Privacy Policy

GemKit Studio (“we”, “our”, “us”) is an AI-powered jewelry product studio that helps sellers create marketplace listings. The Service is operated by MUTAFS, LLC, a limited liability company registered in Wyoming, USA, which is the controller responsible for your data.

Address: 30 N Gould St, Ste 4000, Sheridan, WY 82801-6317, USA
Contact: kaanmutaf@gemkitstudio.com
Website: gemkitstudio.com.

• Account data: your email address, display name, and password (hashed by Supabase Auth — we never see your plaintext password).
• Store information: your jewelry store name, which is used to create your workspace within GemKit Studio.
• Product photos: images you upload of your jewelry products. These are stored in Cloudflare R2 object storage and processed by our AI models (Google Gemini, Anthropic Claude) to generate listing assets.
• Generated assets: AI-generated images, video clips, listing text, and other content produced by our tools on your behalf.
• Usage data: credit consumption, action logs (asset generation, listing generation, publish actions), and timestamps.
• OAuth tokens: if you connect your Etsy or Shopify store, we store OAuth access tokens to publish listings on your behalf. These are stored encrypted and used only for API calls you initiate.

• To provide the GemKit Studio service — classifying products, generating images and videos, writing listings.
• To publish content to Etsy or Shopify on your behalf when you request it, using the Etsy API or Shopify Admin API with your OAuth consent.
• To send transactional emails (email confirmation, credit alerts). We do not send marketing emails without your explicit opt-in.
• To calculate and deduct credits for AI operations you perform.
• To diagnose errors and improve the service.
• Only with your explicit permission: if you give photo-use permission at signup or in your workspace settings, the worn (on-model) photos you upload may be used as hidden size references when generating images of other products — including other users' — and to improve our own models. They are never shown to any user and never sold; they are only passed to our image-generation provider for processing. The option is off by default; you can turn it off at any time and that use stops.

GemKit Studio uses the Etsy API to allow you to publish your listings and product images directly to your Etsy shop. Specifically:

• We request OAuth authorization scopes required to create, read, and update listings and listing images on your behalf.
• We only make Etsy API calls when you explicitly trigger a publish action within GemKit Studio.
• We do not read, store, share, or process personal data about Etsy members other than the OAuth token belonging to you, the authenticated user.
• We do not cache or store any Etsy Member Content (listings, images, or shop data retrieved via the API). GemKit Studio is a publishing tool — all content flows from GemKit to Etsy, not the other way around.
• We do not read, store, or share your Etsy customer data, order data, or financial information.
• Your Etsy OAuth tokens are stored securely and are never exposed to third parties.
• You can revoke GemKit Studio’s Etsy access at any time from your Etsy account settings under “Apps & Integrations”.

GemKit Studio’s use of the Etsy API is governed by the Etsy API Terms of Use. Etsy’s own data practices are described in the Etsy Privacy Policy.

The term “Etsy” is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.

GemKit Studio uses the Shopify Admin API to publish listings to your Shopify store when you connect it and request a publish. We only access the product and media endpoints required to create and update product listings. We do not access customer, order, or financial data.

You can connect your own Instagram professional account, TikTok account and YouTube channel so GemKit Studio can send content you have approved to them. Nothing is posted or uploaded automatically: every post or upload starts with you clicking the button for that platform.

• Instagram (Instagram API with Instagram Login). With instagram_business_basic we read your account ID and username, to show which account is connected and to publish to the right account. With instagram_business_content_publish we publish a single post (image and the caption you approved) to your account when you click “Publish to Instagram”. We do not read your followers, messages, comments or insights.
• TikTok (Login Kit and Content Posting API). With user.info.basic we read your basic profile (open ID, display name, avatar) to show which account is connected. With video.upload we send a product video you approved to your TikTok inbox as a draft; you add the caption and post it in TikTok yourself. We do not read your videos, followers or comments.
• YouTube (YouTube Data API). With the youtube.upload scope we upload a product video you approved to your channel when you click “Upload to YouTube”. We do not read your existing videos, comments or analytics. GemKit Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

For each connected account we store only the access tokens the platform gives us and the account identifier, and we use them only for the actions above. We never sell this data, share it with third parties or use it for advertising.

Disconnecting: Settings › Channels › Disconnect deletes the stored tokens immediately. You can also remove GemKit Studio in the platform's own settings (Instagram: Settings › Apps and websites; TikTok: Settings › Security › Manage app permissions; Google: myaccount.google.com/permissions). When Instagram tells us you removed the app, we delete the stored tokens automatically. Data deletion instructions: gemkitstudio.com/data-deletion.

• Authentication & database: Supabase (EU/US regions), with row-level security enforced — each workspace’s data is strictly isolated.
• File storage: Cloudflare R2. Images and videos are stored under your workspace-scoped path and are not publicly accessible without a signed URL.
• AI processing: Product images are sent to Google Gemini Flash for image generation and to Anthropic Claude for text generation. Neither provider trains on your data under our API agreements.

We do not sell, rent, or share your personal data with third parties for marketing purposes. We share data only with:

• Supabase (database and auth hosting)
• Cloudflare (file storage)
• Google (AI image and video generation via Gemini API)
• Anthropic (AI text generation via Claude API)
• Etsy / Shopify (only the content you explicitly choose to publish)

All sub-processors are contractually bound to data protection standards.

If you choose to sign in with Google, we receive your email address and public profile name from Google. We do not request access to your Google Drive, Gmail, or any other Google service. Your Google account credentials are managed by Google and never stored by us.

• Generated assets that you archive are purged from Cloudflare R2 after 14 days.
• You may request deletion of your account and all associated data at any time by emailing kaanmutaf@gemkitstudio.com. We will complete deletion within 30 days.
• We retain anonymized usage logs for up to 12 months for service improvement.

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for any processing based on consent
• Data portability (export your product data)

To exercise any of these rights, contact us at kaanmutaf@gemkitstudio.com.

We use session cookies managed by Supabase Auth to keep you signed in. We do not use third-party advertising or tracking cookies.

We may update this Privacy Policy. When we do, we will update the “Last updated” date above and notify users via email for material changes.

Questions about this policy? Email us at kaanmutaf@gemkitstudio.com.