Privacy Policy — CanvoraCo Shop Manager (API Data)

Last updated: 5 July 2026

CanvoraCo ("we," "our," "us") operates the Etsy shop CanvoraCo and a private, internal tool called CanvoraCo Shop Manager that connects to our own shop through the official Etsy Open API v3. This policy explains what data that tool accesses and how we handle it. The tool is used solely to operate our own shop; it is not offered to, or operated on behalf of, any other seller or third party.

1. Who we are

CanvoraCo is a United States–based independent seller of original, made-to-order wall art (canvas prints, framed canvas, and posters). Contact: dowlingtrenton@gmail.com.

2. What data the tool accesses

Using OAuth 2.0 authorization that we grant to our own shop, the tool may access:

• Our shop profile, sections, and listing data (including our own inactive and draft listings) — to create and update our listings, inventory, and prices;
• Our order receipts and the buyer-provided fulfillment details attached to them (name, shipping address, items, and order totals) — to produce and ship each order and keep our own sales records.

We request only the minimum permission scopes required for these tasks (shops_r, listings_r, listings_w, transactions_r).

3. How we use the data

Order and buyer data is used exclusively to fulfill and ship the customer's purchase (including transmitting the shipping name and address to our print-on-demand production and shipping partner) and to maintain our internal accounting and tax records. Listing data is used only to manage our own catalog. We do not use Etsy data for advertising, profiling, resale, or to train machine-learning or AI models.

4. Sharing

We do not sell, rent, or share Etsy data with third parties, except with the production/shipping partner strictly as needed to fulfill an order, and where required to comply with law or tax obligations. We do not provide Etsy data or our API access to any other seller or application.

5. Retention and security

We keep data only as long as reasonably necessary to fulfill orders and meet legal/accounting requirements, consistent with the Etsy API Terms of Use, and we do not cache Etsy content longer than needed to provide the service. Data is stored on access-controlled systems, transmitted over encrypted connections, and authenticated with OAuth tokens that we rotate and can revoke at any time.

6. Data breach

If we discover a security incident affecting Etsy member data, we will notify Etsy at dpo@etsy.com and any affected parties within 24 hours of discovery, consistent with the Etsy API Terms of Use.

7. Your rights

Buyers may contact us at the email above with any request regarding their personal data, including access or deletion, and we will respond consistent with applicable law and Etsy's policies.

8. Changes

We may update this policy; the "last updated" date above reflects the current version.

---

The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.