Privacy

1. Scope

This Privacy Policy explains how Lystiva ("Lystiva", "we", "us") processes personal data when you visit the public site, create an account, use a workspace, upload product or artwork material, create Studio work, connect a store, share a review link, prepare exports, or buy a plan. Lystiva is responsible for this processing.

Lystiva is workspace-scoped. The server checks the authenticated identity and workspace membership before protected data is read or changed. Client-supplied IDs are selectors, not permission to access another workspace.

2. Account and authentication data

For an account, Lystiva processes information such as your email address, display name, authentication identity, password credential data, email-verification state, sessions, and security or rate-limit records needed to sign you in, verify your email, recover access, and protect the service. If you continue with Google, we receive your name, email address, and Google account identifier from Google.

The application keeps its account and workspace identity linked to the Better Auth identity that authenticated the request. Authentication secrets and session authority remain server-side; they are not exposed as durable client data.

3. Workspace and product data

When you use Lystiva, the service can process workspace membership and lifecycle state, canonical Sources, uploaded product or artwork files, file checksums and evidence roles, seller-confirmed facts and review decisions, targeted evidence requests, Visual Jobs, generation plans and prompts, reusable Person, Scene, Look, or Brand revisions, generated image versions, reviews, listing copy, Listing Intents, destination exports, and related activity or audit records.

Private uploaded and generated bytes are stored through the application's private binary-object and R2 storage boundary. Raw object keys, provider URLs, and signed delivery URLs are not treated as client authority. Signed reads are short-lived and each file sink rechecks the live workspace and parent lineage.

Lystiva does not treat an AI proposal as a seller-confirmed fact. Source analysis, generation planning, image generation, reviews, and listing copy preserve the state needed to show what was proposed, accepted, rejected, or still needs attention.

4. Billing and destination export data

If you subscribe, buy a top-up, or use credits, the service processes application billing and credit state such as plan, credit grants, reservations, consumption, payment-provider customer or subscription identifiers, orders, refunds, webhook events, and reconciliation records. Creem is the configured billing provider; payment credentials are handled by the payment flow rather than stored as raw card data in the application.

Destination exports contain the reviewed Source-owned assets and listing copy you choose to prepare. Export artifacts remain workspace-scoped until you download them; you decide whether and where to upload them.

5. Connected stores and client review links

If you connect a WooCommerce store or an Etsy shop, Lystiva stores the connection's access credentials encrypted on the server, imported catalogue snapshots (titles, descriptions, attributes, prices, and listing photos), and a history of the listing changes you send. Credentials are never sent to your browser. Disconnecting stops Lystiva from using them; revoke the authorization in your store to remove it completely.

If you create a client review link, the people you share it with can view the selected images. Lystiva stores the display name, comments, and decisions they submit. The private link token is kept in the URL fragment, which is not sent to our servers in page requests or included in analytics.

6. AI and service providers

Lystiva uses service providers to operate specific features. Our hosting provider runs the web application. Convex hosts durable application state and backend functions. Cloudflare R2 stores private Source, Studio, and export bytes. Resend sends authentication email and manages the marketing contact list. Creem is our Merchant of Record and processes checkout, payment, tax, invoices, and refunds. Google provides optional sign-in. WooCommerce and Etsy receive the listing changes you send to a connected store. PostHog processes optional usage analytics and sanitized browser error reports when you permit them.

OpenRouter and the configured underlying text or vision model receive the bounded data needed for Source analysis, generation planning, or listing copy when you request those features. fal receives the authorized image inputs and prompts needed for new generation through the GPT Image 2.5 Sunburst Edit transport. Pre-cutover requests retain their original provider identity for lookup-only recovery. Provider retention and handling are also governed by the provider terms and configuration in effect for the request; do not upload material you are not permitted to send to a provider.

We configure providers to limit data collection and retention where they offer that option, but each independent provider may also have its own retention or legal obligations. We do not sell your personal data, and we do not use your uploaded or generated content to train our own AI models.

Some providers process data outside your country, including in the United States and the European Union. Where required, these transfers rely on the providers' standard contractual clauses or equivalent safeguards.

7. Optional analytics and browser error reporting

Necessary authentication and application behavior can use cookies, including the session required to keep you signed in. Cookie preferences lets you independently allow Usage analytics and Error reporting, or choose Accept all or Reject optional in the notice. Necessary technologies are always on. We store your choices in browser local storage for 30 days. The PostHog client starts only when at least one optional category is allowed. A missing or expired choice, rejection of both categories, or unavailable browser storage prevents new optional collection. Development runtimes and local browser hosts, including local production-build previews, do not initialize the client, collect attribution, or show the consent controls. Hosted staging and production use the same preference gates.

If you allow Usage analytics, we send selected page, usage, performance, and conversion events, such as Source upload, generation requests, export actions, and billing actions. These use bounded categories, counts, and values, not product content. This choice does not enable error reporting. A pseudonymous internal account identifier can connect signed-in activity. We do not create analytics profiles using your email address or name. The SDK uses in-memory analytics persistence rather than persistent analytics cookies.

If you allow Error reporting, browser error reports help us diagnose failures. This choice does not enable pageviews, usage or performance events, or attribution. A pseudonymous internal account identifier can connect signed-in errors for diagnosis. Reports contain a standard error category and, when available, compiled application code locations and line numbers. Raw error messages, source-code context, request or response bodies, prompts, product facts, uploaded or generated images, authentication credentials, and signed file URLs are excluded. Session Replay, automatic click tracking, and console-log forwarding are disabled. The client disables IP-based enrichment; sending a network request still exposes connection information to the receiving service.

Only when Usage analytics is allowed, Lystiva can also send the public landing path, selected UTM values, and the origin of the referrer to its attribution endpoint. The PostHog client filters automatically attached URL, referrer, and person properties before capture. The integration defaults to PostHog's EU ingestion host; the actual project region and provider retention depend on deployment configuration.

When you later sign in and open the workspace, an allowed public landing path can be associated with a pseudonymous workspace-opened milestone. This is not a signup-completed event and does not include the landing URL's query or hash, email address, product facts, or signed storage values.

Use Cookie preferences on this page to reopen the preference dialog, change either optional category, and Save preferences. Closing the dialog without saving leaves your choice unchanged. A previous refusal remains respected until it expires or you change it. Older bundled approvals require a fresh granular choice and never silently enable either category. Changes in another tab and expiry stop newly disallowed collection. Withdrawal does not recall requests already sent or automatically erase events already received by PostHog.

9. Marketing and transactional email

Verification and password-reset emails are transactional messages needed for account access. They are sent through published Resend templates and are separate from marketing subscriptions.

Email and password signup has an optional marketing checkbox. If you select it, Lystiva adds the signup email address to Resend Contacts, which is shown as Audience in Resend, so Lystiva can send product updates and practical seller tips through Broadcasts. Leaving it unchecked does not subscribe you through the email signup path.

Continuing with Google creates an account if one does not exist, whether you start from Sign in or Create account. The Google button includes a notice that new accounts receive product updates and seller tips by email. New Google accounts are added to Resend Contacts automatically. Existing account preferences and prior Resend unsubscribe choices are preserved.

Resend maintains the marketing unsubscribe state. Every marketing Broadcast must include Resend's unsubscribe link or footer. Unsubscribing from marketing does not stop necessary transactional authentication emails.

10. How Lystiva uses data

Lystiva uses the data described above to authenticate accounts, scope workspaces, store and retrieve requested content, analyze accepted Source inputs, prepare and generate requested outputs, create listing copy and exports, send the store changes you approve, process billing and credits, prevent abuse, troubleshoot failures, reconcile uncertain provider outcomes, and maintain security and audit records.

We process this data to provide the service you signed up for (performance of a contract), to keep the service secure and prevent abuse (legitimate interests), to meet billing, tax, and other legal obligations, and, for optional analytics, error reporting, and marketing email, on the basis of your consent, which you can withdraw at any time.

Seller content is not made public by default. Export preparation creates a private workspace file; downloading it does not publish it. Content becomes visible to others only when you share a review link or send a listing to a connected store, and that destination then applies its own privacy rules.

11. Security

Lystiva enforces workspace scope and parent ownership on the server, keeps provider keys, storage keys, and signed URL authority server-side, stores new binary content through private R2, and bounds uploads, provider responses, and exports.

No internet service can promise that every transmission or system will always be secure. You are responsible for using a unique password, protecting your browser session, and not uploading content that you cannot lawfully or safely submit for processing.

12. Retention and deletion

Lystiva retains account, workspace, content, billing, security, and external-operation records for as long as they are needed to operate the service, resolve provider outcomes, protect users, meet financial or audit obligations, or complete the lifecycle rules that apply to the record. The application does not currently promise one universal retention period for every data category.

Prepared export files expire seven days after they are created. The 30-day cookie preference period is not a promise that analytics events are deleted after 30 days; hosted event retention is controlled by the PostHog project settings.

You can delete your account in Settings. Access to your account and the workspace you own stops immediately, and you can restore everything by signing in within 14 days. After that we delete your workspace, uploads, generated content, store connections, and sign-in identity, and anonymize your account record. Pseudonymous billing and credit records (provider references, amounts, and dates) are kept for 180 days so late refunds or chargebacks can be reconciled, then deleted; Creem, our merchant of record, keeps invoices for the period the law requires. A digest of your email address is kept so the welcome credit isn't granted twice.

Archived or removed content can remain in immutable audit, billing, reconciliation, or lifecycle records when removing it would make a financial or external-operation record unreliable. Consent-bound generation-report context is redacted from its report row after terminal delivery and is deleted with its workspace/Source/Job lifecycle. Eligible private bytes are removed only after the service proves that no authorized reference still requires them.

13. Your rights and choices

You can change optional analytics and browser error-reporting permission independently through Cookie preferences on this page, choose whether to join marketing email during email and password signup, unsubscribe from Resend Broadcasts including after Google signup, review or correct seller-owned Source facts in the product, and use the available workspace export and lifecycle controls.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To make a request, email support@lystiva.com from your account email address. We may need to verify your identity, and we aim to respond within 30 days. You can also complain to your local data-protection authority.

Lystiva is not intended for children under 18, and we do not knowingly collect their personal data.

14. Changes and contact

We will update this policy when the product's data flows or providers materially change. The effective date at the top of this page shows when it last changed. If a change is material, we will notify account holders by email or in the product.

Questions about privacy or this policy: support@lystiva.com.