Privacy Policy

SPRL Studio ("we," "us," or "our") is a product of LSF, LLC. It is an inventory management platform for vintage resellers. We help vendors manage product listings, sync inventory across sales channels (including Shopify, Etsy, and Shop SPRL), and fulfill orders from a single dashboard.

This Privacy Policy explains what data we collect, how we use and protect it, and your rights regarding that data. It applies to SPRL Studio on the web (sprlstudio.com), the SPRL Studio iOS app, and Shopify merchants who install our Shopify app.

Information you provide directly

When you create an account, we collect your name, email address, and business information. You may also provide payment details for vendor payouts through Stripe Connect.

Data accessed via Shopify

When you install SPRL Studio on your Shopify store, we request access to the following data through the Shopify API:

• Products: titles, descriptions, images, variants, pricing, tags, and inventory levels
• Orders: order details, line items, fulfillment status, and customer shipping information
• Inventory: stock quantities and location data
• Store information: shop name, domain, currency, and locale settings

We access this data solely to synchronize your inventory and orders between Shopify and SPRL Studio. We do not access data beyond what is necessary for the app to function.

Data from other platforms

If you connect Etsy or Instagram accounts, we access similar product and listing data from those platforms via their respective APIs. Instagram is used for one-way content publishing only.

SPRL Studio iOS app

The iOS app is a capture and review companion for vendors who already have a Studio account. It collects:

• Account identifiers: email address and user ID, used to sign you in
• Business profile: store name and profile photo, if you set them
• Inventory photos: pictures you take with the camera or import from your photo library, uploaded over HTTPS to your vendor-scoped Studio staging folder. These are business product photos, not end-customer personal photos
• Listing content you edit: titles, prices, attributes, and other draft fields when you review and publish
• Order information already tied to your vendor account — customer name, email, and shipping address — so you can fulfill from the phone. That information is not collected from the device; it is loaded from your Studio account. If you buy a shipping label in the app, we share the ship-from and recipient address with Shippo

The iOS app does not collect precise location, contacts, or advertising identifiers. It does not show ads. It does not track you across other companies' apps or websites.

Product images for AI processing

When you capture or import inventory photos (in the iOS app or on the web), we send those images to Google's Gemini API to group photos into products and suggest fields such as color, material, era, and condition. Suggestions are editable. You remain the source of truth before publish.

On iOS, we ask for your explicit permission in the app before the first photo is sent to Google Gemini. You can turn that processing off later in Account Settings. Uploading photos still works if you decline; grouping and field suggestions will not run until you allow it.

We use Google's Gemini API as a paid service. Under Google's current Gemini API terms for paid services, Google does not use those prompts or images to train its models. Google may log requests for a limited time for abuse monitoring. We do not use inventory photos for advertising.

On the web, if you choose to enhance a product description, we may also send that description, the related product fields, and optionally images to Anthropic. That step is opt-in. The iOS app does not use that description-enhancement feature today. Anthropic's commercial API terms govern how it handles that content.

We use the data we collect to:

• Synchronize products, inventory, and orders across your connected sales channels
• Process and fulfill orders received from Shopify and other platforms
• Generate shipping labels through our shipping provider
• Process vendor payouts through Stripe Connect
• Group inventory photos and extract product metadata with AI (Gemini) when you capture or import photos. On iOS this runs only after you allow it
• Provide customer support and respond to your inquiries
• Improve and maintain the reliability of our services

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in this policy.

Your data is stored in a PostgreSQL database hosted by Supabase, which provides enterprise-grade infrastructure with encryption at rest and in transit.

Specific security measures include:

• All OAuth access tokens (Shopify, Etsy, Instagram) are encrypted before storage in our database
• API communication between services uses HMAC signature verification and API key authentication
• All data is transmitted over HTTPS/TLS
• Row-level security policies ensure vendors can only access their own data
• Webhook endpoints verify request signatures to prevent unauthorized access

While you use the app

We retain your data for as long as your account is active. Product data, order history, and sync records are maintained to provide continuous service.

When you delete your Studio account

You can delete your account from inside the iOS app (Account Settings → Delete Account) or by emailing studio@sprl.shop. Deletion pauses your store, takes down live listings on Shopify, Etsy, and Shop SPRL, archives your products, and removes your account and its data after 30 days. That delay is so a mistaken delete can be stopped before the purge. Some financial records may be kept longer where tax or legal rules require it, without customer personal information.

When you uninstall the Shopify app

When you uninstall SPRL Studio from Shopify, we process the following data changes within 48 hours:

• Integration data deleted: your Shopify OAuth tokens, store connection details, and sync configuration are permanently removed
• Customer PII scrubbed: personally identifiable information from orders (customer names, email addresses, shipping addresses) is removed or anonymized
• Financial records retained: order totals, payout records, and transaction history are kept as required for tax and legal compliance. These records do not contain customer PII after scrubbing
• Product data: your product catalog data is retained in case you reinstall. You may request full deletion at any time (see Your Rights below)

Shopify mandatory webhooks

We comply with Shopify's mandatory webhook requirements. When we receive a shop/redact webhook, we delete all store-specific data associated with your Shopify domain. When we receive a customers/redact or customers/data_request webhook, we process the request within 30 days as required by Shopify.

We share data with the following third-party services, each solely for the purpose described:

We do not sell data to any third party. Each service listed above receives only the minimum data required to perform its function. Any third party with whom we share user data — including analytics tools, advertising networks, third-party SDKs, and any parent, subsidiary, or related entity that can access user data — will provide the same or equal protection of that data as stated in this Privacy Policy and as required by Apple's App Store Review Guidelines. We do not use advertising networks or analytics SDKs in the iOS app today.

For all users

You have the right to:

• Access your data: request a copy of all personal data we hold about you
• Correct your data: request corrections to inaccurate or incomplete data
• Delete your data: request deletion of your personal data, subject to legal retention requirements
• Export your data: receive your data in a portable, machine-readable format

For EU/EEA residents (GDPR)

In addition to the rights above, you may restrict or object to certain processing of your data. Our legal basis for processing is contract performance (providing the service you signed up for) and legitimate interest (improving our services). Where we rely on consent, you may withdraw it at any time.

For California residents (CCPA)

Under the California Consumer Privacy Act, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. You will not receive discriminatory treatment for exercising your CCPA rights.

Rights of your customers

If a customer of your Shopify store contacts us (or you forward their request) asking to access or delete their personal data, we will process that request within 30 days. Customer data we hold is limited to order information (name, email, and shipping address) received through Shopify's API. We honor all data subject requests received via Shopify's mandatory GDPR webhooks.

How to withdraw consent

You can withdraw consent without deleting your account:

• Camera and photo library: iOS Settings → SPRL Studio. You can still use the rest of the app
• Google Gemini photo processing: Account Settings in the iOS app, using the AI Photo Processing control. Photos already on your account stay there; we will not send further photos to Gemini until you turn it back on
• Connected sales channels: disconnect them in Studio settings on the web

How to exercise your rights

To delete your Studio account, use Delete Account in the iOS app. You can also email studio@sprl.shop. We will respond within 30 days. We may ask you to verify your identity before processing your request.

SPRL Studio on the web uses essential cookies for authentication and session management. The iOS app stores your session in the device Keychain, not in cookies. We do not use advertising cookies, tracking pixels, or analytics SDKs. We do not use the App Tracking Transparency identifier, and we do not track you across other companies' apps or websites.

SPRL Studio is a business tool intended for use by adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice in the application. The "Effective date" at the top of this page indicates when the policy was last revised.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.