Privacy Policy

The short version

• We collect what we need to run Alura: your account details, the Etsy shop data you connect, what you create in the app, and how you use it.
• We don't sell your personal data for money.
• We use service providers to host data, take payments, send email, run AI features and support you. Most of them process data in the United States.
• AI features send the content they need to AI providers. How long each provider keeps it depends on the provider and the feature, as explained below.
• On our website, outside the EEA, UK and Switzerland, analytics and advertising cookies are on until you turn them off. Inside, they stay off until you allow them.
• You can access, correct, export or delete your data. Email hello@alura.io.

What we collect

Your account

• Name, email address and profile photo, from the sign-up method you choose: Google, Etsy, or a sign-in link sent by email. Alura doesn't use passwords.
• Your workspace: its name and logo, the people you invite (their email address, name and role) and their permissions.
• Your answers during onboarding, such as your goals, whether you already sell, how you heard about us, and your country, time zone and language.
• Your plan, trial and subscription status.

You need an email address to create an account, and a connected Etsy shop to use shop features. Everything else is optional, but features that rely on it won't work without it.

Your Etsy shop

When you connect a shop, Etsy asks you to grant Alura access to it. We ask for permission to read and update your shop, listings, orders and transactions, to read your billing, reviews, profile, addresses and email address, and to delete listings when you ask us to. We then copy and keep up to date:

• your shop profile, policies, listings, photos, videos, shipping and return settings;
• your orders, payments, refunds, fees and shop financials;
• your buyers' details from those orders: name, email address, payment email address, shipping address, messages and gift messages sent with the order, tracking numbers, and reviews.

You can also sign in with Etsy. Then we only ask for your email address, profile and shop.

The Chrome extension

The extension adds Alura to etsy.com. It can:

• read the listings, search results and order pages you open on Etsy, and send the relevant listing IDs, search terms and listing details to Alura when you open the Alura panel or use a feature that needs them;
• carry out the Etsy tasks you use or schedule in Alura, such as follow-up messages, replying to buyer messages and reviews, managing orders, refunds and shipping labels, managing Etsy Ads, sales and coupons, and reading shop stats. Scheduled tasks only run while Chrome is open with the extension installed. The extension only accepts these requests from alura.io.

Buyer conversations you open in Alura are stored in Alura and, if you use AI replies, sent to an AI provider (see "AI features"). The extension also keeps your settings and imported research data in your browser.

The extension checks your Etsy cookies to notice when you switch Etsy accounts. It keeps that check on your device and doesn't send your Etsy cookies to us. It has no analytics or ad tracking.

Other connections

• Pinterest: if you connect it, your Pinterest profile, boards, pins, scheduled pins, pin analytics, and the ad and audience data Pinterest shows you.
• Slack and webhooks: if you set up an automation that posts to Slack or another web address, we send the data you choose to that destination.

What you create in Alura

Listing drafts, AI chats and their history, short notes the AI assistant saves to remember your preferences, images and videos you upload or generate, A/B tests, tasks, automations, email campaigns, notes, and feedback you send us.

Payments

Our payment provider, Stripe, takes your card details on its own secure page. We never see or store your full card number. We keep Stripe's customer and subscription IDs and the billing events Stripe sends us, such as payments, renewals and cancellations. If you cancel, Churnkey runs the cancellation flow and records your reason.

How you use Alura

• Pages you visit and features you use, with your IP address, browser, operating system and screen size.
• Logs of requests and errors. When the app hits an error, our error tracker, Sentry, records it with your user ID, email address and IP address. For a small share of errors it also records a replay of the screen leading up to it, with text and images hidden.
• How you found us: the ad, link or campaign you came from (for example UTM tags and ad click IDs), and whether a partner referred you.

Visiting our website

• Cookies and similar technologies, described in "Cookies".
• What you send through our forms: your name, email address and message on the contact form, and your answers on the extension uninstall form. These go to our support tool, Intercom. We use your IP address to limit how many forms can be sent.
• What you type into our free tools, such as shop names or listing details. We send it to an AI provider to produce the result and use your IP address to limit how often each tool can be used.

Public data about Etsy shops

To power research features, we collect public data about Etsy shops and listings through Etsy's API. This includes shop names, seller display names and photos, listing details, prices and reviews. Our systems also store email addresses that appear in shop text returned by Etsy's API, such as announcements, policies and sale messages. We don't use these addresses to contact anyone. If you run an Etsy shop and want your data removed from Alura, email hello@alura.io.

Customer stories

We sometimes invite sellers to be featured in a customer story. To decide whom to invite, we may prepare a private draft from your public Etsy shop and how you use Alura. We only publish a story with your approval. We use your name, shop, photos, quotes and results, and keep your review notes with the story. If you say no or ask us to remove it, we delete the draft and your notes.

From other people

A teammate who invites you gives us your email address. A friend who refers you gives us your email address. If an affiliate partner referred you, Rewardful tells us which partner, and we share your email address and subscription payments with Rewardful so the partner can be credited and paid.

How we use it and why

Data protection law requires a legal basis for each use. This table covers the uses where we are the controller. When we handle your customers' data on your behalf, we follow your instructions instead (see "Your customers' data").

We don't make decisions about you that have legal or similarly significant effects based only on automated processing.

Your customers' data

When you connect a shop, Alura stores your buyers' order details and messages, and you can build an email list of subscribers. For this data:

• you are the controller and we are your processor. We only use it to provide Alura to you, and we don't use your buyers' data to market Alura;
• you are responsible for having a valid reason to use it, and for following Etsy's rules and the law. For example, only add people to your email list who agreed to hear from you. Etsy doesn't allow adding buyers to a marketing list without their consent;
• follow-up and review request messages are sent as Etsy messages from your own shop, through the Chrome extension;
• marketing emails you send through Alura go out from your own domain through our email provider, Resend. We send Resend your subscribers' details and the email content, and keep your subscriber list in sync with Resend. Resend tells us when an email is delivered, bounces, is marked as spam or leads to an unsubscribe, and, if tracking is on for your domain, when it is opened or clicked. Every campaign email has an unsubscribe link;
• if a buyer or subscriber asks us about their data, we will pass the request to you.

If you need a signed data processing agreement, email hello@alura.io.

AI features

Alura's AI features send the content needed for each task to an AI provider: OpenAI, Anthropic, Google, or Perplexity for web search. Depending on the feature, that can be your listings, photos, buyer messages and reviews, your chat messages, or a voice note you dictate.

Most AI features go through Vercel's AI Gateway, which we set to use only providers that don't train on our requests. For OpenAI requests sent that way, we also turn off response storage. Some features, such as voice notes and some listing and Pinterest tools, call the providers directly without these settings. There the provider's standard business terms apply: they don't train on this data, but they may keep it for a limited time, usually up to 30 days, for example to check for abuse.

AI output can be wrong. Check it before you publish it to your shop or send it to a buyer.

We don't train our own AI models on your content.

Who we share it with

We don't sell your personal data for money. We share it only in these cases.

Service providers

We use these providers to run Alura. When they act as our processors, they handle personal data only under our instructions and data processing terms. Some, such as Stripe, also process certain data for their own legal and business purposes. Most of them process data in the United States.

Advertising partners

To learn which ads bring us customers, we tell Google and Meta (Facebook and Instagram) when you sign up and when your subscription starts, renews, changes, fails to renew or ends, with its value. We send ad click IDs, Meta browser IDs, an event ID and a hashed version of your email address, never the address itself. A hashed address can still be matched to you, so we treat it as personal data.

We do this only if marketing was allowed when you came to the app from our website. In the EEA, the UK and Switzerland that means you allowed marketing cookies. Elsewhere it means you didn't turn them off and your browser didn't send a Global Privacy Control signal. To stop it for your account later, email hello@alura.io. Google and Meta use the data under their own terms and privacy policies.

Etsy, Pinterest and the tools you connect

When you take an action in Alura that changes your Etsy shop or Pinterest account, such as publishing a listing or sending a message, we send the data needed to do it. Their privacy policies apply to what they receive.

Your team

People in your workspace can see the workspace's data according to the roles and permissions its owner sets.

Other cases

We may share data if the law requires it, to protect the rights, safety or property of Alura, our users or others, or as part of a merger, sale or reorganization of our business. A buyer must respect the protections that apply to your data. Before we transfer data collected through the Chrome extension in such a deal, we will ask for your consent.

Cookies

This section covers cookies and similar technologies on our website, www.alura.io. Cookies are small bits of text data placed on your device when you visit sites. They record data about your activity, such as which pages you view and what you click on, and help our website recognize your device when you return. We also use similar technologies, such as tracking pixels and local storage, and treat them the same way.

Here are the cookies we use and why:

Your choices. If you visit from the European Economic Area, the United Kingdom or Switzerland, analytics, advertising and affiliate cookies stay off until you allow them in the cookie banner. Elsewhere they are on by default, except that advertising and affiliate cookies stay off if your browser sends a Global Privacy Control signal. Wherever you are, Cookie settings at the bottom of every page lets you turn analytics (Google Analytics) and marketing (Google Ads, Meta and Rewardful) on or off separately, at any time. Turning a category off stops it from then on.

We use Google Consent Mode. Until you accept, or after you reject, Google's tags do not set or read analytics or advertising cookies and send only basic measurement signals without them.

When you arrive from an ad or a partner link, we keep the campaign details in your browser for the visit and pass them to the app when you sign up, so we know where our customers come from.

In the app. platform.alura.io uses essential cookies to keep you signed in (up to 90 days) and to remember your language. Its sign-up and sign-in pages load Rewardful so a referral partner can be credited. Intercom loads when you open support chat. The app keeps your campaign details in your browser for up to 30 days so we can link them to your sign-up.

You can also block or delete cookies in your browser's Help or Settings menu. Blocking essential cookies may limit your use of the website or affect how it works.

International transfers

We are in Norway, but most of our service providers process data in other countries, mainly the United States. When personal data from the EEA, UK or Switzerland goes to a country without an adequacy decision, we use an approved safeguard: the EU-US Data Privacy Framework (and its UK and Swiss versions) where the recipient is certified, or the European Commission's Standard Contractual Clauses with the UK and Swiss adjustments where they apply. Email us for details.

How long we keep it

• Account, shop and content data: while your account is open.
• AI chat history: until you delete the chat. Deleting your account doesn't delete saved chats automatically, so email us and we'll delete them too.
• Billing records: five years after the end of the financial year, as Norwegian accounting law requires.
• Support conversations: as long as we need them to help you and keep track of past requests.
• Abuse signals: 30 days.
• Usage events and logs in our own systems, including IP addresses: while your account is open, unless you ask us to delete them. Error reports at Sentry and logs at Google Cloud: for the retention period set with each provider.

Deleting your account

You can delete your account in Settings, under Profile. That deletes your profile, the workspaces only you own, your Etsy connection and your AI usage history, and cancels your subscription. If other people are active in a workspace you own, hand it over or remove them first. Content you created in a workspace someone else owns stays in that workspace.

Some data is not removed automatically: your shops' synced orders, buyer details and messages, your email subscribers, your AI chats, usage logs and ad attribution records, your customer record at Stripe, and copies held by our providers. Email hello@alura.io to have that deleted too. Within 30 days we will delete what we no longer need from our systems and ask our providers to delete their copies, and tell you about anything we must keep, why, and for how long.

Disconnecting a shop

Disconnecting a shop removes it from your workspace. To also revoke Alura's access at Etsy, remove Alura from the apps connected to your Etsy account. To delete the data we already copied, email us.

Security

We protect your data with:

• encrypted connections (HTTPS) to our website and app;
• signed, secure sign-in cookies;
• workspace roles and permissions that limit who sees what;
• encryption at rest by our hosting provider, and extra encryption for the secrets you give automations;
• access to production data only for staff who need it for their work.

No system is completely secure. If a breach puts your personal data at risk, we will tell you, the authorities, and Etsy where its data is involved, as the law and Etsy's terms require.

Your rights

Subject to the conditions and exceptions in the law that applies to you, you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or object to how we use it, including at any time for direct marketing;
• give you your data in a portable format;
• withdraw your consent, where we rely on it. This doesn't affect what we did before you withdrew it.

Email hello@alura.io. You don't need an Alura account, but if you have one, writing from its email address helps us find your data. We'll reply within one month and may need to confirm who you are first. If we turn down a request, we'll explain why. If you think we've handled your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet (https://www.datatilsynet.no), or the authority where you live.

US privacy rights

Depending on where you live, you can ask to know what personal data we hold about you, to correct or delete it, and to opt out of its sale, sharing or use for targeted advertising. We don't sell personal data for money. Our advertising cookies, and the sign-up and subscription events we send to Google and Meta, may count as "sharing" or a "sale" for targeted advertising under some US state laws, including California's. To opt out, turn off marketing in Cookie settings at the bottom of any page and email hello@alura.io, so we also stop sending your account's events. If your browser sends a Global Privacy Control signal, we treat it as turning off marketing on our website. We don't respond to Do Not Track signals. If we turn down your request, you can appeal by replying to our answer, and we'll respond within 60 days. We won't treat you differently for using your privacy rights.

Children

Alura is a business tool for Etsy sellers and is not meant for children. Our Terms of Service set who can use Alura. We don't knowingly collect data from children under 14. If you believe a child has given us personal data, email hello@alura.io and we'll delete it.

Links to other sites

Our website and app link to other sites, such as Etsy and Pinterest. Their own privacy policies apply when you visit them.

Etsy, Chrome and Google

The term "Etsy" is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

Our use of information received through the Alura Chrome extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements. We use it only to provide and improve the features you use, and for security and legal purposes. We don't sell it, use it for advertising, or use it to decide creditworthiness.

Alura's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

We update this policy when our product or the law changes, and show the date it took effect at the top. If a change is significant, we'll tell you by email or in the app before it applies.

Contact us

Pixell AS, Solheimgata 1A, 0267 Oslo, Norway
Email: hello@alura.io