Effective July 20, 2026 · Last updated October 22, 2026
PrintKit ("the Service," "we," "us," "our") is a hosted software service operated by Big Chato LLC, doing business as Big Chato's Apparel and PrintKit, Madison, Virginia, USA. This policy explains what data the Service collects, why, how we protect it, how long we keep it, and how merchants and their customers can have it deleted.
This policy covers two groups of people:
For the personal data of a merchant's customers, PrintKit acts as a processor on behalf of the merchant (the controller). Merchants remain responsible for their own privacy notices to their customers; this policy describes what the Service does with the data on their behalf. For a merchant's own account information (their name, email, shop configuration, and billing records), Big Chato's Apparel is the controller for the purpose of providing and billing the Service.
PrintKit is built and operated by Big Chato LLC, which runs the Big Chato's Apparel print shop in Madison, Virginia. We built PrintKit for our own storefront first and packaged it so any print shop can add the same builders to any website.
Privacy / data-request contact: support@printkit.tech
We collect only what the Service needs to do its job. We group it below.
When you register, we store your shop name, email address, a securely hashed password, your email-verification status, and your shop configuration — which builder modules and products are enabled, your production settings (presses/machines, print areas, roll widths, cut-line spot color, turnaround/rush settings, pricing tiers, and file/quality preferences), and your publishable key. When you subscribe, we store a Stripe customer/subscription identifier and billing status (plan, trial end date, subscribed builders). Why: to create and secure your account, adapt each builder to your equipment, render your builders, and manage your subscription.
If you connect Webflow, Webflow gives PrintKit an access token for the sites you choose to authorize. We store that token encrypted at rest (sealed with a master key that lives only in the server environment), together with your Webflow user ID and email address, the list of sites you authorized (site ID, name and address), and, for each builder you add, which site and page it is on (IDs, page title and path) and the ID of PrintKit's registered script. We use the token only to list your sites and pages and to add or remove PrintKit's own builder script on the pages you pick. We do not read your page content, CMS items, forms, ecommerce data or other apps' code, and we never publish your site. Why: to show which Webflow account is connected and to put the builder where you asked. When you click Disconnect Webflow, we remove PrintKit's script from your pages, revoke the token at Webflow and delete this record. If you remove the app in Webflow instead, the token stops working and we delete it the next time PrintKit tries to use it.
If you install the app in Ecwid, Ecwid gives PrintKit an access token for your store. We store that token encrypted at rest, together with your Ecwid store ID, your store's name, address (URL) and currency, and the IDs of the "design your own" products PrintKit creates in your store. When an order containing a PrintKit design is created or changes, we read that order from Ecwid to see whether it was paid, refunded or cancelled and what was charged for each design; we record the Ecwid order number, the payment status and the amount, not the order's other contents. We do not change your orders, customers or other products. Why: to put designs into your Ecwid cart at your PrintKit price and to tell you when a design is paid (or on hold because the amount doesn't match). When you click Disconnect Ecwid, we delete PrintKit's products from your store and forget the store. If you uninstall the app in Ecwid, the token stops working and we delete it right away; we then ask you to delete PrintKit's products yourself, because Ecwid no longer lets us. If your PrintKit plan is billed through Ecwid, Ecwid handles the payment: we read your app subscription status (trial, active or suspended) from Ecwid and keep a record of the builders you chose and of the monthly charges we asked Ecwid to make for extra builders (amount, month, result). We never see your card or bank details.
When your customer designs a product in a builder, the Service processes their uploaded artwork and design state (text, images, placement, sizing, product/color/size selections). Why: to generate the production-ready print file and show live previews. Where the save/resume feature is enabled, a design may be stored so the customer can return to it, keyed to a lookup token.
When your customer finishes a design and submits it, the Service captures the order details the builder collects — the customer name and contact email and the line items they configured (product, quantity, options) — and creates a quote in your dashboard together with the print specifications and the production file(s) generated by the builder. Why: you need to know who ordered what, and with which specs, in order to quote, print, and ship the job. This is the core purpose of the Service.
Your customer may also add an optional phone number and a note to their quote. If you connect Stripe to get paid online and your customer pays by card, the email and delivery address they enter on Stripe's checkout page are saved with the order so you can ship it. These contact details are encrypted at rest with your shop's own key.
Under each builder your customers can send you a request instead of designing online. The form collects their name, email, an optional phone number, what they want, and their message. The Service stores the request encrypted at rest with your shop's own key and shows it only to you, in Orders → Requests; we email you that a request arrived, without your customer's details. Why: so your customer's request reaches you reliably, instead of depending on their own email app.
Protecting merchant and customer data is core to how PrintKit is built.
We honor data-access and data-deletion requests. Merchants can request access to or deletion of their PrintKit data by contacting us at the address in Section 1; closing your account deletes your shop's records — configuration, designs, artwork, order/quote logs, Order-direct requests, and the shop's encryption key (crypto-shredding). Customers who want their data accessed or deleted should contact the merchant they ordered from (the controller); the merchant can trigger deletion through us, and anyone may also contact us directly at support@printkit.tech. We record deletion requests in an internal audit log so we can demonstrate they were received and actioned.
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal data, and to appeal a decision. Residents of California (CCPA/CPRA), Virginia (VCDPA), and other U.S. states with comprehensive privacy laws, and individuals in the EU/UK (GDPR/UK GDPR), may exercise the rights their law provides by contacting us. We do not sell personal data or share it for cross-context behavioral advertising, so no "Do Not Sell" action is required, but you may still contact us with any request.
We use a small number of trusted service providers to run the Service. We do not add sub-processors casually.
| Sub-processor | Role | Data handled |
|---|---|---|
| Hostinger (VPS hosting) | Runs the application server and database and stores encrypted design/artwork files; also delivers our transactional email. | Encrypted customer designs/artwork, shop configuration, order/quote records, merchant account data. |
| Stripe | Processes merchant subscription billing. | Merchant billing contact and payment method (held by Stripe), subscription status. |
Hosting region: United States. The application server, database, and encrypted file storage are hosted on a Hostinger VPS in the United States.
We do not sell, rent, or trade merchant or customer data to anyone, and we do not share it except with the sub-processors above as needed to run the Service, or where required by law.
PrintKit does not sell merchant or customer personal data, and does not share it for third-party or cross-context behavioral advertising. We never have and we don't intend to.
The Service is hosted in the United States. If you or your customers are in the EU, UK, or Switzerland, personal data will be transferred to and processed in the United States. Where required, such transfers are governed by the Standard Contractual Clauses and the safeguards described in our DPA. Merchants who are subject to the GDPR/UK GDPR act as controllers and should enter into our DPA, which reflects our processor obligations.
PrintKit uses a single, essential session cookie to keep merchants signed in to their dashboard. It is a strictly necessary cookie set with Secure and HttpOnly flags. We do not use advertising, analytics, or cross-site tracking cookies, and the embedded builders do not set tracking cookies on your customers.
PrintKit is a business tool for merchants and is not directed at children. We do not knowingly collect data from children under 13 (or the applicable age in your jurisdiction).
If we make material changes to this policy, we'll update the "Last updated" date above and, where appropriate, notify merchants through the app or by email. Continued use of the Service after a change means you accept the updated policy.
Questions or privacy requests:
Big Chato LLC, doing business as PrintKit — Madison, Virginia, USA
Privacy & support: support@printkit.tech