Privacy policy

1. What we collect

We collect the information needed to print and deliver your order and to run your account, and nothing that we do not use.

Account details: your email address, your name, and optionally your company name, plus a password we store only as a hash. Shipping and billing address, so we can deliver the order and calculate sales tax. Artwork uploads and the text you add in the design studio, which are your designs. Order history, including proofs, approvals, size breakdowns, payments and tracking numbers. Messages you send us by email or the contact form. Analytics data (pages visited, approximate location, device type) only if analytics is enabled on the site; see the cookie policy.

Payment card numbers are entered directly with our payment processor and never reach our servers. The payment record we keep is the processor's transaction id.

2. Why we collect it

To produce proofs, print your order, ship it, and show you its status. To keep your designs so you can reorder without uploading again. To send transactional email: order confirmation, the proof, shipping and tracking notices, and invoices. To answer support questions and resolve reprint claims. To meet tax, accounting and legal obligations. To understand how the site is used, in aggregate, if analytics is enabled.

We do not sell your personal information, and we do not send marketing email unless you have asked for it, which you can withdraw at any time.

3. Who we share it with

We share data only with the services needed to fulfil your order and run the site, and only what each one needs.

Stripe, our payment processor, receives your payment details and billing address to take payment. Resend, our email provider, receives your email address and the content of transactional emails so they can be delivered. Carriers (UPS, USPS, FedEx and DHL) receive your name, shipping address and phone number if given, so the package can be delivered. Our hosting and database providers store the site and its data. Where we use a printing partner for part of an order, they receive the design and the size breakdown, not your account details.

We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of customers and staff.

4. How long we keep it

Artwork and designs are kept so that you can reorder, until you ask us to delete them. Order records are kept for as long as tax and accounting law require, typically seven years. Account details are kept while your account exists. Support messages are kept for two years so we can follow up on prior issues. Analytics data, if enabled, is kept according to the retention setting of the analytics tool.

5. Cookies and local storage

We set a session cookie that keeps you signed in and a small cookie that shows your name in the header. Your unsent design and cart are stored in your browser's local storage until you check out. Artwork you upload in the studio is stored on our servers as soon as you upload it, under a random id, so it can be attached to your order. If analytics is enabled, Google Analytics sets its own cookies. Details, names and lifetimes are in the cookie policy.

6. Your rights

You can access, correct, export or delete your personal data by emailing [email protected] from the address on your account. We reply within 30 days. Deleting your account removes your designs and account details; order records that we must keep for tax purposes are retained but no longer linked to a usable account. You can also see and download your order history from your account page at any time.

Depending on where you live, you may have additional rights under state or national privacy law, including the right to know what we hold and the right to opt out of sales of personal data. We do not sell personal data, and we honor these requests wherever you are.

7. Children

The site is not intended for anyone under 16, and we do not knowingly collect personal information from children. If you believe a child has created an account or placed an order, contact [email protected] and we will delete the data.

8. Security

Connections to the site are encrypted, passwords are hashed, and card details are handled by our payment processor. No system is perfectly secure, so please use a strong password and tell us if you notice anything unusual on your account.

9. Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects how we use data you have already given us, we email account holders before it takes effect.

10. Contact

Privacy questions and requests: [email protected]. Post: Merch to Order LLC, 1209 N Orange St, Wilmington, DE 19801.