SPARCORP VENTURES LTD.
Privacy notice
Updated October 1, 2026.
Pick List is operated by SparCorp Ventures Ltd. Contact Chris Sparling at chris@tiny.com about privacy. This notice covers picklistkit.com and the public sample-data demo at app.picklistkit.com, the authorized Ecwid development app at pick-list-development.onrender.com, and the merchant app at pick-list-production.onrender.com.
The public demo uses sample orders and does not connect to your Ecwid store or start a subscription. The connected merchant app uses your store’s authorized Ecwid access. Pick List is available through the Ecwid App Market.
Website visits
Our website code includes no advertising pixels, analytics scripts, signup forms or tracking cookies. The small example on the homepage runs in your browser using fixed sample data. It does not upload your selections. The website is hosted through OpenAI Sites. Hosting providers may process IP addresses, request information and security logs to deliver and protect their services under their own policies.
The public demo
The app is hosted on Render in Oregon, United States. It serves synthetic orders and saves the batches and found quantities you create. A necessary, private HttpOnly cookie identifies your demo workspace for up to 90 days. Clearing it starts a new workspace; it does not immediately erase the earlier server records. The connected Ecwid apps use store authentication and separate databases from the public demo.
Saved batches and their order reservations expire 90 days after creation. Demo workspace records expire after 90 days. The app also records workspace identifiers, event times, recruitment-source labels when supplied, and counts of orders, units and picking lines. Usage events expire after 90 days. Source attribution can remain until the workspace is deleted. We use this information to operate the demo and understand whether its features are useful.
Data used by the Ecwid integration
In an authorized Ecwid store, the integration reads order references, dates, payment and fulfillment status, physical line items, SKUs, selected product options, quantities, shipping-method names and customer order notes. Notes and personalization can contain personal information. The application does not request customer email addresses, postal addresses, payment details or private admin notes.
The app uses an Ecwid store identifier, temporary access token and subscription status to authorize access. Access tokens are kept in server memory for sessions of up to one hour and are not saved in the application database. Saved live picking snapshots are encrypted with a server-held key; order identifiers, batch status, dates and counts remain database metadata. Store history is kept for 90 days from batch creation. We record the store ID, accepted merchant terms version and acceptance time until uninstall or deletion. Service usage records contain store IDs, event times and counts of orders, units and picking lines, and expire after 90 days. The app reads orders; it does not change stock, fulfillment status or customer records.
Support and other recipients
If you email us, we receive your email address, message and any attachments, and use them to respond and manage the issue. Contact links open your email application and do not subscribe you to marketing. Support correspondence is handled through our email service; it is separate from the app’s 90-day batch retention. You can ask us to delete correspondence that is no longer needed.
Our service providers process information to host, secure and support the service. The marketing website uses OpenAI Sites; the application uses Render; encrypted database backups and minimal deletion records are stored in private Cloudflare R2 storage; Ecwid/Lightspeed provides the merchant platform and manages merchant app subscriptions. Processing can occur outside your country, including in the United States. We do not sell personal information or use it for advertising. Information may also be disclosed where required by law or necessary to investigate misuse or protect the service.
Deletion, exports and backups
In the connected Ecwid app, a verified Ecwid uninstall or personal-data removal notification revokes sessions and deletes the store’s saved batches, reservations, usage, attribution and terms acceptance. A customer deletion notification clears all of that store’s saved batches because the app keeps no customer index. Minimal lifecycle records are retained for up to 90 days and webhook identifiers for up to two days to handle retries. A separate deletion record contains only the store ID, event ID and timestamps, so recovery can reapply deletion requests. Delivered deletion records expire after 90 days; records awaiting backup delivery remain until that delivery succeeds. Recovery applies deletion records and a current deletion review before restoring data.
Automated encrypted database backups are stored in private Cloudflare R2 storage for recovery. We target daily snapshots and remove app-managed snapshots older than seven days. Provider expiration is asynchronous. Backup encryption keys are held separately from the backup storage. Minimal deletion records are retained separately so older snapshots can be restored without bringing back deleted store data.
Hosting recovery copies may retain data after removal from the active database. Render separately documents daily disk snapshots retained for at least seven days; this is not a promise that all provider recovery copies are erased within seven days. Files you download, print or share remain under your control and cannot be recalled by the app.
Your questions and requests
Contact chris@tiny.com to request access, correction or deletion, or to raise a concern. For a demo request, include a batch reference if available, but not your cookie. We may need to verify that you control the relevant workspace or store before providing information. If you are a merchant’s customer, contact that merchant first so the request can be connected to the correct store. Rights and available remedies depend on the laws that apply to you.
Changes and provider information
We will update this notice as the service changes and provide the applicable app notice before merchant installation. Provider information: OpenAI privacy policy, Render privacy policy, and Render disk retention documentation.