Skip to content
ProductHow it worksLimits

Privacy policy

Last updated: 26 September 2026

This policy explains what data Kawlen ("we") collects when you use kawlen.com and the Kawlen dashboard, why we collect it, how long we keep it, and what rights you have over it.

Kawlen is a tool for Etsy sellers. We connect to your Etsy shop only when you authorise it, and only with the scopes listed below.

Kawlen is the data controller responsible for processing your data. For anything at all: info@kawlen.com.

01Data we collect

Because you give it to us

  • Request form: name, email, shop name and link, monthly order range, and the description you write.
  • Account: your email address and language preference. Kawlen works without passwords; you sign in through a one-time link sent to your email.
  • What you enter in the dashboard: product costs, shipping spend, targets, tasks and notes.

Through your Etsy connection

When you connect your Etsy account, we access the following scopes through the Etsy Open API v3:

  • Shop information (shops_r): shop name, currency, holiday mode, shop sections.
  • Listings (listings_r / listings_w): title, description, tags, price, stock, variations, images and listing translations. Write access is used only for edits you approve yourself.
  • Orders and payment ledger (transactions_r): order line items, amounts, shipping status, Etsy fee and advertising cost entries; and, so that you can prepare and ship the order, the buyer's name, delivery address, order note, gift message and personalisation text.
  • Your account email (email_r): to match your Kawlen account with your Etsy account.

Your buyers' details and order fulfilment

So that you can prepare and ship an order, we store the buyer's name, delivery address, order note, gift message and personalisation text. We use this only for order fulfilment: we do not use it for marketing, we do not sell it and we do not share it with third parties.

If the Etsy sale email includes the buyer's email address, we keep it with the order record for order-related contact; the same rules apply (never used for marketing, never shared, never sent to the workshop).

Only authorised users of your own shop can see these details. If you route production to a workshop, the workshop receives only what production requires (item, quantity, dimensions, personalisation text); the delivery address is not sent to the workshop.

Retention: the buyer's name, delivery address, order note and personalisation text that come from Etsy emails in Gmail or from an order file you upload are kept with the order record as your business record; they are not deleted when the order ships, is cancelled or refunded. They stay until you delete them or close your account. The order record (order number, date, amounts, items, the buyer's country, state and city, Etsy username and buyer number) also stays as your business record.

Buyer details obtained through your Etsy connection are also deleted, together with the rest of your Etsy data, within 30 days of you disconnecting Etsy, or immediately on request.

Files you download from Etsy and upload (optional)

You can upload the files you download from Etsy's "Download Data" page (currently-for-sale listings, orders, order items, reviews, shop settings). The file is opened and parsed in your browser; only the fields listed below are sent to Kawlen, and the file itself is never stored.

Listings: title, description, price, quantity, tags, materials, image addresses, variations and SKU. Orders: order number, date, amounts, currency, payment method, shipping date, the buyer's country, state and city, and Etsy buyer number. Order items: item, quantity, price, variation, SKU and personalisation text. Reviews: rating, review text, date and order number; the reviewer's name is not sent. Shop settings: shop name, announcement, messages to buyers, icon and banner image.

The phone number, last four digits of the SSN, card and bank details, team members and shipping postcodes in the shop settings file are removed in your browser and never sent to Kawlen. The buyer name and address columns in the order items file are not read.

The buyer's name, delivery address and personalisation text are kept with the order record as your business record (see "Your buyers' details and order fulfilment").

Through your Google account connection (optional)

Each shop can be connected to at most one Google account. When you connect, you choose which permissions to grant; both are read-only. We store the connected account's email address and Google account ID so we can show which account is connected.

Google Analytics (analytics.readonly permission)

If you grant this permission, we read traffic reports for the Analytics property you select (sessions, source/medium, country, device and page breakdowns). We cannot change anything in your Analytics account.

Gmail (gmail.readonly permission)

If you grant this permission, we search your inbox only for email from etsy.com addresses. An email counts as an Etsy email only if Gmail's own sender authentication (DMARC) confirms it really comes from Etsy; email with a spoofed sender counts as non-Etsy. If a non-Etsy email turns up in that search, it is discarded without processing and nothing is stored. No other email is read. If one Gmail account receives email for several shops, only email for shops with the Gmail feature turned on is processed; the rest is discarded without processing, and only its Gmail message ID is kept so the same email is not downloaded again.

Etsy emails we read: new orders, refunds and cancellations, help requests, and Etsy payment and billing notices. Buyer message notifications are not recorded.

From these emails we extract what you need to fulfil the order: order number, date, amounts, items, quantity, price, personalisation, the buyer's Etsy username and buyer number, name, delivery address, order note and (if present) email address. The order record appears on your Orders, Sales, Customers, Reports and Profit pages. The buyer's name, address, note and personalisation text are kept with the order record as your business record. If the email includes the buyer's email address, it is added to the order record. When the email text is stored, the email addresses in it (other than Etsy's and your own) are masked.

We make no changes in Gmail: we do not send, delete, label or mark any email as read. To learn about new Etsy emails we use Gmail's push notification subscription; in that notification Google sends no email content, only the account address and a sequence number.

Collected automatically

  • Application records: sync runs, error logs, security and audit records (who did what and when).
  • Technical data: IP address and browser information, for session security and abuse prevention.

02Data we do not collect

We never collect:

  • Your Etsy password — Kawlen never sees it; authorisation happens on Etsy's own screen.
  • The contents of your Etsy message inbox (convos). Even with the Gmail connection on, buyer message notifications are not recorded.
  • Non-Etsy email in your Gmail inbox. It is not downloaded, read or stored.
  • Your payment card details.

03What we use data for

  • Producing the analyses, reports and suggestions in the dashboard.
  • Applying listing edits you approve, and writing shipping tracking numbers to Etsy.
  • If you turned on the Gmail connection, bringing your orders into the dashboard from Etsy notification emails.
  • Sending functional emails about your account (sign-in link, invitation, notice of important changes).
  • Keeping the service secure, fixing errors and preventing abuse.
  • Meeting our legal obligations.

04What we do not do

  • We do not sell, rent or share your data with third parties for advertising.
  • We do not show your shop data to any other Kawlen user; each organisation's data is isolated at the database level.
  • We do not send marketing messages to your buyers on your behalf.
  • We do not scrape Etsy; official data comes only from the API connection you authorised.

05Data received from Google APIs

Kawlen's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

  • We use data from Google (Analytics reports and the Etsy emails in Gmail) only to provide features you see in the dashboard: traffic analysis and bringing your orders into the dashboard.
  • We do not use this data for advertising, and we do not sell it or transfer it to data brokers or information resellers.
  • We do not use this data to develop, improve or train generalised AI or machine-learning models. If an AI provider is used to extract order fields from an Etsy email that could not be parsed, the provider does not use that data for model training.
  • People do not read your Gmail data, except with your explicit permission (for example, when you ask us to look at a specific email in a support request), for security purposes (investigating abuse or bugs), or to comply with the law.
  • We transfer this data only to service providers needed to provide the feature (hosting and database), and to no other third party.

06Estimated data

Some figures, such as search volume or a competitor's sales, do not come from Etsy. They come from a third-party statistical model. Such data is shown in its own colour with an "Estimate" label, is never merged with official Etsy data, and is stored separately. For these lookups we send the provider only the search term — never your shop identity.

07Third-party services we use

  • Supabase — database, authentication and file storage.
  • Vercel — application hosting.
  • Etsy, Inc. — the source of the shop data you authorise.
  • Google (Analytics Data API, Gmail API) — only if you connect your Google account yourself, and only with the permissions you grant.
  • An AI provider — relevant listing text is processed to generate suggestions; this data is not used to train the provider's models.

08How long we keep data

We prefer to be specific here:

  • Etsy access and refresh tokens: for as long as the connection is active. The token record is deleted immediately when you disconnect.
  • Shop data pulled from Etsy (listings, orders, payment ledger, reviews): while the connection is active, and for at most 30 days after you disconnect. That window exists so you can undo an accidental disconnect; on request we delete it right away.
  • Data from files you download from Etsy and upload: until you delete it (you can delete each file type on the Data uploads page; if the same order also came from Gmail, the order record stays with the information from the email). Buyer names, addresses and personalisation text are kept with the order record. When you close your account, it is deleted within 30 days.
  • Google access and refresh tokens: for as long as the connection is active. The token record is deleted immediately when you remove the connection, and the permission is revoked at Google (unless the same Google account is also connected to another of your shops).
  • Traffic data pulled from Google Analytics: for as long as the connection is active. It is deleted immediately when you remove the connection or the traffic module.
  • The text of Etsy emails received through Gmail: at most 90 days from the date the email was received; the text of older emails is never stored. When you turn off Gmail for a shop or remove its Google connection, that shop's email records (email text, and refund, help request and payment notice records) are deleted within 30 days, even if the same Google account is still on for another shop. The order information extracted from them (the order record, including the buyer's name, address, note and personalisation text) is your business record and stays until you delete it.
  • Access request records: at most 12 months.
  • Audit and security logs: 12 months.
  • When you close your account: all data belonging to your organisation is deleted within 30 days.

09Disconnecting Etsy and deleting your data

You can remove the Etsy connection in two places: in Kawlen under Settings › Connections, or directly from your Etsy account at etsy.com/your/account/apps. Either way, Kawlen stops pulling new data.

If you want all your data deleted, write to info@kawlen.com. We complete such requests within 30 days at the latest and confirm in writing when it is done.

10Removing the Google connection

You can remove your Google account connection in Kawlen under Settings › Integrations, or directly from your Google account at myaccount.google.com/permissions. Either way, Kawlen stops receiving new data from Google.

11Your rights

Depending on where you live, under the GDPR and/or Turkish data protection law (KVKK) you have the right to access your data, ask for it to be corrected or deleted, restrict processing, request portability, and object to processing.

To exercise any of these, write to info@kawlen.com. After verifying your identity we respond within 30 days at the latest. If you find our response inadequate, you may complain to the data protection authority in your country.

12Cookies

We use only the cookies the service needs to work: a session cookie to keep you signed in, and a language preference cookie. We use no advertising cookies and do not track you across sites.

13Security

  • All traffic is encrypted with HTTPS; data is encrypted at rest by our hosting provider.
  • Row level security (RLS) is enforced in the database: only members of an organisation can reach that organisation's data.
  • Etsy and Google tokens are read only by the server that runs background jobs; they are never sent to the browser.
  • Administrative actions are written to an audit log.

14Where data is held

Kawlen hosts data on servers in the United States. If you are in the European Union or Türkiye, your data is therefore transferred outside those jurisdictions. That transfer is necessary to provide the service to you and is safeguarded by the standard data protection terms in our contracts with our hosting providers.

15Children

Kawlen is not directed at people under 18 and we do not knowingly collect their data.

16Changes to this policy

When we update this policy we change the date on this page. If a change is significant, we also notify the email address on your account.

17Contact

For anything about privacy: info@kawlen.com. For everything else: info@kawlen.com.

The term 'Etsy' is a trademark of Etsy, Inc. Kawlen is not affiliated with, endorsed or certified by Etsy, Inc.