for WooCommerce & ShopifyPrivacy Policy
Who is responsible
The data controller for the Service is REXOH LLC, 5830 E 2nd St, Ste 7000 #30559, Casper, WY 82609, United States. Privacy questions: support@selflist.io.
What we store, and why
- Your account: name, e-mail, a hashed password, your plan, the time of your last sign-in, your acceptance of the Terms. To run your account.
- Your team: the name, e-mail and level of each team member you invite, and which actions each one took. So that you can see who did what.
- Your store connections: your store's address, the credentials you approved (encrypted), and the store details your store reports (such as its name and currency). To create and update products in your store.
- Your products: supplier product data (titles, images, variants, prices, stock), the products we create in your store, price and stock history, and every change we make (the activity log). To import, publish and monitor.
- Customer reviews, only if you switch them on: the review text, star rating and date the extension read on the supplier's page, with the reviewer's name masked (first and last letter only). No reviewer pictures or review photos are kept.
- Your API token: only its hash and the last four characters, plus when a device last used it. A one-time pairing code is stored only as a keyed hash, for ten minutes.
- The Chrome extension, only when you press its button: it reads the product page you are on — its address, title, pictures, options, prices, the postage it shows and, if you switched reviews on, the public reviews with the reviewers' names masked in your browser — and sends that only to your SelfList account at app.selflist.io. On your computer it keeps only its connection token and your account's name. It does not read other pages, your browsing history or what you type, and nothing runs until you press its button or start a Browser Check.
- Telegram, only if you link it: your Telegram chat ID and the links and messages you send to our bot. To import and list the products you ask for.
- Your own AI key, if you gave one: encrypted; used only for your requests.
- Payments, if you pay for a plan: your plan, the customer and subscription numbers Stripe gives, and your subscription's status and dates. Your card is entered on Stripe's own page and goes only to Stripe; we never receive it.
- Technical logs: request timing and status codes without payloads, kept up to 60 entries per service; sign-in attempts per IP for one hour, to slow down attacks.
- Orders, only if you switch them on (Business plan and up): for each paid order of your store, its number, items, total, country and city, whether it has a phone number, the AliExpress order number and the tracking number. Your buyer's name, address and phone are read from your store at the moment the order is placed and sent to your own AliExpress account to deliver it; we do not keep them. Order rows are deleted a year after they end.
- Your AliExpress connection, if you made one: the access tokens AliExpress gave (encrypted) and the account name it reported. Used only to place and follow your orders; deleted when you disconnect.
- Affiliate partners, if you join: your link name, how we pay you (a PayPal e-mail; bank details only by e-mail, never stored here), the clicks on your link counted per day (no visitor's address is kept), the accounts that signed up through it and their commissions and payments. To run the programme and pay you.
We use your buyers' data only on your behalf, to fulfil your orders.
Where it goes
Product data is sent to your stores to create and update products, and to AI providers to write titles and descriptions. When you pay for a plan, your e-mail, your name and our account number for you go to Stripe, our payment provider; your card, billing address and tax ID, if you give them, are entered on Stripe's own pages. Stripe processes them under its own privacy policy. Messages you send to our Telegram bot pass through Telegram. If you use Orders, the order's items and your buyer's delivery address go to your own AliExpress account, and a note with the tracking number goes to the order in your store. We do not sell data and do not use it for advertising. The Service is hosted by Hostinger. If you created your account through a partner's link, that partner sees that an account signed up and paid, with its e-mail masked (for example a***@g***.com) and its plan — never your details.
Cookies
A sign-in cookie, and — only while you connect your AliExpress account — a ten-minute cookie that ties AliExpress's approval to your browser. No tracking cookies. The payment pages are Stripe's own pages (checkout.stripe.com, billing.stripe.com) and use Stripe's cookies under Stripe's policy. If you arrive through a partner's link, a cookie (slf_via) remembers that partner for 60 days so that the partner is credited if you create an account.
Your rights
Export or delete everything by e-mailing support@selflist.io from your account address; done within 30 days, usually the same day. Disconnecting a store deletes our copy of its credentials immediately. You can complain to your data-protection authority.
Contact
REXOH LLC
5830 E 2nd St, Ste 7000 #30559
Casper, WY 82609
United States
E-mail: support@selflist.io