Privacy Policy
Last updated: 28 September 2026
This policy explains what personal data NVC Books (“the Service”) collects, why, who it is shared with, how long it is kept and what rights you have. The Service is operated by Northvis, a sole proprietorship based in Pakistan (“Northvis”, “we”, “us”).
1. Who we are
Northvis
402 Garden Heights, New Garden Town, Lahore 54000, Pakistan
Email: info@northvis.com
If Northvis moves the Service to a UK company, we will update this policy and tell you before the change takes effect.
2. Our role for your data
- Your account data (your name, email, sign-in details and billing details): we decide how it is used, so we are the controller.
- Your shop and buyer data (your Etsy records, orders, and the names and addresses of the people who buy from you): we handle it only on your instructions, to provide the Service to you. For this data we act as your processor, and you, the seller, remain the controller.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, sign-in provider ID, the role you hold in your organisation | You, or Google when you sign in with Google |
| Shop and financial records | Shop name, currency, statement lines (sales, fees, taxes, refunds, deposits), cost of goods, expenses, payments and profit shares you enter | You (CSV upload and data entry), or Etsy when you connect a shop |
| Order details | Order number, date, items, quantities, prices, SKUs and listing IDs | Etsy, when you connect a shop |
| Buyer shipping details | Buyer name and delivery address | Etsy, and only for the purposes in section 5 |
| Billing | Subscription plan and payment status. Card details are held by our payment provider, never by us. | Our payment provider |
| Technical | IP address, browser type, and the time of each request, kept in server logs | Your browser |
| Support | Messages you send us | You |
4. Data from Etsy
If you choose to connect an Etsy shop, you sign in on Etsy's own website and approve access there. We never see your Etsy password. We request read-only access to:
- Shop details, to confirm which shop is connected and its currency;
- Transactions and payment records: orders, order items, payments, refunds and payment-account ledger entries, used to build your accounts;
- Listings: titles, SKUs and listing IDs, used to match orders to your products and their costs.
We use Etsy data only to provide the Service to the seller who connected the shop. We do not sell it, use it for advertising, combine it with data about other sellers, or use it for any purpose Etsy's API terms do not permit. We store the access tokens Etsy issues in encrypted form. You can disconnect at any time from within the Service, or by revoking access in your Etsy account settings. When you disconnect, we delete those tokens immediately.
Uploading a CSV statement is always an alternative. You do not have to connect your Etsy account to use the Service.
5. Your buyers' data
We keep as little buyer personal data as the Service needs:
- Etsy shipping labels. If you buy the postage label through Etsy, we do not store the buyer's name or address.
- Labels created through NVC Books. If you ask the Service to create a shipping label, we use the buyer's name and delivery address to create it. We share them only with the carrier or label provider you choose.
- Dropship orders. If you fulfil an order through a supplier, we send the buyer's name and delivery address to the supplier you have named for that product, so they can deliver the order.
Buyer names and addresses are kept only until the order is marked as shipped. They are then deleted within 30 days, unless you tell us to delete them sooner. We never use buyer data for marketing and never contact your buyers.
If you are a buyer and want to use your privacy rights, please contact the seller you bought from, because the seller controls your data. We will help that seller respond to you.
6. How we use data, and our legal basis
| Purpose | Legal basis (where UK or EU data protection law applies) |
|---|---|
| Providing the Service: importing statements, calculating profit, producing reports, creating labels and sending dropship orders | Performance of our contract with you |
| Billing and account management | Performance of contract |
| Keeping the Service secure, and preventing fraud and abuse | Our legitimate interests |
| Answering support requests | Performance of contract, or our legitimate interests |
| Service messages, such as a failed sync or a change to these terms | Performance of contract |
| Meeting legal, tax and accounting obligations | Legal obligation |
We do not use your data, or your buyers' data, to train AI models. We do not sell personal data.
7. Who we share it with
We share data only with service providers that help us run the Service. Each provider is bound to use the data only on our instructions:
- Hosting and infrastructure: the servers that run the Service and store its database and backups;
- Email delivery: for sign-in links and service messages;
- Payment processing: for subscriptions, once paid plans begin;
- Carriers and label providers that you choose, as described in section 5;
- Suppliers that you name for dropship orders, as described in section 5;
- People you invite, such as a client or team member you give access to a shop.
We may also disclose data where the law requires it. If Northvis's business is transferred, the data would pass to the new owner under this policy, and we would tell you first.
8. How long we keep it
- Buyer names and addresses: deleted within 30 days of the order being marked as shipped (see section 5).
- Etsy access tokens: deleted as soon as you disconnect the shop.
- Financial records (statement lines, costs, expenses and reports): kept while your account is open, because they are your books. If a subscription lapses, your account becomes read-only. Your records are kept so that you can still see and export them.
- After you ask us to close your account: we offer you an export, then delete your data within 30 days. Encrypted backups roll over and are erased within a further 35 days. We keep only what the law requires us to keep, such as invoices we issued to you.
- Server logs: up to 90 days.
9. Security
Data travels over encrypted connections (HTTPS). Etsy access tokens and buyer addresses are encrypted when stored. Each customer's data is kept separate at the database level. Access to production systems is limited to the people who need it. No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay, and notify any regulator where the law requires it.
10. International transfers
Northvis is based in Pakistan, and our servers or service providers may be in other countries. If you are in the UK or the European Economic Area, your data may therefore be processed outside it. Where the law requires it, we use appropriate safeguards, such as standard contractual clauses, to protect it.
11. Your rights
Depending on where you live, you may have the right to:
- access your data;
- correct it;
- delete it;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw consent where we rely on it.
Email info@northvis.com and we will respond within one month. If you are in the UK, you can also complain to the Information Commissioner's Office (ico.org.uk). In the EU, you can complain to your local data protection authority.
12. Cookies
This website sets no cookies. The Service uses only the cookies it needs to keep you signed in and secure. We use no advertising or tracking cookies, so we do not ask you to accept any.
13. Children
The Service is for businesses and is not intended for anyone under 18.
14. Changes to this policy
If we make a material change, we will email account holders at least 14 days before it takes effect, and update the date at the top of this page.
15. Contact
Questions about privacy: info@northvis.com, or by post to Northvis, 402 Garden Heights, New Garden Town, Lahore 54000, Pakistan.