Privacy Policy

The data controller for the purposes of the GDPR is: TagRocket, operated by an individual based in Romania. Contact: hello@tagrocket.io

Account information: You sign in with Google — we receive your email address and name from Google to create your account. We never receive your Google password.

Payment information: When you buy a credit pack, payment is processed by LemonSqueezy (our merchant of record). We receive your email address and order details — we never see your card number, CVV, or full payment details.

Beta invite codes: If you access the Service via an invite code, we store the code and usage count to enforce usage limits.

Form input data: When you generate a listing, we temporarily process the product details you enter (name, material, features, etc.) to generate content. This data is sent to Anthropic's Claude API for AI processing.

Generation logs: We store a log of each generation — including your input, the generated output, and any feedback you provide — to monitor service quality and diagnose issues. Logs are stored in our Redis database.

Feedback: If you submit a thumbs up/down rating or text feedback, we store this linked to the generation log.

Usage analytics: We record anonymous, aggregated usage events (for example, when the free checker is used, when a listing is generated, or where a form is left unfinished) to understand and improve the product. These events contain no personal information, are not linked to your identity, and set no cookies.

We process your personal data only where we have a lawful basis to do so under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)): Account information, payment records, credit balances, and generation logs — necessary to provide the Service you have requested.
• Legitimate interests (Art. 6(1)(f)): Service quality monitoring, bug diagnosis, and anonymous usage analytics — we have a legitimate interest in improving the Service, and these activities do not override your privacy rights.
• Legal obligation (Art. 6(1)(c)): Financial and subscription records retained for 7 years to comply with applicable accounting and tax law.

• To provide and improve the Service
• To process credit-pack purchases via LemonSqueezy
• To enforce usage limits on beta and paid plans
• To monitor service quality and generation accuracy
• To diagnose and fix bugs
• To contact you about your account (purchase receipts, policy changes)

We do not sell your data. We do not use your listing inputs to train AI models. Your product details are processed transiently by Anthropic's API to generate your listing and are not retained by Anthropic for training purposes (per their API data usage policy).

Some of our service providers are based outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards, to ensure your data is protected.

LemonSqueezy — Our merchant of record; handles all payment processing for credit packs. Based in the US (SCCs apply). We receive only your email and order details.

Google — Used for sign-in (OAuth). We receive your email address and name. Subject to Google's Privacy Policy.

Etsy — When you use the listing Makeover, we fetch public listing data from the Etsy API for the URL you provide. Subject to Etsy's API terms.

Resend — Sends transactional emails on our behalf. Based in the US (SCCs apply).

Anthropic (Claude API) — Processes your listing input to generate content. Based in the US (SCCs apply). Anthropic does not retain API inputs for model training per their data usage policy.

Upstash Redis — Stores session data, beta tokens, subscription records, and generation logs in encrypted form. May process data in the US (SCCs apply).

Vercel — Hosts the Service. Server request logs may be retained by Vercel for up to 30 days. May process data in the US (SCCs apply).

We use a single session cookie (tr_session) to keep you logged in. This cookie contains a time-limited token that identifies your session type (beta or subscriber). It does not contain personal information and expires after 30 days.

We do not use advertising cookies or third-party analytics services. Our usage analytics (described above) are first-party, cookieless, and anonymous.

Generation logs are retained for up to 12 months for quality monitoring purposes. Beta token data is retained until the beta programme concludes. Subscription records are retained for 7 years for financial compliance purposes.

You may request deletion of your generation logs by contacting us at hello@tagrocket.io.

We use HTTPS for all data transmission. Session cookies are set as httpOnly and Secure. Database credentials and API keys are stored as environment variables and never exposed client-side.

No security system is perfect. In the event of a breach that affects your personal data, we will notify you within 72 hours of discovery, as required by the GDPR.

Under the GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, email us at hello@tagrocket.io. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — www.dataprotection.ro. If you are based in another EU/EEA member state, you may contact your local data protection authority.

The Service is not directed at children under 18. We do not knowingly collect data from anyone under 18.

We may update this Privacy Policy. We will notify active subscribers by email before material changes take effect. The "Last updated" date at the top reflects the most recent revision.

For privacy questions or data requests: hello@tagrocket.io