Privacy Policy

1. What we collect

Account and contact details. Your name, email address, brand name, password (stored only as a salted hash) and, if you sign in with Google, the name, email and profile picture Google shares with us.

Business details. Your ship-from name and address, phone number, tax or resale documents you send us, and branding assets — logos, neck labels, hang tags, inserts and packaging artwork.

Designs and files. Artwork you upload, prompts and reference images you give the design studio, the images it generates, mockups and the print files we render from them.

Orders. What you ordered, when, the price and its breakdown, production status, tracking numbers, problem reports and the photos you attach to them, and the shipping details of the person the order goes to — usually your customer: name, address, phone number and email address.

Payments. Stripe processes your payments. We store your Stripe customer ID, the card brand and last four digits, your plan, your invoices and your wallet ledger. We never see or store your full card number.

Connected stores. When you install our Shopify app or connect another store we receive the store's domain, an access token, the products we publish for you, the orders in that store that contain our products (including the buyer's shipping details), and fulfillment status. Section 5 explains this in detail.

Communications. Emails you send us, support requests, factory visit bookings and newsletter signups.

Usage and device data. When you visit our pages we and our analytics providers record your IP address, browser and device type, the pages you view, the link or ad that brought you here (including UTM parameters and click IDs), and cookie identifiers. See Section 7 on cookies and advertising.

2. How we use it

• To run your workspace: create and secure your account, save your designs, render print files, and show you your orders.
• To produce and ship your orders: print, embroider, pack, label and ship each piece, and hand the recipient's details to the carrier.
• To bill you: charge your card on file for orders, run your plan subscription (through Shopify's billing when your Shopify store is connected, otherwise through Stripe), keep invoices and the wallet ledger, and prevent fraud.
• To keep you informed: order received, expected ship date, shipped with tracking, running late, problem-report answers, plan and payment notices. These transactional emails are part of the service.
• To run the design studio: your prompts and images are sent to the AI provider that generates the result.
• To support you: answer questions, investigate problems and honor reprint and refund requests.
• To improve and protect the Platform: analytics, debugging, security monitoring, abuse prevention, and an audit log of administrative actions.
• To market our services to you, with your consent where required and always with an easy way to opt out.
• To comply with the law, enforce our terms and defend legal claims.

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases are: performing our contract with you; our legitimate interests in running, securing and improving the Platform and in reaching businesses that may want our services; your consent, where we ask for it (for example non-essential cookies); and our legal obligations.

3. Your customers' data

The shipping details of your customers reach us because you place an order for them or because a connected store sends us the order. We process this information on your behalf and on your instructions, as your service provider (a "processor" under the GDPR, a "service provider" under California law), and only to produce and ship the order, to handle problems with it, and to keep the records the law requires.

We do not use your customers' information to market to them, we do not sell it or share it for advertising, and we do not combine it with other sources to build profiles. Carriers receive the name, address and phone number needed to deliver the package. You are responsible for telling your customers, in your own privacy notice, that a fulfillment partner processes their details.

We delete or anonymize a customer's contact details 24 months after the order ships, sooner when you ask us to, and immediately when a store platform sends us a redaction request (Section 5).

4. Who we share it with

We share personal information only with the providers below, who process it for us under contracts that restrict how they use it, and with the people and authorities described afterwards. We do not sell personal information.

• Hosting and infrastructure: Vercel (application hosting) and Neon (database), both in the United States.
• File storage: Amazon Web Services (S3, US East) for artwork, print files, mockups, labels and photos.
• Payments: Stripe, for cards, charges, subscriptions and invoices.
• Email: Resend, for transactional email; Klaviyo, for the newsletter if you sign up for it.
• Shipping: Shippo and the carriers it connects to (USPS, UPS and others) to buy labels and track packages — they receive the recipient's name, address and phone number.
• AI generation: OpenAI and other model providers we may use receive the prompts and images you submit to the design studio. Under our API terms they do not use them to train their models.
• Sign-in and analytics: Google (Google sign-in, Google Analytics, Google Ads) and Meta (Meta Pixel) as described in Section 7.
• Store platforms: Shopify and any other platform you connect, which receive the products and fulfillment information we write back to your store.
• The factory floor: NYC Factory staff who print, check and pack your orders see the order, the artwork and the shipping label, and nothing more than they need.

We may also disclose information when the law requires it, to respond to lawful requests from authorities, to protect the rights, property or safety of NYC Factory, our merchants or others, and as part of a merger, financing or sale of our business, in which case the new owner is bound by this policy.

5. The NYC Factory app for Shopify

When a merchant installs our app, Shopify grants us an access token with these permissions: write products, read orders, write fulfillments (merchant-managed and assigned fulfillment orders) and read locations. We request access to protected customer data — name, address, phone and email of the buyer — for one purpose: fulfilling the orders that contain our products.

We use the token to publish the products you create, to receive webhooks for orders that contain our products, to push tracking numbers back as fulfillments, and to notice when the app is uninstalled. We store the store's domain, tokens (encrypted at rest), the products we published, and the orders we received. We do not read orders that contain none of our products, customer lists, or any other store data.

We honor Shopify's mandatory privacy webhooks: a customer data request is answered from the order records we hold for that buyer; a customer redaction removes the buyer's details from our records; a shop redaction, sent 48 hours after the app is uninstalled, deletes the store's tokens and the personal data we hold for that store, keeping only the accounting records the law requires.

Tokens are renewable, short-lived tokens, refreshed automatically; uninstalling the app revokes them. Merchants can also disconnect a store from the Stores page at any time, which stops all syncing.

6. How long we keep it

• Account data: while your account is open, and up to 90 days after you close it so you can reopen it, unless you ask for immediate deletion.
• Designs, artwork and print files: until you delete them or 12 months after your account closes.
• Orders, invoices and payment records: 7 years, as accounting and tax law requires.
• Your customers' contact details on orders: 24 months after shipping, then deleted or anonymized (earlier on request or on a platform redaction).
• AI prompts and generated images: until you delete them, or with your designs.
• Email log and support messages: 12 months.
• Server and security logs: 90 days.

7. Cookies, analytics and advertising

Essential cookies keep you signed in, protect forms and store connections against forgery, and remember choices such as the demo or admin mode. The Platform does not work without them.

Attribution. When you arrive from an ad or a link with tracking parameters (UTM tags, Google or Meta click IDs), we store them in a cookie for 90 days and save them on your account when you sign up, so we know which campaign brought you to us. This is used for our own reporting only.

Analytics and advertising. With your consent where the law requires it, we use Google Analytics to understand how our public pages are used, and the Google Ads and Meta Pixel tags to measure whether our advertising works — for example, that someone who saw an ad created an account or placed a first order. These tags set cookies and send Google and Meta your IP address, device information and the pages you visited on our public site, which those companies may combine with information from their own services. Under California law, this may count as "sharing" personal information for cross-context behavioral advertising.

Your choices. You can block or delete cookies in your browser, opt out of Google Analytics with the Google Analytics opt-out add-on, and manage ad personalization at Google Ads Settings and in your Meta ad preferences. To opt out of the advertising tags on our site, email sales@nycfactoryinc.com with the subject "Do not share". We do not currently respond to browser Do Not Track signals.

8. Security

All traffic to the Platform is encrypted with TLS. Files are stored in private storage and served through expiring links; databases and storage are encrypted at rest by our providers; store tokens are held in encrypted form; passwords are hashed; administrative access is limited to staff who need it and every administrative action is logged. No system is perfectly secure, so we cannot guarantee absolute security — if we learn of a breach affecting your data we will notify you as the law requires.

9. Your rights and choices

Depending on where you live you may have the right to access the personal information we hold about you, to correct it, to receive a copy in a portable format, to have it deleted, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You can update most account details yourself under Account settings, and you can close your account there or by emailing us.

California residents have the rights to know what personal information we collect, use and share; to delete it; to correct it; to opt out of the sale or sharing of personal information (we do not sell it; see Section 7 for sharing through advertising tags); to limit the use of sensitive personal information (we do not use it for anything beyond what this policy describes); and not to be discriminated against for exercising these rights. Residents of Virginia, Colorado, Connecticut, Texas, Oregon and other states with privacy laws have similar rights, including the right to appeal a decision we make about a request.

Residents of the EEA, UK and Switzerland may also lodge a complaint with their data-protection authority. We are based in the United States and process information there; where we receive information from those regions we rely on standard contractual clauses or another lawful transfer mechanism.

To exercise a right, email sales@nycfactoryinc.com with the subject "Privacy" from the address on your account, or write to 1109 Grand Ave, Unit #3, North Bergen, NJ 07047. We may ask for information to verify your identity, we respond within the time the applicable law allows (normally 30 days, 45 in California), and you may authorize an agent to act for you. If you are one of our merchants' customers, please contact the brand you bought from — they control your information and we act on their instructions.

Marketing. Every marketing email has an unsubscribe link. Transactional emails about your orders and account cannot be switched off while you use the Platform.

10. Children

The Platform is for businesses and adults. We do not knowingly collect personal information from anyone under 18, and we close accounts we learn belong to minors.

11. Other websites

The Platform links to store platforms, carriers, payment providers and other sites we do not control. Their privacy practices are their own.

12. Changes to this policy

We may update this policy as the Platform changes. We post the new version here with its effective date and, for material changes, notify account holders by email or in the workspace before it takes effect.

13. Contact

NYC Factory Inc. · 1109 Grand Ave, Unit #3, North Bergen, NJ 07047 · sales@nycfactoryinc.com (subject "Privacy").