Chrome extension · STLSeller

Extension Privacy Policy

Last updated:

This policy explains how the Chrome extension “STLSeller Importer” (the “extension”) handles personal data and usage data. It complements the general STLSeller Privacy Policy, which still applies to your account and to the web app.

1. Who we are and how to reach us

The extension is offered by STLSeller, a platform operated by André Bisewski (tax ID available on request), based in Brazil. STLSeller is the controller of the data handled by the extension under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018).

Contact for privacy questions and to exercise your rights: support@stlflix.com.

2. What the extension does (single purpose)

The extension has a single purpose: to copy the Shopee Brasil listing you are viewing into a draft in your STLSeller account when you click the “Copiar para o STLSeller” button (“Copy to STLSeller”), which appears on shopee.com.br listing pages.

After the copy, you review and edit the draft in STLSeller and decide whether to publish it and where (Mercado Livre or Shopee). The extension does not publish anything to a marketplace, has no ads and only works on shopee.com.br. It has a small panel (click the extension icon) showing the account status, the sign-in form, “How to use” and the links to this policy and the terms.

STLSeller's own pages may ask the extension whether it is installed, in order to show that status in Settings. The reply carries only the extension's name and version. The extension does not send it to any server: it only goes back to the page, which uses it to show the status on screen.

3. Data the extension sends

The extension only sends data when you click “Copiar para o STLSeller”. At that moment it sends STLSeller the data of the listing that is open in the tab:

  • title, description, price, stock, brand and condition (new or used);
  • category, attributes, weight and dimensions, when the listing provides them;
  • the addresses (links) of the photos and the video, which STLSeller's servers download to keep a copy in the draft;
  • the variations: options, price, stock and SKU code of each combination;
  • the listing link, the Shopee shop and item identifiers, and the date and time of the reading.

This is the content Shopee shows to any visitor of the listing page. The draft created from it is linked to your STLSeller account.

When you are logged in to Shopee, the response the page receives also carries a block with data from your Shopee account. The extension discards that block in the browser itself, before anything is sent: it never leaves the tab and never reaches STLSeller.

To authenticate you, the extension also handles your STLSeller email and password (only if you sign in through the extension's panel or window) and your session token. See the section on sign-in and session.

4. How the extension reads the page

On shopee.com.br pages, the extension observes, from the moment the page loads, the listing response that the page itself has already received from Shopee. It keeps only that response, in the tab's memory (at most the last 5 listings opened), and no other request, cookie, header or page content. Nothing is sent before you click.

The extension makes no extra requests to Shopee, does not read other sites, does not crawl shops and does not copy several listings at once.

5. What the extension does not collect

The extension does not collect or send:

  • browsing history or the list of pages you visit;
  • the content of other pages or other sites (it only runs on shopee.com.br);
  • cookies, password or personal data from your Shopee account;
  • buyer data, orders or messages;
  • location, financial or health data, or what you type or click outside the extension's button.

6. Sign-in and session

The extension uses your STLSeller account. If you are already signed in to STLSeller in this browser, it reads the app's session cookie (only STLSeller's, never cookies from Shopee or other sites) and uses that session. When the session needs to be renewed, the extension writes the updated cookie back, so that your sign-in to the app stays valid.

If there is no session, the extension shows, in the icon's panel (or, if you prefer, in its own window; always an extension page, never the Shopee page), the form for you to sign in with your STLSeller email and password. These details are sent only to STLSeller's authentication service (Supabase Auth), over HTTPS. The password is not stored.

The session created by that sign-in is kept in chrome.storage.session, the browser's temporary storage area, and is erased when you close the browser. The panel and the sign-in window have a “Sair do STLSeller” (“Sign out of STLSeller”) option that erases this session. Tokens stay only in the extension's internal process and are never exposed to the Shopee page.

On the first copy, the extension shows a notice about your responsibility for the copied content. The date you accepted it is recorded in your STLSeller account, so the notice does not repeat, even in another browser.

7. Where the data is kept and who operates it

The data sent by the extension is processed by STLSeller's servers and stored in your account: the database and file storage are on Supabase, the API runs on Railway and the web app on Vercel. These providers act as processors, only to provide us with infrastructure services.

The listing's photos (up to 5) and video are downloaded by STLSeller's servers from Shopee's content network and stored in STLSeller's storage, alongside your draft. Your browser does not upload the files, only their addresses.

Some of these providers may process data outside Brazil. In that case, the international transfer takes place under the cases provided for in Article 33 of the LGPD, with the appropriate contractual safeguards. Copied content is only published to a marketplace by your own action, inside STLSeller.

8. Artificial intelligence (only if you ask)

The extension does not use artificial intelligence. Inside STLSeller, you can choose “Generate ad with AI” (or generate new images) from a copied draft. Only in that case are the draft's text and photos sent to the AI providers STLSeller contracts, currently OpenAI (text and images) and Google (images, through Gemini), to produce the result you asked for.

STLSeller does not use this content to train AI models and sends it through each provider's commercial interface (API), only to process your request. If you never ask for AI generation, nothing from the draft goes to these providers.

9. No ads, no sale of data and no telemetry

  • The extension shows no ads and does not use your data for advertising or profiling.
  • We do not sell your data or transfer it to third parties, except to the infrastructure processors and, only when you ask, to the AI providers described above, or when the law requires it.
  • The extension has no telemetry or analytics tools, does not track your browsing and does not load remote code: everything it runs is in the installed package.
  • The STLSeller website and web app, where you review drafts, are governed by the general Privacy Policy, not by this policy.

10. Limited Use statement

The use and transfer of information received by this extension adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

  • We use the data only for the extension's single purpose: creating the draft in your account and authenticating you.
  • We do not sell the data to third parties.
  • We do not use or transfer the data for purposes unrelated to the extension's single purpose.
  • We do not use or transfer the data to determine creditworthiness or for lending.
  • People do not read the data, except with your consent (for example, at your support request), for security or abuse reasons, to comply with the law, or when the data is aggregated and anonymized to operate the service.

11. Browser permissions and why they are needed

  • storage: keeps only in chrome.storage.session (never in local or sync) the session of whoever signs in through the extension's panel or window and the identifier of that window. It disappears when the browser is closed.
  • cookies: reads and, after renewing the sign-in, rewrites only the STLSeller app's session cookie, so you do not have to sign in again. It never reads cookies from Shopee or any other site.
  • Access to shopee.com.br: shows the button on listing pages and reads the listing data the page itself has already loaded, only when you click. No other Shopee country and no other site.
  • Access to STLSeller's app, API and authentication service: to send the copied listing and your session token in order to create the draft and authenticate you.

12. How long we keep data

Drafts created by the extension stay in your account until you delete them or ask for deletion. The extension's own session is erased when you close the browser (or when you use “Sair do STLSeller”). The date you accepted the notice is kept as long as your account exists.

Please note: when you delete a draft in My ads, the draft record is erased, but its photo and video files may remain in STLSeller's storage until your account is deleted or until you ask support to remove them (support@stlflix.com). Today there is no automatic removal of these files.

When the account is deleted, or on request, we erase the associated data and files within the timeframes of the general Privacy Policy. Technical operation and security logs, which do not include the listing's content, may be kept for as long as needed to operate and protect the service.

13. Your rights (LGPD)

As a data subject, you may request, under Article 18 of the LGPD:

  • confirmation that we process your data, and access to it;
  • correction of incomplete, inaccurate or outdated data;
  • anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
  • portability of your data;
  • information about whom we share data with, and withdrawal of consent where consent is the legal basis.

Write to support@stlflix.com. We reply within 15 business days, the same timeframe as the general Privacy Policy. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

14. Children

The extension and STLSeller are tools for sellers and are not intended for children or teenagers. We do not knowingly collect data from minors; if you believe this has happened, write to support@stlflix.com so we can erase it.

15. Security

  • All communication between the extension and STLSeller and its authentication service uses HTTPS.
  • The session token stays only in the extension's internal process and is never exposed to the Shopee page; the extension's screens are isolated from the page.
  • The password is typed only in the extension's own panel or window, never on the Shopee page, where page scripts could read it, and it is not stored.
  • The extension does not keep its own data permanently in the browser: it only uses the session area, erased when the browser closes. The app's sign-in cookie is STLSeller's own; the extension only reads and renews it.
  • Beyond the extension, the security measures described in STLSeller's general Privacy Policy apply.

16. Changes to this policy

We may update this policy, for example if the extension starts handling other data. The current version will always be on this page, with the date of the last update at the top.

17. Contact

Questions, data subject requests and privacy matters: support@stlflix.com.