Privacy Policy

ListingSet is an AI-powered product image generation platform that enables e-commerce sellers to create professional listing images for online marketplaces. The Service is operated by ListingSet, a company based in Israel.

For all privacy-related matters, you can contact our data team at: support@listingset.io

When this policy refers to "personal data" or "personal information", we mean any information that identifies or could reasonably identify you as an individual, directly or indirectly.

We collect information in several ways: information you provide directly to us, information collected automatically as you use the Service, and information received from third parties.

2.1 Information You Provide Directly

• Account information: You may create an account using Google Sign-In or by registering with an email address and password. When using Google Sign-In, we receive your full name, email address, and profile picture from the authentication provider. When registering with email and password, we collect your email address and store a cryptographic hash of your password — we never store your password in plain text.
• Product images you upload: When you create an image set, you upload product photos. These are temporarily processed and stored to enable image generation.
• Support communications: If you contact us via support@listingset.io, we retain your messages and email address to respond to your inquiry and improve our service.
• Affiliate application: If you apply to our affiliate program, we collect your full name, email, country of residence, website URL, and payment details (PayPal email or Payoneer email) for commission payouts. We also store a reference to the affiliate who referred each user, to enable commission tracking.
• Cancellation feedback: If you cancel your subscription, we ask for a reason. This information is used solely to improve the Service.

2.2 Information Collected Automatically

• Usage data: We log actions you take within the Service — such as image sets created, platforms selected, styles chosen, credits consumed, and features accessed — along with timestamps.
• Device and browser information: Our hosting infrastructure automatically collects information such as IP address, browser type, operating system, referring URL, and pages visited. This data is used for security, performance monitoring, and anonymized analytics.
• Session data: We use session cookies to keep you logged in and maintain your authenticated state across pages. See Section 5 and our Cookie Policy for details.
• Referral tracking: If you arrive at ListingSet via a referral link (invite=CODE), an affiliate link (ref=CODE), or a salesperson link (sales=CODE), a cookie stores the relevant code for up to 30 days so we can correctly attribute the referral and award bonus credits or commissions. Upon signup, the referring user's ID is stored on your account to enable credit rewards.

2.3 Information From Third Parties

• Third-party sign-in providers: If you choose to sign in using a third-party authentication provider, we receive the profile information that provider shares with us — typically your name and email address. We do not receive your password or access to other services associated with that account.
• Payment providers: When you pay, our payment provider handles your card details directly. We receive only a transaction reference ID or subscription ID — never your raw card number, CVV, or full billing address.

We use the information we collect for the following purposes:

• Providing the Service: Processing your uploaded images, generating AI product images, maintaining your project history, and delivering generated image files to you.
• Account management: Creating and managing your account, authenticating you when you log in, and tracking your credit balance and subscription status.
• Billing and payments: Processing subscription payments, managing credit purchases, issuing refunds where applicable, and maintaining billing records as required by law.
• Communication: Sending transactional emails related to your account (e.g., subscription confirmations, payment receipts, security alerts). We do not send marketing emails without your explicit consent.
• Customer support: Responding to your support requests, resolving disputes, and troubleshooting technical issues.
• Service improvement: Analyzing usage patterns, identifying bugs, understanding which features are most valuable, and developing new features and improvements.
• Security and fraud prevention: Monitoring for suspicious activity, enforcing rate limits, protecting against unauthorized access, and maintaining the integrity of the Service.
• Legal compliance: Meeting our obligations under applicable law, including Israeli law, GDPR (where applicable), and tax regulations.
• Referral program: Tracking user-to-user referrals via cookies and stored referral codes, and awarding 200 bonus credits to both parties when a referred user subscribes to a paid plan.
• Affiliate management: Tracking affiliate referrals via cookies and stored affiliate codes, calculating commissions on qualifying purchases and renewals (up to 12 consecutive months per referred customer), and processing affiliate payments via PayPal or Payoneer.

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the Service you have signed up for, including image generation, billing, and account management.
• Legitimate interests (Art. 6(1)(f)): Processing for purposes such as security monitoring, fraud prevention, service improvement, and understanding user behavior — provided these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, such as tax and financial record-keeping obligations.
• Consent (Art. 6(1)(a)): Where we rely on consent (e.g., non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

We use cookies and similar technologies to operate the Service. Please see our Cookie Policy for a full breakdown of every cookie we use, its purpose, and its duration. In summary:

• Essential cookies are required for authentication and security. The Service cannot function without them.
• Functional cookies remember your preferences and affiliate referrals.
• Analytics cookies collect anonymized data about page views and traffic to help us improve the Service. No personally identifiable information is shared.

You can manage cookie preferences via our cookie consent banner or your browser settings.

We do not sell your personal data. We do not rent, trade, or share your personal information with third parties for their own marketing purposes. We share your data only in the following limited circumstances:

6.1 Service Providers

We share data with trusted third-party service providers who process data on our behalf solely to deliver the Service. These include providers in the following categories:

• Authentication providers: Enable secure account creation and sign-in. Depending on the sign-in method you choose, relevant authentication data (such as your name and email address) may be processed by the relevant provider in accordance with their own data policies.
• Cloud infrastructure, database, and storage providers: Host the application and store your account data, project history, uploaded files, and generated images. We work with providers that maintain enterprise-grade security and compliance certifications.
• AI technology providers: Receive product descriptions and generation parameters to generate AI prompts, listing copy, and product images. Data submitted for generation is processed in accordance with the provider's data processing agreements and applicable data protection requirements.
• Payment provider: Processes subscription payments and one-time purchases. Our payment provider receives your name and email when initiating payment and is PCI DSS compliant. We do not store your card details on our servers.

6.2 Legal Requirements

We may disclose your personal information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

6.3 Business Transfers

If ListingSet is involved in a merger, acquisition, asset sale, or bankruptcy, your personal data may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

6.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

ListingSet is based in Israel. Your data may be transferred to and processed in countries outside your country of residence, including Israel, the United States, South Korea, and other jurisdictions where our service providers operate.

Israel is recognized by the European Commission as providing an adequate level of data protection. For transfers to other countries, we rely on Standard Contractual Clauses (SCCs) and our service providers' data processing agreements to ensure appropriate protections are in place.

• Account data: Retained for as long as your account is active. If you delete your account, personal data is permanently deleted within 30 days, except where we are required by law to retain it longer (e.g., billing records for tax purposes).
• Generated images: Stored indefinitely while your account is active so you can access past projects. Deleted within 30 days of account deletion.
• Uploaded product images: Retained for as long as the associated project exists in your account.
• Payment records: Retained for 7 years as required by Israeli tax law.
• Support communications: Retained for 2 years from the date of last contact.
• Server logs: Retained for up to 90 days for security and debugging purposes.
• Anonymized analytics data: May be retained indefinitely as it cannot be linked to any individual.

Depending on where you are located, you may have the following rights regarding your personal data:

9.1 Rights Under GDPR (EEA / UK residents)

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data where there is no overriding legitimate reason for us to retain it. You can delete your account directly from Account Settings.
• Right to restrict processing: Request that we temporarily or permanently stop processing your personal data.
• Right to data portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time.
• Right to lodge a complaint: If you believe we have violated your rights, you may file a complaint with the relevant data protection supervisory authority in your country.

9.2 Rights Under Israeli Privacy Protection Law

Israeli residents have the right to access personal information held about them and to request its correction. To exercise these rights, contact us at support@listingset.io.

To exercise any of the above rights, please email support@listingset.io with the subject line "Privacy Request". We will respond within 30 days. We may need to verify your identity before processing your request.

We implement technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or alteration. These measures include:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Database access is restricted to authorized systems only, with no direct public exposure.
• Payment processing is handled entirely by PCI-compliant providers — card data never passes through our systems.
• Administrative access to production systems is protected by multi-factor authentication.
• We conduct periodic security reviews and apply security patches promptly.
• Access to personal data within our team is limited to personnel who need it to operate and improve the Service.

Despite these measures, no security system is impenetrable. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by law.

ListingSet is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@listingset.io and we will promptly delete that information from our records.

The Service may contain links to third-party websites or services that are not operated by us (for example, links to e-commerce platforms). We are not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policies of any third-party services you access.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users by email at least 14 days before the changes take effect, where required by law.
• Display a notice within the Service.

Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: