Privacy policy
Maker's Assistant is a back-office dashboard and morning email for maker brands. It is made and run by 2LFCO (Two Little Fruits Co), in Denver, Colorado ("we", "us"). This page explains what data the app reads from the platforms you connect, why, where it's kept, who can see it, and how to remove it.
The short version
- We only read what the features need, and we only write to your store when you approve a listing change.
- Your data lives in your own separate database. No other client can see it.
- We never sell your data, never use it for advertising, and never contact your customers.
- We delete it within 30 days of cancelling, or sooner if you ask.
Who this covers
This policy covers the shop owner and staff who use a Maker's Assistant dashboard (our clients), and the store data we read on their behalf. That store data can include information about the client's own customers, such as names and addresses on orders. We handle that information only to produce the client's reports, as described below.
What we read from each platform
Each platform asks you to approve these permissions on its own sign-in page when you press Connect. We ask for nothing beyond this list.
| Platform | Permissions | What it's used for |
|---|---|---|
| Shopify | read_orders, read_products, read_inventory, read_locations, read_customers; write_products | Sales by channel, stock and reorder dates, telling wholesale orders from retail ones. write_products is used only to apply a listing change you have approved. |
| Etsy | shops_r, listings_r, listings_w, transactions_r | Sales, listing drafts. listings_w is used only to apply a listing change you have approved. |
| Faire | READ_BRAND, READ_ORDERS, READ_PRODUCTS, WRITE_PRODUCTS, READ_INVENTORIES, WRITE_INVENTORIES, READ_RETAILER, READ_SHIPMENTS | Wholesale sales, stock, listing drafts, and knowing which retailers buy from you. Write permissions are used only for changes you have approved. We don't read or send Faire messages. |
| Google Ads | adwords (reports only) | Ad spend and return for the ads and email report. |
| Meta | ads_read | Ad spend and return for the ads and email report. |
| Klaviyo | campaigns:read, flows:read, metrics:read, lists:read | Email campaign and flow results for the ads and email report. |
If a shop already uses another tool to edit its listings, we turn listing changes off entirely. The dashboard then shows suggestions only and never writes to the store.
What we keep about the people who sign in
- Name, email address and role (owner or staff), which the owner gives us at setup.
- A passkey's public key. You sign in with Face ID, Touch ID or your device's passkey. We never receive your fingerprint, face data or a password, because there isn't one.
- An action log: each sign-in, each AI request and each change, with the time and who did it. The owner can see this log.
Why we read it
Only to run the features you pay for: the morning email, sales by channel, stock and reorder dates, the ads and email report, and listing drafts. We don't build profiles of your customers, and we don't combine one client's data with another's.
Where it's stored
- Each client gets their own deploy on Cloudflare, with its own database and its own secret keys. There is no shared database across clients.
- The access tokens each platform gives us are encrypted at rest with AES-GCM, using a key unique to that client's deploy.
- We never ask for, receive or store your passwords for Shopify, Etsy, Faire, Google, Meta or Klaviyo.
- The morning email is sent from [email protected] through Cloudflare's email service, only to the people the owner names at setup.
AI features and Anthropic
Some features use Anthropic's Claude API: listing drafts, the one-line note in the morning brief, and questions you type into the dashboard's ask box. For those features only, we send Anthropic the store data that feature needs, such as a listing's current text and your brand voice notes, or the day's numbers for the brief.
Every AI request is checked against a monthly spending cap first and recorded in your action log after. When the cap is reached, AI features pause until the next month. Everything else keeps working. Anthropic processes this data under its commercial API terms.
What we never do
- We never sell your data or your customers' data.
- We never use it for advertising, ours or anyone else's.
- We never contact your customers, by email or any other way.
- We never share it with other clients.
Who at 2LFCO can see it
2LFCO is a small company. Brent, our founder, sets up and runs each client's deploy and is the only person with access to the Cloudflare account that holds it. We use AI tools, including Claude, under his supervision to help set up deploys and check that the numbers are right. We look at a client's data only to set up, check, fix or support their service.
How long we keep it
While you're a client, we keep what the features need. When you cancel, we delete your deploy, its database and the stored tokens within 30 days. You can also ask us to delete your data at any time, and we'll do it within 30 days of the request.
How to disconnect
You can cut off our access yourself at any time by removing the app on each platform. Once removed, we can't read anything new from that platform.
- Shopify: in your Shopify admin, open Settings, then Apps, and uninstall Maker's Assistant.
- Etsy: in your Etsy account settings, remove the app's access.
- Faire: in your Faire brand portal settings, remove the app from your connected integrations.
- Google Ads: in your Google Account, under third-party connections, remove the app.
- Meta: in Facebook settings, under Business Integrations, remove the app.
- Klaviyo: in your Klaviyo account's integrations, remove the app.
Menu names on these platforms change from time to time. If you can't find the setting, write to us and we'll walk you through it, or revoke access on our side.
Changes to this policy
If we change what we read or how we use it, we'll update this page, change the date at the top, and tell our clients by email before the change takes effect.
Contact
Questions or deletion requests: [email protected].