Privacy Policy

FlipPilot is a tool that helps individual secondhand resellers keep track of inventory, write listing drafts (optionally with AI assistance), estimate marketplace fees, and record actual sales and profit. FlipPilot is operated by Atlookat (“we”, “us”, “our”). We are responsible for the personal information described in this policy.

FlipPilot is offered to adults aged 18 and older in the United States and Canada. This policy applies to the FlipPilot website and web app, to account emails we send, and to support conversations with us. It does not apply to marketplaces or other websites you visit, even when you copy a FlipPilot draft to them.

FlipPilot never logs in to, posts to or scrapes any marketplace. You move your listings yourself, by copying text or exporting a CSV file. FlipPilot is not affiliated with eBay, Poshmark, Depop, Mercari, Facebook Marketplace or any other marketplace; we use their names only to describe formatting styles.

Almost everything FlipPilot holds is information you type in or upload yourself. The rest is technical information that any web service needs in order to run and stay secure.

Photos. Uploaded photos are kept in a private storage bucket. They are never public: FlipPilot shows them to you only through temporary links that expire after 1 hour. Please avoid uploading photos that show identifiable people, house numbers, documents or other personal details you don’t want stored.

Sourcing notes and costs. Your purchase costs and private sourcing notes are for your own records. They appear only inside your account and in your own exports.

We designed FlipPilot to work without the following, and we do not collect them:

• Payment card or bank account details (early access is free, and we take no payment information).
• Usernames or passwords for any marketplace.
• Precise location. Location metadata is stripped from photos on your device before upload.
• Your contacts or address book.
• Government-issued ID numbers.
• Biometric data.

We also don’t use advertising trackers, analytics cookies or social-media pixels. The Cookies Policy lists the few items we do store in your browser.

We use personal information only for the following purposes:

• To provide FlipPilot: creating and maintaining your account, storing and showing your inventory, photos, drafts and sales, calculating fees and profit from the figures you enter, and producing the exports you ask for.
• To generate AI drafts, but only when AI suggestions are enabled and you click Generate (see AI listing suggestions).
• To keep FlipPilot secure: authenticating you, detecting and preventing abuse, fraud and unauthorized access, and enforcing daily AI quotas.
• To communicate with you: account confirmation, password reset, security notices and important service notices, and replies to your support requests.
• To comply with the law: meeting legal obligations, responding to lawful requests, and establishing or defending legal claims.
• To improve FlipPilot: using aggregated, de-identified information (for example, how often AI generation fails) to fix problems and decide what to build. We don’t try to re-identify de-identified information.

Just as important is what we don’t do:

• We don’t show ads, and we don’t profile you for advertising.
• We don’t sell your personal information or “share” it for cross-context behavioral advertising, as those terms are defined by California law.
• We don’t use sensitive personal information to infer characteristics about you.
• We don’t use your content (item details, photos or drafts) to train AI models.

Where the law requires a legal basis or your consent, we rely on your consent (for example, when you choose to use AI suggestions), on what is necessary to provide the service you asked for, on our legitimate interest in keeping FlipPilot secure and working, and on our legal obligations. You can withdraw your consent at any time; doing so may mean some features stop working, but it doesn’t affect processing that already took place.

FlipPilot can suggest listing text using an AI model provided by Anthropic PBC, through Anthropic’s commercial API. Nothing is sent to Anthropic unless AI suggestions are enabled in your Settings and you click Generate for a specific item.

When you do, we send Anthropic the following details of that one item:

• item name, brand, category and condition;
• the description you wrote; and
• up to 3 of that item’s photos.

The request contains only those fields. It doesn’t include your purchase cost, private sourcing notes or sales records. We keep a usage record of each request (provider, model, success or error, token counts, number of photos and time) so we can enforce daily quotas and keep costs under control; that record never contains your text, photos or the generated draft.

You can turn AI suggestions off at any time in Settings. While they are off, nothing is sent to Anthropic, and you can still write and edit drafts by hand. For information about how Anthropic handles data it receives through its API, see Anthropic’s privacy policy.

We use a small number of service providers (also called processors) to run FlipPilot. Each one is bound by contract to process personal information only on our instructions and for the purpose of providing its service to us.

Apart from our service providers, we disclose personal information only:

• when you ask us to, or when you export or copy your own data;
• when we are required to by law, for example to comply with a valid court order, subpoena or other legal process, and only to the extent required;
• when we believe in good faith that disclosure is necessary to protect the safety, rights or property of our users, the public or Atlookat, or to investigate fraud or security problems; or
• as part of a merger, acquisition, financing or sale of all or part of our business, in which case the recipient must protect your information in line with this policy and we will notify you of the change.

Your information is stored and processed in the United States. Our main database and file storage are hosted on Amazon Web Services in the us-west-2 (Oregon) region through Supabase, and our other service providers may also process information in the United States.

If you are in Canada, this means your personal information is transferred to, stored in and processed in the United States. While it is there, it is subject to US law and may be accessible to US courts, law enforcement and national security authorities under that law. We protect transferred information through our contracts with our service providers and the security measures described below.

We use safeguards that are appropriate to the sensitivity of the information, including:

• Per-account isolation enforced in the database itself (row-level security), so one account cannot read or change another account’s records.
• Private photo storage, with photos shown only through links that expire after 1 hour.
• Encryption in transit: all connections to FlipPilot use HTTPS (TLS).
• Hashed passwords, handled by our authentication provider; we never see or store your password in readable form.
• Least-privilege access: people and systems get only the access they need, and secret keys are kept on the server and never sent to your browser.
• Minimal logging: our logs exclude listing text, photos and AI prompts.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You can help by using a strong, unique password and keeping your email account secure. If a security breach affects your personal information, we will notify you and the relevant authorities as required by applicable law.

We keep your information while your account is active, because that is what lets FlipPilot remember your inventory and sales.

• Individual records. You can delete individual items, photos, drafts and sales at any time.
• Account deletion. When you delete your account (Settings → Delete account, then type DELETE to confirm), we immediately and permanently delete your account, items, photos, drafts, sales, fee presets and AI usage records. This cannot be undone, so export anything you want to keep first.
• Backups. Residual copies may remain in our providers’ encrypted backups for a limited period until they are overwritten in the normal backup cycle.
• Security logs. Authentication and server logs are kept for a limited period for security and troubleshooting, then deleted.
• Inactive accounts. If an account is inactive for an extended period, we may delete it. We will email you before doing so, giving you time to sign in or export your data.
• Legal obligations. We may keep specific information longer where the law requires it or where it is needed to establish or defend a legal claim.

Most privacy choices don’t require contacting us. Inside FlipPilot you can:

• See and edit everything you have entered: items, photos, drafts, fee presets, sales and your profile.
• Correct anything that is inaccurate by editing it directly.
• Export all your data as a JSON file from Settings, and export reviewed drafts as CSV.
• Delete individual records, or your whole account from Settings.
• Turn AI suggestions off in Settings, so nothing is sent to our AI provider.
• Change cookie choices through Cookie settings in the footer or on the Cookies Policy page.

You can also exercise your privacy rights by emailing privacy@adsgora.com from the email address on your account. Please tell us what you are asking for (for example, a copy of your data or deletion) and, if you live in a particular US state or Canadian province, where you live, so we can apply the right rules.

• Verification. To protect your account, we verify requests by confirming that you control the email address on the account. We may ask for a little more information if we cannot verify you that way, and we use it only for verification.
• Timing. We respond within 30 days. Where California law allows, we may take up to 45 days, and we will tell you if we need that extension.
• Authorized agents. Where the law allows, someone you authorize may make a request on your behalf. We may ask for proof of the authorization and ask you to verify your identity directly with us.
• If we can’t fully agree. If we decline all or part of a request, for example because an exception in the law applies, we will tell you why and explain how you can appeal or complain.

California. If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to:

• know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients;
• delete personal information we collected from you;
• correct inaccurate personal information;
• data portability, meaning a copy of your information in a usable format;
• opt out of the sale or sharing of personal information. We don’t sell or share personal information, so there is nothing to opt out of, but you may still contact us;
• limit the use of sensitive personal information. We use sensitive personal information (such as your account login) only to provide and secure the service, and never to infer characteristics about you; and
• non-discrimination: we won’t treat you differently for exercising any of these rights.

In the past 12 months, we have collected the following categories of personal information, as defined by California law: identifiers (such as email address and IP address); commercial information (the inventory, purchase and sales records you enter); internet or other electronic network activity (authentication and server logs); audio, electronic or visual information (the photos you upload); and sensitive personal information limited to your account login credentials. We collected them from you and your browser for the purposes described in How we use information, and disclosed them for business purposes only to the service providers listed above. We have not sold or shared personal information, including that of consumers under 16. We keep each category as described in How long we keep data.

Global Privacy Control. We honor Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information. When your browser sends a GPC signal, marketing cookies stay off.

Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws have similar rights, which may include access, correction, deletion, portability, and opting out of targeted advertising, sale of personal data and profiling. We don’t engage in targeted advertising, sales of personal data or profiling with legal or similarly significant effects.

Appeals. If we decline your request, you may appeal by replying to our decision. We will respond to your appeal in writing within the time required by your state’s law and explain our reasons. If we deny your appeal, you may contact your state attorney general.

Canada. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, you have the right to access the personal information we hold about you, to ask us to correct it if it is inaccurate or incomplete, and to withdraw your consent to our handling of it (subject to legal and contractual restrictions and reasonable notice). Withdrawing consent may mean we can no longer provide some or all of FlipPilot. If you are not satisfied with how we handle your information or a request, you may complain to the Office of the Privacy Commissioner of Canada.

Quebec. Under Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, we have designated a person in charge of the protection of personal information. You can reach our Privacy Officer at privacy@adsgora.com. Quebec residents have the right to access and rectify their personal information, to receive computerized personal information they provided in a structured, commonly used technological format (portability), and to withdraw consent. If you are not satisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec.

As explained in Where your data is stored, personal information of Canadian users is stored and processed in the United States.

When you request an AI draft, the AI model writes suggested listing text using only the item details you provided. FlipPilot then automatically removes unverified claims you didn’t make yourself, such as describing an item as “authentic” or “vintage” when you didn’t say so.

FlipPilot makes no decisions about you that have legal or similarly significant effects. AI output is only a suggestion: you review and edit it, and you must confirm that you have reviewed a draft before you can copy or export it.

We send emails from noreply@adsgora.com for account confirmation, password resets, security notices and important service notices (for example, a material change to this policy or our terms). These emails are part of running your account, so you can’t opt out of them while your account is active.

We don’t send marketing emails today. If we ever do, we will send them only to people who opt in, and every marketing email will include a way to unsubscribe. Our account emails don’t contain tracking pixels.

FlipPilot uses only a small number of first-party cookies that are strictly necessary to sign you in, protect sign-in links and remember your cookie choices, plus one browser storage entry that remembers your theme. We don’t use advertising, analytics or social-media tracking cookies. If we add analytics or marketing cookies in the future, they will stay off unless you opt in. See the Cookies Policy for the full list.

FlipPilot is not intended for anyone under 18, and you must confirm that you are 18 or older to create an account. We don’t knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it. If you believe a minor has created an account, please contact privacy@adsgora.com.

We may update this policy as FlipPilot changes or as the law requires. When we do, we will change the “Last updated” date at the top of this page. If a change is material, for example a new use of your information or a new category of service provider, we will notify you by email or in the app before the change takes effect, and ask for your consent where the law requires it.

For privacy questions, requests or complaints, contact our Privacy Officer at privacy@adsgora.com. For general support, email support@adsgora.com.

FlipPilot is operated by Atlookat. Please also read our Terms of Use and Cookies Policy.