Privacy Policy

1. Who We Are (Data Controller)

MentisLeap LLC is the data controller for personal data collected from:

• Marketing site visitors
• Sellers (account holders)

For buyer data (download page visitors), MentisLeap LLC acts as a data processor on behalf of the seller, who is the data controller. Sellers determine how download pages are configured and whether buyer-initiated email capture is enabled. If you are a buyer with questions about how the seller uses your data, contact them directly via Etsy.

Contact: privacy@pickupmyfiles.com
Postal: 1021 E Lincolnway Suite #6605, Cheyenne, Wyoming 82001, United States

2. Marketing Site Visitors

2.1 What We Collect

When you visit pickupmyfiles.com, we and our analytics partners automatically collect:

2.2 Cookies and Tracking on the Marketing Site

Before you choose: Google Consent Mode may send limited, cookieless consent-state and measurement pings to Google while optional storage is denied. It does not read or write analytics or advertising cookies unless you accept.

Managing cookies: You can control cookies via your browser settings. Disabling analytics cookies does not affect your ability to browse the site. You can also review or change your optional-cookie choice at any time.

2.3 How We Use Marketing Site Data

• Measure which content and traffic sources bring the most engaged visitors
• Identify UX friction points to improve the site
• Measure the effectiveness of our own advertising campaigns
• Comply with legal obligations

We do not sell marketing site visitor data for money. We disclose online identifiers and browsing activity to Google, Microsoft Clarity, Meta, and Pinterest for analytics and advertising measurement when you accept optional cookies. Depending on applicable law, this may be treated as sharing for cross-context behavioral advertising.

3. Sellers (Account Holders)

3.1 What We Collect

When you create and use a Pick Up My Files account, we collect:

3.2 How We Use Seller Data

3.3 Connected Account Data

When you connect Etsy or Google Drive™, we access those services using the credentials or OAuth tokens you grant. Specifically:

• Etsy sign-in (email_r): We receive the Etsy user identifier, email address, and name needed to create or access your Pick Up My Files account and the shop identity needed to confirm ownership. We do not store gender or birth date from Etsy.
• Etsy store connection (listings_r and listings_w): We read the shop identity and listing fields described in Section 3.1 to import and refresh your catalog and to power listing delivery. We write only to create, upload, replace, or remove listing delivery files and listing content you expressly manage through Pick Up My Files. The current connection does not request transactions_r, receipts, orders, fees, financial data, or buyer email access. We do not send Etsy API data to advertising or marketing platforms.
• Google Drive: We receive a provider grant that permits Pick Up My Files to view and manage files in Google Drive. Before setup, the folder chooser may browse Google Drive. After setup, routine operations are limited to the seller-selected managed or adopted root and its descendants. We process access tokens, encrypted refresh tokens, cached metadata and hierarchy, thumbnails, change identifiers, request-temporary content, and generated package artifacts. Files are delivered to buyers through Pick Up My Files without exposing raw Google Drive URLs.

We obtain Etsy data only through Etsy’s authorized API and OAuth flows; we do not scrape Etsy. Etsy-derived listing content is displayed only while verified within the previous six hours. Other Etsy-derived shop or profile content is displayed only while verified within the previous 24 hours. At expiry, or when verification is missing, that content is suppressed. When a dependency-safe Etsy store disconnect completes, we delete the local store access and refresh tokens and imported listing cache. If Etsy sign-in remains linked, the stable Etsy identity and shop binding remain to provide login and prevent the same shop from being attached to another account. Disconnecting never deletes or changes the seller’s original Etsy listings or files.

3.4 Google API Data and Limited Use

Google sign-in identity data is separate from Google Drive data. You may use different Google accounts for sign-in and storage, unlink Google sign-in without disconnecting Google Drive, and disconnect Google Drive without removing Google sign-in.

Google user data is used only to provide or improve user-facing features that are prominent in Pick Up My Files. We do not sell Google user data, use it for advertising or credit decisions, or use it to train generalized AI or machine-learning models. Human access is prohibited except when you affirmatively authorize support for a specific issue, when necessary to investigate abuse or a security incident, or when required by applicable law. Google Drive screens and file data are masked from session-recording tools. Optional analytics and advertising measurement on pickupmyfiles.com is consent-based and separate from Google Drive user data.

Pick Up My Files’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

On successful Google Drive disconnect or account closure, active Google Drive credentials are deleted from the connection immediately. Remote revocation is retried through an auditable restricted outbox if Google is temporarily unavailable. Cached Google Drive metadata is purged within 24 hours; request-temporary files are deleted after success or failure; selection packages expire after 24 hours; other generated packages expire after seven days; and encrypted backups containing deleted Google data age out within 30 days. Disconnect and account closure never delete original files from your Google Drive.

We do not access connected accounts for any purpose beyond providing the services you have configured.

4. Buyers (Download Page Visitors)

Buyers are people who arrive at a Pick Up My Files download page after purchasing a digital product on Etsy from a seller who uses our platform. Buyers do not have an account with us and do not agree to our Terms of Use.

We process buyer data as a data processor acting on the seller’s behalf. The seller is the data controller for buyer data.

4.1 What We Collect from Buyers

We do not require buyers to create an account, and we do not use buyer data for our own marketing.

4.2 How Buyer Data Is Used

• Delivering the purchased files to the buyer (the primary purpose of the page)
• Seller analytics: providing the seller with download counts, visit statistics, and buyer-initiated email capture rates

4.3 No Advertising Forwarding from Buyer Pages or Etsy Data

We do not send buyer download-page events, captured buyer email addresses, Etsy order data, or other Etsy API data to a seller’s Meta, Google Ads, Pinterest, or other advertising or marketing account. We do not place seller advertising pixels on buyer download pages.

Optional analytics and advertising measurement on pickupmyfiles.com is separate and is used only to measure Pick Up My Files’ own marketing campaigns, subject to the visitor’s cookie choice as described in Sections 2 and 6. It does not use Etsy API data or buyer download-page activity.

4.4 Buyer Data Retention and Requests

• Download and visit event logs are retained for 24 months, then deleted
• Buyer information captured via the voluntary email-capture form is retained while the seller’s account is active and deleted within 90 days of the seller’s account closure

A buyer may ask the seller to remove a captured contact. The buyer may also email privacy@pickupmyfiles.com; we will route or carry out the request as the seller’s processor, subject to identity verification and applicable law.

5. How We Share Data

We do not sell personal data. We share data only as follows:

5.1 Service Providers (Sub-processors)

We use the following third-party service providers who process data on our behalf:

We enter into data processing agreements with each sub-processor as required by GDPR.

5.2 Sellers (For Buyer Data)

Download and visit events are shown to the seller through the seller’s analytics dashboard. When a buyer voluntarily submits information through an enabled capture form and gives the displayed consent, that information is stored in the seller’s Pick Up My Files contact list and can be exported by the seller. Buyer data is not forwarded to advertising platforms.

5.3 Legal Requirements

We may disclose personal data if required by law, regulation, valid legal process (court order, subpoena), or government request, or if we believe in good faith that disclosure is necessary to protect rights, property, or safety.

5.4 Business Transfers

If MentisLeap LLC is acquired, merged, or sells substantially all of its assets, personal data may be transferred as part of that transaction. We will notify affected users by email before data is transferred under a materially different privacy policy.

6. Cookies in Detail

6.1 Essential Cookies

These cookies are necessary for the platform to function. They cannot be disabled without breaking core functionality.

6.2 Analytics Cookies (Marketing Site + Seller App)

These optional cookies are set only after you accept them. Before a choice, Google Consent Mode may send cookieless consent-state and measurement pings while analytics and advertising storage remain denied. You can opt out at any time through Your Privacy Choices.

6.3 Marketing Cookies (Marketing Site Only)

These optional cookies are only set after acceptance on pickupmyfiles.com, not in the seller app or on buyer download pages.

6.4 Managing Cookies

• Browser settings: You can block or delete cookies in your browser settings. Note that blocking essential cookies will prevent login and core platform functions.
• Global Privacy Control: We honor a browser Global Privacy Control signal as an opt-out of optional analytics and advertising cookies. It overrides a stored acceptance choice while the signal is enabled.
• Your Privacy Choices: To review or change your optional-cookie choice, open Cookie Settings. This immediately applies denied consent until you make a new choice. When Global Privacy Control is enabled in your browser, that setting remains in effect.

7. Data Retention

8. Data Security

We implement industry-standard security measures including:

• Encryption in transit: TLS 1.2+ on all surfaces
• Encryption at rest: databases and file storage are encrypted at rest
• Authentication security: hashed passwords (bcrypt), short-lived OAuth access tokens, encrypted OAuth refresh tokens, CSRF protection, secure session cookies (HttpOnly, SameSite)
• Access controls: least-privilege database access; seller accounts are isolated by multi-tenancy controls
• File proxying: your Google Drive files are never exposed directly to buyers. All downloads route through our server, so Google Drive URLs and credentials remain private.
• Monitoring: application errors and anomalies are logged and reviewed; Stripe handles PCI-DSS compliance for payment data

No system is perfectly secure. In the event of a data breach affecting your personal data, we will notify affected users and relevant supervisory authorities as required by applicable law.

9. Your Rights

9.1 All Users

You may:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account (subject to legal retention obligations in Section 7)
• Export your data in a portable format (account data and analytics)
• Unsubscribe from marketing emails at any time via the unsubscribe link in any email or by emailing privacy@pickupmyfiles.com

9.2 EEA / UK / Swiss Users (GDPR and equivalent)

If you are located in the EEA, UK, or Switzerland, you have additional rights under GDPR (or the UK GDPR / Swiss DPA):

• Right of access (Art. 15): Receive a copy of the personal data we process about you
• Right to rectification (Art. 16): Have inaccurate data corrected
• Right to erasure / “right to be forgotten” (Art. 17): Request deletion of your data where we have no overriding legal basis to retain it
• Right to restriction of processing (Art. 18): Request that we limit how we use your data while a dispute is resolved
• Right to data portability (Art. 20): Receive your data in a machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests, including profiling
• Rights related to automated decision-making (Art. 22): We do not make solely automated decisions with significant legal effects on individuals

To exercise any right: email privacy@pickupmyfiles.com with your name, account email, and a description of the request. We will respond within 30 days.

Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority. In the EEA, find your authority at edpb.europa.eu. In the UK, contact the ICO.

9.3 Lawful Bases for Processing (GDPR)

9.4 California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) / CPRA:

• Right to know: What categories and specific pieces of personal data we collect about you, and how we use and share it
• Right to delete: Request deletion of personal data we hold about you, subject to exceptions
• Right to correct: Request correction of inaccurate personal data
• Right to opt out of sale or sharing: Optional advertising disclosures to Google, Meta, and Pinterest may be treated as sharing for cross-context behavioral advertising under applicable law. Use Your Privacy Choices or a browser Global Privacy Control signal to opt out.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

To exercise other applicable CCPA rights, contact us at privacy@pickupmyfiles.com with the subject “CCPA Request.”

10. International Data Transfers

MentisLeap LLC is based in the United States. If you are located outside the US, your data is transferred to and processed in the US.

For EEA/UK users, transfers to the US rely on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (for transfers to our US sub-processors)
• The sub-processor’s participation in the EU-US Data Privacy Framework (where applicable)

We enter into data processing agreements with all sub-processors that include appropriate transfer mechanisms.

11. Children’s Privacy

The platform is intended for business use by persons aged 18 and older. We do not knowingly collect personal data from anyone under 18. If we become aware that a person under 18 has created an account, we will delete that account and its associated data promptly.

If you believe a minor has used the platform, please notify us at privacy@pickupmyfiles.com.

12. Third-Party Links

The marketing site and seller platform may contain links to third-party websites (including Etsy, Google, Meta, and others). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policy of any site you visit.

13. Changes to This Policy

We may update this Privacy Policy at any time. We will notify you of material changes by email (for registered users) and by posting a notice on the site at least 14 days before the change takes effect.

The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the platform after the effective date of a revised policy constitutes acceptance of the changes.

14. Contact

For privacy questions, data subject requests, or to exercise your rights:

MentisLeap LLC
Wyoming, USA
Email: privacy@pickupmyfiles.com
Support: support@pickupmyfiles.com

For legal matters related to these policies:
Email: legal@pickupmyfiles.com