Privacy Policy
Last updated: 26 October 2026
Who we are
nybld is a service operated by nybld Limited, a company registered in England and Wales (company number 17399787), registered office 66 Paul Street, London EC2A 4NA ("nybld", "we", "us").
We are the controller of the personal data described in this policy. That means we decide why and how your data is used.
You can reach us about anything in this policy, including any request about your data, at mail@nybld.com.
Who this service is for
nybld is for business users aged 18 or over. We do not offer the service to, or knowingly collect data from, anyone under 18. If you believe someone under 18 has created an account, contact us at mail@nybld.com and we will close it.
What we collect and why
We only collect what the service needs to work. The table sets out what we collect, why, and the lawful basis we rely on under the UK GDPR.
| What we collect | Why | Lawful basis |
|---|---|---|
| Your email address (for sign-in by magic link) | To create your account, sign you in and contact you about the service | Performance of our contract with you |
| Images you upload, and the prompts and creative direction you enter | To produce your listing files, mockups and listing copy | Performance of our contract with you |
| Files you upload for one of your Etsy listings, and the Drive links you add for its download | To enable us to build and maintain a complete listing for use across all nybld features | Performance of our contract with you |
| Your listing history and credit balance | To run your account and show you your work | Performance of our contract with you |
| Connection tokens for the third-party accounts you link (such as Etsy, Google Drive and your Shopify store) | To carry out the actions you ask for on those accounts | Performance of our contract with you |
| Your turnkey store's details, if you buy one: its name, your logo, your domain and where it is registered, and for an Etsy import the Etsy listings you choose (their words, pictures and prices) and the download links you add | To build your store, make your logo and connect your domain | Performance of our contract with you |
| Records of your purchases and subscription | To take payment, grant credits and keep required financial records | Performance of our contract, and our legal obligations |
| Basic usage and security information | To keep the service secure, prevent abuse and fix faults | Our legitimate interests in running a secure, reliable service |
| Reports and requests you send us from the app’s report button: what you write, the page you were on, the time, the app version and the most recent errors your browser recorded | To answer you, fix the faults you report and decide what to add to the service | Our legitimate interests in running and improving the service |
| How you use nybld.com, if you accept marketing cookies there: the pages you view and the buttons you press, the products you add to your cart or buy, and an identifier for your browser | To measure our ads on Facebook and Instagram, and to show them to people who have visited nybld.com | Your consent, which you can withdraw at any time |
| Marketing emails, if you opt in | To tell you about the service | Your consent, which you can withdraw at any time |
Your account identity is your email address — we do not ask for your name. To match your payments to your account we also store the customer ID that Shopify gives us when you buy. Shopify’s order notices also carry the name, address and phone number typed at checkout; we remove them before a notice is stored.
We do not take or store your card details. Payment is handled by Shopify as the payment processor; your card data goes to them, not to us.
AI and automated processing
nybld uses AI to build image prompts, to generate room pictures for your mockups, and to generate listing content (titles, tags, descriptions, alt text) from your artwork or, when you ask the Listing Manager to, from one of your Etsy listings as it stands. This is automated processing, but it does not make any decision that produces a legal or similarly significant effect about you. You review, edit and choose whether to use everything it produces. There is no solely automated decision-making of the kind that would give you rights under Article 22 of the UK GDPR.
Who we share it with
We use the third-party providers below to run the service. They only process your data on our instructions, for the purposes above.
| Provider | What they do | Where |
|---|---|---|
| Render | Hosts our application and database | Germany (Frankfurt) |
| Cloudflare (R2) | Stores your files | Western Europe |
| Deep-Image | Upscales your images | Poland |
| Claid | Upscales your images | United States |
| Anthropic | Describes the images you upload and generates prompt and listing content | United States |
| OpenAI | Generates the room pictures you ask for, and the logo options for a brand package | United States |
| Resend | Sends service emails | United States |
| Shopify | Runs the store and processes payments | Canada / United States |
| Seal Subscriptions | Manages memberships | Slovenia; data stored in Canada |
| Sentry | Receives error reports from the app so faults can be fixed | United States |
| Google (Google Workspace) | Hosts our email | United States and other countries |
Accounts you connect
Some of the services you use with nybld are your own accounts, which you connect and control. When you connect one and ask nybld to, we send your content there on your instruction:
-
Your Google Drive — where you connect it, nybld saves the files you create to your Drive. We use
drive.fileaccess only, so we can see only the files you create with nybld, nothing else in your Drive. - Your Etsy shop — where you connect it, the nybld Listing Manager sends the draft listings you build to your own shop for you to publish, shows you your shop’s existing listings, and saves the edits you make back to them. It never deletes a listing, and it cannot see your orders, your messages or your buyers’ information.
- Your own Shopify store — where you connect it, nybld creates and updates products in your store from the listings you send: their titles, descriptions, prices, tags, search-engine fields and images, and saves a download link onto the product so your buyers can be sent their files. It reads your products and collections so it can show them to you and file new listings correctly. It never deletes a product, and it cannot see your orders or your buyers’ information.
- Your own Gelato account — where you connect it, nybld sends Gelato the artwork and listing text for the products you choose, so Gelato can create those products in your store and print and post them when someone buys. The artwork is sent as a temporary private link to your file, and nybld reads your Gelato template so it knows the sizes and prices you set. Gelato is your supplier, not ours: your relationship with them, and their own privacy terms, govern what they do with it. nybld does not see your Gelato orders or your buyers’ information.
Your Etsy connection
When you connect your Etsy shop, nybld accesses only the data it needs to show and manage your own listings, to create the draft listings you ask for, and to copy the listings you choose into your turnkey store. In handling that data, nybld acts as your service provider and processes it only to provide those features — never for its own purposes. We do not use any data from your Etsy shop to train AI models or for analytics. When you press “Optimise SEO” on one of your listings, its current title, tags, description and pictures are sent to Anthropic to write the suggestion you then review; when you make new pictures for a listing, its title is sent with them to write their alt text. Nothing else from your shop is sent, nothing is kept for training, and nothing changes on Etsy until you press “Update on Etsy”.
If we ever discover that data accessed from your Etsy shop through Etsy’s API has been compromised, we will notify both Etsy (at dpo@etsy.com) and you within 24 hours of discovering it.
Your Shopify connection
When you connect your Shopify store, nybld accesses only the data it needs to create and update the products you send it and to file them correctly. In handling that data, nybld acts as your service provider and processes it only to provide those features — never for its own purposes. We do not use any data from your Shopify store to create, train, fine-tune or improve AI models, or for analytics; nybld’s AI features work only on the artwork and prompts you give us.
If we ever discover that data accessed from your Shopify store through Shopify’s API has been compromised, we will notify both Shopify and you within 24 hours of discovering it.
If you uninstall nybld from your store, we delete the data we hold from that store — the connection, its access token and the record of which products in your store came from nybld — within 30 days. Your listings, artwork and files in nybld are your own and stay with your account; uninstalling the app does not close it.
If you buy a turnkey store, we keep collaborator access to it for 30 days after we transfer it to you, to connect your domain and fix anything that needs it, and then remove that access; you can remove it sooner from your Shopify admin. That access does not include your customers or your orders. While we have it we act as your service provider, as above.
Advertising on Facebook and Instagram
nybld.com, our website and store, uses Meta’s pixel. If you accept marketing cookies there, the pixel records the pages you view and the buttons you press, and the products you add to your cart or buy, with an identifier for your browser, and sends them to Meta Platforms, Inc. We use this to measure our ads and to show them to people who have visited nybld.com. If you decline, the pixel does not run and nothing is sent. You can change your choice at any time from “Cookie preferences” at the foot of any page on nybld.com. The nybld app has no Meta pixel, and nothing from your nybld account, your artwork or the accounts you connect is sent to Meta.
For collecting this information and sending it to Meta, nybld and Meta Platforms, Inc. are joint controllers under Article 26 of the UK GDPR. We have entered into Meta’s UK Controller Addendum, which sets out who is responsible for what: we are responsible for asking your consent and for telling you about it, and Meta is responsible for your rights over the information it holds once it has received it, which it uses as an independent controller. Meta’s identity and contact details, the legal basis it relies on, and how to exercise your rights with Meta are in Meta’s Privacy Policy at facebook.com/about/privacy. You can also contact us at mail@nybld.com.
We do not sell your personal data for money. The only data we share for advertising is information about visits to nybld.com, and only with your consent, as set out under “Advertising on Facebook and Instagram”.
Sending data outside the UK
Our application and database are hosted in Frankfurt, Germany, and your files are stored in Western Europe. The UK recognises every country in the European Economic Area as giving adequate protection, so data held there, and data sent to Deep-Image in Poland and Seal in Slovenia, needs no further safeguard. Several providers are based in, or reach your data from, other countries, mostly the United States. Where your data goes to a country without UK "adequacy" regulations, we rely on an approved safeguard so it stays protected:
- Render, Cloudflare, Resend, Sentry — the UK Extension to the EU–US Data Privacy Framework, backed by Standard Contractual Clauses with the UK Addendum, as set out in each provider’s data-processing terms.
- Anthropic — Standard Contractual Clauses with the UK Addendum, as set out in Anthropic’s Data Processing Addendum.
- Google — the UK Extension to the EU–US Data Privacy Framework, and Standard Contractual Clauses where needed, as set out in Google’s Cloud Data Processing Addendum.
- Meta — Meta Platforms, Inc. receives information about visits to nybld.com only if you accept marketing cookies there. The transfer is covered by Standard Contractual Clauses with the UK Addendum, as set out in Meta’s UK Data Transfer Addendum.
- OpenAI — Standard Contractual Clauses with the UK Addendum, as set out in OpenAI’s Data Processing Addendum. It receives only the description of the room you ask for, or for a brand package your store's name and the style you choose, with no account details attached.
- Shopify — Standard Contractual Clauses and the UK Addendum through Shopify International Ltd. (Ireland), with onward transfer to Shopify Inc. in Canada, which the UK recognises as adequate.
- Seal Subscriptions — operated from Slovenia, with data stored in Canada. The UK recognises Canada as providing adequate protection for data held by commercial organisations, so no further safeguard is needed.
- Deep-Image and Claid — each receives only the image being upscaled, through a short-lived link, with no account details attached. Because neither receives anything that identifies you, this is not a transfer of your personal data and these safeguards do not apply to it.
When you send your own content to your Google Drive, your Etsy shop or your Shopify store, you are sending it to your own connected account, at your instruction and as part of the service you asked us to provide.
You can ask us for more detail on any of these safeguards at mail@nybld.com.
How long we keep it
Each kind of record is kept for a set period, then deleted:
- Your account, listings and files — while your account is open. When you ask us to delete your account, at mail@nybld.com, they are deleted with it.
- Records of your payments and subscription — 6 years from the end of the last financial year they relate to (ours ends on 31 August), as UK company and tax rules require.
- What you agreed to at checkout, and the confirmation email that repeated it — 6 years after your membership ends, the period in which a claim about the contract can be brought. These are kept if you delete your account.
- The order notices Shopify sends us — 90 days, without the name, address and phone number they carry.
- Reports and requests you send from the app — while your account is open. They are deleted with it.
- Activity records, the log of what happened in your account that we use to fix faults — 12 months.
- Sign-in links and sessions — deleted once they expire.
Your rights
Under the UK GDPR you have the right to: be told how your data is used; get a copy of it; have it corrected; have it deleted; restrict or object to how we use it; get it in a portable form; and, where we rely on your consent, withdraw that consent at any time.
To exercise any of these, email mail@nybld.com. We will respond within the time the law allows.
If you are unhappy with how we handle your data you can complain to a data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk).
If you are in California
If you are a California resident, the California Consumer Privacy Act gives you the right to: know what personal information we collect and why; access a copy of it; have it deleted; have it corrected; and not be discriminated against for exercising these rights. If you accept marketing cookies on nybld.com, information about your visit is shared with Meta for cross-context behavioural advertising, which California law calls “sharing”. You can opt out at any time from “Cookie preferences” at the foot of any page on nybld.com. We do not sell your personal information for money, and nothing from your nybld account is shared. The categories we collect and our purposes are set out in "What we collect and why" above. To make a request, email mail@nybld.com.
Cookies
For what cookies nybld and the nybld store use, and why, see our Cookie Notice.
Changes to this policy
If we change this policy we will update the date at the top and, where the change is significant, tell you by email.