practices described in this policy.

1. Information We Collect

Account Information

• Email address, full name, and a securely hashed password. We never store passwords in plain text.

Mobile Phone Number (Optional)

• If you turn on text alerts in Prelo Want, we collect your mobile number, the date you agreed to receive texts, and a record that you confirmed the number with a one-time code. We use it only to send the alerts you asked for.

Prelo Want

• If you use Prelo Want, we collect the reference photo you upload and the item details you enter (brand, item, color, sizes, maximum price, and an optional product link), and we record which listings we found for you and whether you marked them bought or not a match.

Google OAuth

• If you sign in with Google, we receive your email address, display name, and profile picture from Google. We do not receive or store your Google password.

Marketplace Credentials

• eBay OAuth tokens (encrypted at rest with AES-256-GCM), Etsy OAuth tokens, and marketplace usernames necessary to publish and manage listings on your behalf.

Payment Information

• Stripe customer ID and subscription details (plan type, billing cycle, usage credits). We never store credit card numbers, CVVs, or full card details — all payment processing is handled directly by Stripe.

Item Data

• Photos you upload, listing titles, descriptions, prices, categories, item condition, item specifics, and the results of AI analysis performed on your items.

Shipping Information

• Package dimensions, weight estimates, tracking numbers, and carrier information associated with your listings.

Warehouse & Inventory Data (Pro Users)

• Storage zones, rack locations, SKU numbers, and inventory movement records for users on the Pro plan who utilize warehouse management features.

Usage Data

• Analytics events (e.g., feature clicks, page views), feature-usage metrics, and session identifiers used to understand how you interact with the Service.

Device Data

• IP address, browser user-agent string, device type, and cookie identifiers (including those set by Google, Meta and Microsoft — see Cookies & Tracking) collected automatically when you access the Service.

Communication Data

• AI chat conversations within the platform and buyer messages you send through the Service.

2. How We Use Your Information

• Provide, operate, and improve the Service, including AI-powered listing creation, market research, and optional photo clean-up (performed on our own servers, not by a third-party AI provider).
• Analyze your item photos using third-party artificial intelligence services to identify products, generate titles and descriptions, suggest pricing, and estimate shipping dimensions.
• Perform visual-search market research by sending item photos to third-party visual search services to find comparable sold listings and pricing data.
• Publish and manage listings on eBay and Etsy on your behalf using the marketplace credentials you provide.
• Process subscription payments and usage-based charges through Stripe.
• Send transactional emails such as account verification, password resets, sale notifications, and billing receipts via Resend.
• Analyze aggregated usage data to improve product features, performance, and reliability.
• Measure whether our ads on Meta (Facebook and Instagram) and Google lead to sign-ups and purchases (see Cookies & Tracking below).
• Provide customer support and respond to your inquiries.
• Detect, prevent, and address fraud, abuse, and security incidents.

We do not sell your personal data for money (but see Your Privacy Choices about ad tags). We do not use your photos or listing content to train AI models.

3. Information Sharing & Disclosure

We share information only as described below. We do not sell your personal data for money. Disclosing it to Meta and Google through their ad tags may be treated as a "sale" or "sharing" under California law, and you can opt out of both (see Your Privacy Choices below).

Service Providers

• OpenAI — Item photos and descriptions are sent to OpenAI's API for AI analysis (product identification, titles, descriptions, pricing). If you use the in-app support chat, your messages and a summary of your account (plan, credits, item counts, connection status) are sent to OpenAI so our assistant can answer. If you use the Chrome extension to fill a listing, the listing form's fields and, where Chrome allows, a screenshot of the visible form are sent to OpenAI to match your item to the right fields (see Chrome Extension below). OpenAI does not use data submitted through its API to train its models.
• SerpAPI — Item photos are sent to SerpAPI's visual-search service for market research, to find comparable listings and pricing data.
• eBay / Etsy — Listing data (titles, descriptions, photos, prices, item specifics) is published to these marketplaces on your behalf.
• Stripe — Payment and subscription information is processed by Stripe.
• AWS (Amazon S3) — Uploaded images are stored on Amazon S3 in the United States.
• Railway — Our application and database are hosted on Railway's infrastructure.
• Resend — Transactional emails (verification, password reset, notifications) are delivered through Resend.
• Google — Authentication services (if you use Google sign-in), Google Analytics for usage statistics, and the Google Ads tag to measure whether our Google ads lead to sign-ups and purchases.
• Meta (Facebook and Instagram) — The Meta Pixel on our website and, when you create an account, a server-side event containing a hashed (scrambled) copy of your email address, an internal account identifier, your IP address and browser details. Meta uses this to measure and improve the delivery of our ads and may use it to show you ads. You can opt out (see Your Privacy Choices below), and you can also manage ads at facebook.com/adpreferences or optout.aboutads.info.
• Microsoft Clarity — Records how visitors use our pages (clicks, scrolling and page layout) so we can find and fix confusing parts of the Service. Clarity is set to mask sensitive fields such as passwords and payment details. Microsoft processes this data under its own privacy statement (privacy.microsoft.com).
• Twilio — If you turn on text alerts, your mobile number and the text of each alert are sent to Twilio, which delivers the message.

Mobile information is not shared. We do not share, sell, or rent mobile phone numbers or text messaging opt-in data or consent with third parties or affiliates for marketing or promotional purposes. The categories of sharing above exclude text messaging originator opt-in data and consent; that information is not shared with any third party, except the messaging provider that delivers the texts you asked for.

Legal Requirements

We may disclose your information if required to do so by law, subpoena, or other legal process, or if we believe in good faith that disclosure is reasonably necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

4. Data Storage & Security

• Your data is stored in a PostgreSQL database hosted on Railway in the United States.
• Uploaded images are stored on AWS S3 in the United States.
• eBay and Etsy OAuth tokens are encrypted at rest using AES-256-GCM.
• Passwords are hashed with bcrypt using 12 salt rounds and are never stored in plain text.
• All data in transit is protected with HTTPS/TLS encryption.
• API endpoints are protected with rate limiting to prevent abuse.
• Account lockout is enforced after repeated failed login attempts.
• Session tokens are JWTs with version-based revocation, allowing immediate invalidation when needed.

While we implement commercially reasonable technical and organizational security measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security of your data.

In the event of a data breach affecting your personal information, we will notify you in accordance with applicable state and federal law, typically within 72 hours of discovering the breach.

5. Cookies & Tracking

• Session cookies — Used to maintain your authenticated session. These are essential for the Service to function.
• Google Analytics — Usage statistics such as page views, feature engagement, and session duration. This helps us improve the product.
• Meta Pixel and Google Ads tag — We advertise on Meta (Facebook and Instagram) and Google. These tags set cookies and tell those companies when a visitor who saw or clicked one of our ads views a page, signs up, or makes a purchase, so we can measure which ads work. Meta and Google may use this data to measure and improve ad delivery, may combine it with information they already have about you, and may use it to show you ads, under their own privacy policies. You can manage this at facebook.com/adpreferences, adssettings.google.com or optout.aboutads.info.
• Microsoft Clarity — Session recordings and heatmaps of how visitors use our pages, with sensitive fields such as passwords and payment details masked. Microsoft processes this data under its own privacy statement (privacy.microsoft.com).
• We do not show ads inside the Service and we do not sell your personal data for money.

Your Privacy Choices

You can opt out of the sale or sharing of your information with Meta, Google and Microsoft for advertising and session recording. When you opt out, our website stops loading the Meta Pixel and Microsoft Clarity in this browser, stops sending conversions to Google Ads, turns off Google's advertising features in Google Analytics, and we do not send Meta an event when you create an account. Google Analytics usage statistics continue. The choice is stored in a cookie, so make it again in each browser you use and after clearing cookies. If you have an account, you can also email [email protected] and we will apply the opt-out to your account.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out and apply the same choice automatically. Browsers' older "Do Not Track" setting has no common standard, so we do not respond to it; use the opt-out above or GPC instead.

6. Your Rights & Choices

• Access — You can view the personal data we hold about you at any time through your account dashboard.
• Correction — You can edit your profile information, item data, and listing details directly within the Service.
• Deletion — You may delete your account at any time. Deletion removes all personal data from our active systems (see Data Retention below for timing details).
• Email preferences — You can manage your notification settings from your dashboard to control which emails you receive.
• Marketplace disconnect — You can revoke eBay or Etsy access at any time from your account settings, which removes stored OAuth tokens.
• Data export — You may request an export of your account data in a portable format by contacting [email protected]. We will fulfill export requests within 30 days.

California Residents (CCPA)

California residents have the right to: (1) know what personal information we collect about them and how we use and share it, (2) request a copy or deletion of their personal information, (3) correct inaccurate information, and (4) opt out of the sale or sharing of their personal information. We do not sell personal information for money; to opt out of sharing for ad measurement, use Your Privacy Choices or turn on Global Privacy Control. We will not treat you differently for using these rights. For the other requests, contact [email protected].

7. Data Retention

• Active accounts — Your data is retained for as long as your account remains active and the Service is in use.
• Deleted accounts — Upon account deletion, personal data is removed from our active systems within 30 days. Data in encrypted backups is purged within 90 days.
• Published marketplace listings — Listings you published to eBay or Etsy remain on those platforms even after account deletion. You must remove marketplace listings separately through the respective platform.
• Analytics data — Aggregated and anonymized usage data may be retained indefinitely for product improvement purposes.
• Analytics and advertising data held by Google, Meta and Microsoft is kept under their own retention settings (for example, Google Analytics' configured retention period and Clarity's recording window).

8. Children's Privacy

The Service is not intended for users under 18 years of age. The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have collected personal information from a child under 13, we will delete that information promptly. If you believe a minor has provided us with personal data, please contact us at [email protected].

9. International Users

The Service is currently focused on the United States market. All data is processed and stored in the United States. If you access the Service from outside the United States, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

10. Chrome Extension

ListPrelo offers a Chrome browser extension that fills your listings on supported marketplaces. With your permission, it runs only on Poshmark, Mercari, Depop, Vinted, and Facebook Marketplace pages, and on listprelo.com. It works inside your own signed-in browser session and communicates with ListPrelo servers via authenticated API calls. On those marketplace pages it:

• Fills new listings: on a marketplace's create-listing page, it reads the form's fields (labels, placeholders and any values already entered) and, where Chrome allows, a screenshot of the visible form. These are sent to ListPrelo and our AI provider (OpenAI) to match your ListPrelo item to the right fields. It then fills the form and highlights the submit button. You review the listing and submit it yourself.
• Reports the result: after you submit, it reads the new listing's web address (URL) and tells ListPrelo whether the listing was posted, so your cross-listing status stays accurate. If a CAPTCHA, a login prompt or an account-warning message appears, it stops and reports that to ListPrelo.
• Keeps sold items in sync: it may open your own listings on Poshmark, Mercari, Depop and Vinted in a background tab to read their title and status (for example, active or sold), and it reads which listings show as sold when you view your own Poshmark closet. When you mark an item sold, or if you have turned on automatic ending of listings, it may take the matching listing off market on Mercari, Depop or Vinted using that site's own controls. It never deletes listings.
• Lookout (if you use it): it reads Facebook Marketplace search results for searches you set up (title, price, photo, location and link), and, after you click "Bought it", the listing's description, condition and photos.

The extension stores your ListPrelo sign-in token and pending jobs in your browser. It does not access your browsing history, saved passwords, or data from websites outside those marketplaces and listprelo.com.

11. Text Messages (SMS)

Prelo Want can text you when an item you asked it to find is listed for sale or back in stock. Texts are off unless you turn them on: you enter your US mobile number, tick a box agreeing to receive alerts, and confirm the number with a code we text you. Agreeing is not a condition of any purchase.

• What you receive: alerts about items you asked Prelo Want to find, and one-time verification codes. No marketing texts.
• How often: it varies with your wants; typically a few messages a month.
• Cost: message and data rates may apply, depending on your mobile plan.
• Opting out: reply STOP to any message, or turn texts off in Prelo Want. You will receive one confirmation and no further texts. Reply START to resume.
• Help: reply HELP, or email [email protected].
• Carriers are not liable for delayed or undelivered messages.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. If we make material changes, we will notify you by email at the address associated with your account or by placing a prominent notice within the Service prior to the change taking effect. Your continued use of the Service after the effective date of any updated policy constitutes your acceptance of the revised terms.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

[email protected]