Privacy Policy

1. Who We Are (Data Controller)

MentisLeap LLC is the data controller for personal data collected from:

• Marketing site visitors
• Sellers (account holders)

For buyer data (download page visitors), MentisLeap LLC acts as a data processor on behalf of the seller, who is the data controller. Sellers determine how download pages are configured and whether buyer-initiated email capture is enabled. If you are a buyer with questions about how the seller uses your data, contact them directly via Etsy.

Contact: privacy@pickupmyfiles.com
Postal: 1021 E Lincolnway Suite #6605, Cheyenne, Wyoming 82001, United States

2. Marketing Site Visitors

2.1 What We Collect

When you visit pickupmyfiles.com, we and our analytics partners automatically collect:

2.2 Cookies and Tracking on the Marketing Site

Before you choose: Google Consent Mode may send limited, cookieless consent-state and measurement pings to Google while optional storage is denied. It does not read or write analytics or advertising cookies unless you accept.

Managing cookies: You can control cookies via your browser settings. Disabling analytics cookies does not affect your ability to browse the site. You can also review or change your optional-cookie choice at any time.

2.3 How We Use Marketing Site Data

• Measure which content and traffic sources bring the most engaged visitors
• Identify UX friction points to improve the site
• Measure the effectiveness of our own advertising campaigns
• Comply with legal obligations

We do not sell marketing site visitor data for money. We disclose online identifiers and browsing activity to Google, Microsoft Clarity, Meta, and Pinterest for analytics and advertising measurement when you accept optional cookies. Depending on applicable law, this may be treated as sharing for cross-context behavioral advertising.

3. Sellers (Account Holders)

3.1 What We Collect

When you create and use a Pick Up My Files account, we collect:

3.2 How We Use Seller Data

3.3 Connected Account Data

When you connect Etsy or sign in with Google, we access those services using the credentials or OAuth tokens you grant. Specifically:

• Etsy sign-in (email_r): We receive the Etsy user identifier, email address, and name needed to create or access your Pick Up My Files account and the shop identity needed to confirm ownership. We do not store gender or birth date from Etsy.
• Etsy store connection (listings_r and listings_w): We read the shop identity and listing fields described in Section 3.1 to import and refresh your catalog and to power listing delivery. We write only to create, upload, replace, or remove listing delivery files and listing content you expressly manage through Pick Up My Files. The current connection does not request transactions_r, receipts, orders, fees, financial data, or buyer email access. We do not send Etsy API data to advertising or marketing platforms.
• Your public shop reviews (no additional permission): If you add a Reviews block to a download page, we read your shop’s public reviews and Etsy’s shop rating through Etsy’s API with Pick Up My Files’ own application key. We fetch them only when they are needed: when you add, edit, or publish the block, and when a buyer opens your page and our copy is more than 20 hours old. We keep only what the block shows, never the reviewer’s name or Etsy account identifier.

We obtain Etsy data only through Etsy’s authorized API and OAuth flows; we do not scrape Etsy. Etsy-derived listing content is displayed only while verified within the previous six hours. Other Etsy-derived shop or profile content is displayed only while verified within the previous 24 hours. A shop icon you choose to copy into your Brand Kit is your own Brand Kit image: it stays until you replace or remove it and is not refreshed from Etsy. At expiry, or when verification is missing, that content is suppressed. When a dependency-safe Etsy store disconnect completes, we delete the local store access and refresh tokens and imported listing cache. If Etsy sign-in remains linked, the stable Etsy identity and shop binding remain to provide login and prevent the same shop from being attached to another account. Disconnecting never deletes or changes the seller’s original Etsy listings or files.

3.4 Google API Data and Limited Use

Google data we receive is sign-in identity data only: the Google account identifier, email address, name and profile image. Pick Up My Files does not request access to your Google Drive or any other Google service, and the files you sell are stored by us, not in your Google account.

Google user data is used only to provide or improve user-facing features that are prominent in Pick Up My Files. We do not sell Google user data, use it for advertising or credit decisions, or use it to train generalized AI or machine-learning models. Human access is prohibited except when you affirmatively authorize support for a specific issue, when necessary to investigate abuse or a security incident, or when required by applicable law. Optional analytics and advertising measurement on pickupmyfiles.com is consent-based and separate from Google user data.

Pick Up My Files’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

On account closure, stored Google sign-in credentials are deleted immediately, and remote revocation is retried through an auditable restricted outbox if Google is temporarily unavailable. Encrypted backups containing deleted Google sign-in data age out within 30 days.

3.5 AI Apps You Connect

You can connect an AI app, such as Claude or ChatGPT, to your Pick Up My Files account. Nothing is connected unless you start it from the app, sign in to Pick Up My Files, and approve the connection on our consent screen, which names the app and lists what it will be able to do.

• What the app can receive: only what Pick Up My Files tools return when the app uses them for you, and only for your account. An app can confirm the connection; read your Brand Kit; read your listings, download pages, files, Bundles and product guides, including how much storage you use; and get a status report of your shop: what needs your attention, what changed since that app last asked, and totals for your listings, download pages, Bundles, files, download security, and plan, with the names of the listings, pages, and Bundles concerned. Download and visit numbers are totals only, for the shop or for one listing. Tools may return the names and details of the listings, pages, Bundles, files and guides in your account. AI app tools never change anything on Etsy, never delete anything, and never change your billing. When a tool shows a listing whose details are out of date, or copies your shop icon at your request, Pick Up My Files reads that data from Etsy the same way it does when you open those screens. Before any tool returns information about individual buyers, we will update this policy.
• What the app can change: only when you ask it to: your Brand Kit (except the logo; it can use your Etsy shop icon as the icon), your Bundles (create them, rename them and choose their files), your files (rename them, unpack ZIP files into separate files, and choose which to keep while you are over your storage allowance), your product guides (create them, change their text and choose which listings use them), what each listing delivers, and which download page each listing uses. Each change is checked and saved like one you make yourself in Pick Up My Files. Changes to a listing that is already delivering, or to a guide or Bundle it uses, show on your buyers’ download pages straight away. It cannot upload or delete files or images, delete Bundles or guides, remove what a listing delivers, its page or its guide, create download pages, or change anything on Etsy.
• Where that data goes: the app’s provider, for example Anthropic for Claude or OpenAI for ChatGPT, receives it because you asked the app to use Pick Up My Files. The provider handles it under its own terms and privacy policy; it is not our service provider.
• What we keep: the connection records listed in Section 3.1, including, for each app, when it last received a status report and that report’s totals, so the next report can say what changed. We do not receive your conversations with the app.
• Ending a connection: disconnect an app at any time in Settings, under Connected AI apps. Changing or resetting your password, or closing your account, ends every connection, and a connection you do not use for 90 days ends on its own. Pick Up My Files support may also end a connection or turn off AI apps for an account, for example to protect it.

4. Buyers (Download Page Visitors)

Buyers are people who arrive at a Pick Up My Files download page after purchasing a digital product on Etsy from a seller who uses our platform. Buyers do not have an account with us and do not agree to our Terms of Use.

We process buyer data as a data processor acting on the seller’s behalf. The seller is the data controller for buyer data.

4.1 What We Collect from Buyers

We do not require buyers to create an account, and we do not use buyer data for our own marketing.

4.2 How Buyer Data Is Used

• Delivering the purchased files to the buyer (the primary purpose of the page)
• Seller analytics: providing the seller with download counts, including by country, visit statistics, and buyer-initiated email capture rates
• Protecting downloads: short-lived download links, limits when one link is used far more than a buyer would use it, and location rules. We block places under sanctions because the law requires it of us; other countries are blocked only when the seller chooses to

4.3 No Advertising Forwarding from Buyer Pages or Etsy Data

We do not send buyer download-page events, captured buyer email addresses, Etsy order data, or other Etsy API data to a seller’s Meta, Google Ads, Pinterest, or other advertising or marketing account. We do not place seller advertising pixels on buyer download pages.

Optional analytics and advertising measurement on pickupmyfiles.com is separate and is used only to measure Pick Up My Files’ own marketing campaigns, subject to the visitor’s cookie choice as described in Sections 2 and 6. It does not use Etsy API data or buyer download-page activity.

4.4 Buyer Data Retention and Requests

• Download and visit event logs are retained for 24 months, then deleted
• Buyer information captured via the voluntary email-capture form is retained while the seller’s account is active and deleted within 90 days of the seller’s account closure

A buyer may ask the seller to remove a captured contact. The buyer may also email privacy@pickupmyfiles.com; we will route or carry out the request as the seller’s processor, subject to identity verification and applicable law.

4.5 Etsy Reviews Shown on Download Pages

A seller may show their shop’s public Etsy reviews on their download pages. These are reviews that Etsy buyers chose to publish on Etsy. We show the star rating, review text, month, the listing reviewed, and any photo the reviewer shared on Etsy, but never the reviewer’s name or Etsy identity. We process these reviews on the seller’s behalf, only to show them on that seller’s pages, and keep them only as described in Section 7. If a reviewer edits or removes a review on Etsy, download pages reflect it at the next refresh, and a review is never shown more than 24 hours after we last fetched it from Etsy. Questions about a specific review can be sent to privacy@pickupmyfiles.com.

5. How We Share Data

We do not sell personal data. We share data only as follows:

5.1 Service Providers (Sub-processors)

We use the following third-party service providers who process data on our behalf:

We enter into data processing agreements with each sub-processor as required by GDPR.

5.2 Sellers (For Buyer Data)

Download and visit events are shown to the seller through the seller’s analytics dashboard. When a buyer voluntarily submits information through an enabled capture form and gives the displayed consent, that information is stored in the seller’s Pick Up My Files contact list and can be exported by the seller. Buyer data is not forwarded to advertising platforms.

5.3 AI Apps You Connect

When you connect an AI app (Section 3.5), we send it the results of the Pick Up My Files tools it uses for you. You choose this sharing and can end it at any time in Settings.

5.4 Legal Requirements

We may disclose personal data if required by law, regulation, valid legal process (court order, subpoena), or government request, or if we believe in good faith that disclosure is necessary to protect rights, property, or safety.

5.5 Business Transfers

If MentisLeap LLC is acquired, merged, or sells substantially all of its assets, personal data may be transferred as part of that transaction. We will notify affected users by email before data is transferred under a materially different privacy policy.

6. Cookies in Detail

6.1 Essential Cookies

These cookies are necessary for the platform to function. They cannot be disabled without breaking core functionality.

6.2 Analytics Cookies (Marketing Site + Seller App)

These optional cookies are set only after you accept them. Before a choice, Google Consent Mode may send cookieless consent-state and measurement pings while analytics and advertising storage remain denied. You can opt out at any time through Your Privacy Choices.

6.3 Marketing Cookies (Marketing Site + Seller App)

These optional cookies are set only after you accept: Meta on pickupmyfiles.com and in the seller app, Pinterest on pickupmyfiles.com only. They are never set on buyer download pages. In the seller app they receive the page address and our own sign-up and purchase events, never your Etsy shop or listing data.

6.4 Managing Cookies

• Browser settings: You can block or delete cookies in your browser settings. Note that blocking essential cookies will prevent login and core platform functions.
• Global Privacy Control: We honor a browser Global Privacy Control signal as an opt-out of optional analytics and advertising cookies. It overrides a stored acceptance choice while the signal is enabled.
• Your Privacy Choices: To review or change your optional-cookie choice, open Cookie Settings. This immediately applies denied consent until you make a new choice. When Global Privacy Control is enabled in your browser, that setting remains in effect.

7. Data Retention

8. Data Security

We implement industry-standard security measures including:

• Encryption in transit: TLS 1.2+ on all surfaces
• Encryption at rest: databases and file storage are encrypted at rest
• Authentication security: hashed passwords (bcrypt), short-lived OAuth access tokens, encrypted OAuth refresh tokens, AI app connections signed in with OAuth and PKCE using refresh tokens that change on every use, CSRF protection, secure session cookies (HttpOnly, SameSite)
• Access controls: least-privilege database access; seller accounts are isolated by multi-tenancy controls
• Private delivery: seller files are never public. Every buyer download uses a short-lived link tied to that buyer's download page, and storage locations are never exposed.
• Malware scanning: uploaded files are scanned before any buyer can download them.
• Monitoring: application errors and anomalies are logged and reviewed; Stripe handles PCI-DSS compliance for payment data

No system is perfectly secure. In the event of a data breach affecting your personal data, we will notify affected users and relevant supervisory authorities as required by applicable law. If a breach affects data we received through the Etsy API, we notify Etsy and the affected sellers within 24 hours of discovering it.

9. Your Rights

9.1 All Users

You may:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account (subject to legal retention obligations in Section 7)
• Export your data in a portable format (account data and analytics)
• Unsubscribe from marketing emails at any time via the unsubscribe link in any email or by emailing privacy@pickupmyfiles.com

9.2 EEA / UK / Swiss Users (GDPR and equivalent)

If you are located in the EEA, UK, or Switzerland, you have additional rights under GDPR (or the UK GDPR / Swiss DPA):

• Right of access (Art. 15): Receive a copy of the personal data we process about you
• Right to rectification (Art. 16): Have inaccurate data corrected
• Right to erasure / “right to be forgotten” (Art. 17): Request deletion of your data where we have no overriding legal basis to retain it
• Right to restriction of processing (Art. 18): Request that we limit how we use your data while a dispute is resolved
• Right to data portability (Art. 20): Receive your data in a machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests, including profiling
• Rights related to automated decision-making (Art. 22): We do not make solely automated decisions with significant legal effects on individuals

To exercise any right: email privacy@pickupmyfiles.com with your name, account email, and a description of the request. We will respond within 30 days.

Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority. In the EEA, find your authority at edpb.europa.eu. In the UK, contact the ICO.

9.3 Lawful Bases for Processing (GDPR)

9.4 California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) / CPRA:

• Right to know: What categories and specific pieces of personal data we collect about you, and how we use and share it
• Right to delete: Request deletion of personal data we hold about you, subject to exceptions
• Right to correct: Request correction of inaccurate personal data
• Right to opt out of sale or sharing: Optional advertising disclosures to Google, Meta, and Pinterest may be treated as sharing for cross-context behavioral advertising under applicable law. Use Your Privacy Choices or a browser Global Privacy Control signal to opt out.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

To exercise other applicable CCPA rights, contact us at privacy@pickupmyfiles.com with the subject “CCPA Request.”

10. International Data Transfers

MentisLeap LLC is based in the United States. If you are located outside the US, your data is transferred to and processed in the US.

For EEA/UK users, transfers to the US rely on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (for transfers to our US sub-processors)
• The sub-processor’s participation in the EU-US Data Privacy Framework (where applicable)

We enter into data processing agreements with all sub-processors that include appropriate transfer mechanisms.

11. Children’s Privacy

The platform is intended for business use by persons aged 18 and older. We do not knowingly collect personal data from anyone under 18. If we become aware that a person under 18 has created an account, we will delete that account and its associated data promptly.

If you believe a minor has used the platform, please notify us at privacy@pickupmyfiles.com.

12. Third-Party Links

The marketing site and seller platform may contain links to third-party websites (including Etsy, Google, Meta, and others). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policy of any site you visit.

13. Changes to This Policy

We may update this Privacy Policy at any time. We will notify you of material changes by email (for registered users) and by posting a notice on the site at least 14 days before the change takes effect.

The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the platform after the effective date of a revised policy constitutes acceptance of the changes.

14. Contact

For privacy questions, data subject requests, or to exercise your rights:

MentisLeap LLC
Wyoming, USA
Email: privacy@pickupmyfiles.com
Support: support@pickupmyfiles.com

For legal matters related to these policies:
Email: legal@pickupmyfiles.com