Privacy Policy
Last updated: October 29, 2026
- You connect your Etsy shop yourself, and we use its data only to work out the profit of your listings for you.
- We read your orders to count sales per listing. We do not store your buyers' names, addresses or messages.
- Nothing in your shop changes unless you approve the change, and every change is logged so you can undo it.
- We never sell your data. You can disconnect your shop and ask us to delete your data at any time.
1. Who we are
Profit Guard is a web app made by SunMesa Labs LLC, a New Mexico limited liability company ("SunMesa Labs", "we", "us"). It audits an Etsy shop: it estimates the profit of each listing after Etsy fees and your costs, suggests which listings to renew, fix or deactivate, and, if you ask it to, makes the changes you approve. Questions: randy@sunmesalabs.com.
2. What we collect
| Data | Where it comes from | Why we need it |
|---|---|---|
| Name and email address | Your purchase (WarriorPlus) or your Sunmesa Labs account sign-in | To create your account, let you log in and send account emails |
| Password | You | To log you in. We only store a one-way hash, never the password itself |
| Purchase details: product, sale ID, status | WarriorPlus purchase notifications | To unlock the plan you bought, and to remove access after a refund |
| Etsy connection: your Etsy user ID, shop ID and name, shop country and currency, and access tokens | Etsy, when you connect your shop (OAuth) | To read your shop for the audit and to make the changes you approve. Tokens are stored encrypted |
| Listing data: title, description, price, quantity, tags, materials, state, views, favorites, renewal date, shipping profile, first photo link | The Etsy API | To calculate profit, give each listing a verdict, and show before/after for proposed changes |
| Sales data per order line: listing, quantity, item price, shipping charged, order date, order status, buyer country | The Etsy API (your receipts) | To count sales and revenue per listing. We do not store buyer names, emails, addresses or messages, even though Etsy sends some of them with each order |
| Shipping profiles: name, origin country, shipping prices | The Etsy API | To estimate the shipping a buyer pays |
| Your costs and settings: unit cost, real shipping, packaging, price floor and ceiling, fee settings, target margin | You | To calculate profit and suggested prices |
| Change log: every field we changed on Etsy, its value before and after, when, and the IP address that approved the batch | The app | So you can see and undo every change, and to prove that changes only happen after your approval |
| Monitor alerts and monthly reports (Always-On plan) | The app, after each scan | To tell you by email when a listing slips into a loss or is about to renew without selling, and to summarise each month |
| Client shop details (Agency plan): the client's name and optional email that the agency types in, and the client's shop connection | The agency, and the client when they accept an invite | To let an agency audit a client's shop with the client's permission |
| Technical data: IP address, login attempts, a log of requests the app made to Etsy (time, endpoint, result), usage counts, emails we sent | Your browser and the app | Security, rate limits, monthly limits and troubleshooting |
We do not collect payment card details. Payments are handled by WarriorPlus and the payment providers they use. We do not read your Etsy messages, reviews you wrote, or your bank details.
3. What we do with your Etsy shop
When you connect, Etsy asks you to allow these permissions: read listings, update listings, read transactions and read shop details. A scan only reads. The app writes to your shop only in a batch you approved in the Fix Queue (Profit Fix Autopilot): new price, new title, tags or description, renewing an expired listing, or deactivating a listing. Before each change the app reads the listing again and skips it if it changed since the scan. You can disconnect at any time on the My shop page or in your Etsy account settings; we then delete the stored tokens.
Agencies and their clients
With the Agency plan, an agency can send a client an invite link. When the client opens it and allows access on Etsy, the client's shop is connected to the agency's account: the agency can then see the data described above for that shop and, after approving them, make changes. The invite page says so before the client continues. The client can remove the access any time in Etsy (Account settings → Apps) or ask the agency or us to remove the shop. An agency can also share a client's report through a link with a long random code; anyone with that link can see that report, so it should only be sent to the client. A new link replaces the old one.
4. How the AI writing works
When you click Write with AI in the Fix Queue, the app sends that listing's title, tags, materials, description and up to 10 of its public buyer reviews (the review text only) to OpenRouter, which passes the request to an AI model provider (for example Google or OpenAI). We do not send your name, email, sales or costs. Every request asks OpenRouter to use only providers that do not store or train on the data (OpenRouter's data collection: deny setting). The text is shown to you to edit and approve; it is never published on its own.
5. Cookies
We use only cookies the app needs to work, and no advertising or tracking cookies:
pg_sess: keeps you logged in (session).pg_via,pg_hub_try: remember whether you log in with a password or through your Sunmesa Labs account.pg_pin: remembers whether you pinned or collapsed the sidebar.
6. Who we share data with
We never sell your data or share it for advertising. We only share what is needed to run the app with:
- Our hosting provider, which stores the app and its database.
- Etsy, when the app reads your shop or writes the changes you approved, through the Etsy API.
- An agency, only for a shop you connected through that agency's invite link (section 3).
- OpenRouter and the AI model providers it routes to, only when you ask for an AI rewrite (section 4).
- WarriorPlus, which tells us about your purchase.
- Authorities, if the law requires it.
7. How long we keep data
We keep your account, shop data, costs and change log while your account is active, so you can compare scans over time and undo changes. Failed-login records are deleted after 24 hours; logs of sent emails and of Etsy requests, and Monitor alerts, after 12 months. Invite links stop working after 30 days or once used. When you disconnect a shop, we delete its tokens right away. When you ask us to delete your account, we delete your account, shops, listings, sales data, costs, scans and logs within 30 days. Copies may stay in backups for up to 30 more days before they are overwritten.
8. Your choices and rights
- See and correct: your listings, verdicts, costs and change log are in the app. Change your name and time zone in Settings.
- Disconnect: on My shop, or in Etsy under Account settings → Apps.
- Copy: download your costs, the action checklist and the change log as CSV at any time.
- Delete or ask: write to randy@sunmesalabs.com to delete your account or for a copy of your data. We answer within 30 days.
Depending on where you live (for example the EU, the UK or California), you may have further rights under local law. We will honour them.
9. Security
The app runs over HTTPS. Passwords are hashed, and Etsy tokens and API keys are encrypted. Access to the server is limited to the people who run the app. No system is perfectly secure, so if we learn of a breach that affects your data, we will tell you without undue delay.
10. Children
The app is for sellers and is not meant for anyone under 16. We do not knowingly collect data from children.
11. Changes to this policy
If we change how we handle data, we will update this page and the date at the top. For important changes we will also let you know by email or in the app.
12. Contact
SunMesa Labs LLC · 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA · randy@sunmesalabs.com