Privacy Policy

PrintKit Anywhere ("PrintKit Anywhere," "the Service," "we," "us," "our") is a hosted software service operated by Big Chato's Apparel LLC, Reva, Virginia, USA. This policy explains what data the Service collects, why, how we protect it, how long we keep it, and how merchants and their customers can have it deleted.

This policy covers two groups of people:

• Merchants — print shops and businesses that register for PrintKit Anywhere and embed our design builders on their own websites.
• Customers (end shoppers) — a merchant's own customers, who use those embedded builders to design a product and submit an order/quote.

For the personal data of a merchant's customers, PrintKit Anywhere acts as a processor on behalf of the merchant (the controller). Merchants remain responsible for their own privacy notices to their customers; this policy describes what the Service does with the data on their behalf. For a merchant's own account information (their name, email, shop configuration, and billing records), Big Chato's Apparel is the controller for the purpose of providing and billing the Service.

---

1. Who we are

PrintKit Anywhere is built and operated by Big Chato's Apparel LLC, a working print shop in Reva, Virginia. We built PrintKit for our own storefront first and packaged it so any print shop can add the same builders to any website.

Privacy / data-request contact: support@printkit.tech

2. What data we collect and why

We collect only what the Service needs to do its job. We group it below.

a) Merchant account data

When you register, we store your shop name, email address, a securely hashed password, your email-verification status, and your shop configuration — which builder modules and products are enabled, your production settings (presses/machines, print areas, roll widths, cut-line spot color, turnaround/rush settings, pricing tiers, and file/quality preferences), and your publishable key. When you subscribe, we store a Stripe customer/subscription identifier and billing status (plan, trial end date, subscribed builders). Why: to create and secure your account, adapt each builder to your equipment, render your builders, and manage your subscription.

b) Customer-designed artwork and saved designs (end shopper)

When your customer designs a product in a builder, the Service processes their uploaded artwork and design state (text, images, placement, sizing, product/color/size selections). Why: to generate the production-ready print file and show live previews. Where the save/resume feature is enabled, a design may be stored so the customer can return to it, keyed to a lookup token.

c) Order / quote data for the work ticket (end shopper)

When your customer finishes a design and submits it, the Service captures the order details the builder collects — the customer name and contact email and the line items they configured (product, quantity, options) — and creates a quote in your dashboard together with the print specifications and the production file(s) generated by the builder. Why: you need to know who ordered what, and with which specs, in order to quote, print, and ship the job. This is the core purpose of the Service.

d) What we do NOT collect

• We do not collect or store payment-card data. The Service operates in quote mode and does not take payment from your customers; you collect payment through your own systems. Your subscription to PrintKit Anywhere is billed by Stripe, which handles your card data directly — we never see your full card number, CVV, or bank details.
• We do not build advertising profiles, we do not track shoppers across other websites, and we do not use your or your customers' data to train AI models.

3. How your data is stored and protected

Protecting merchant and customer data is core to how PrintKit Anywhere is built.

• Encryption in transit. All traffic runs over HTTPS/TLS.
• Encryption at rest (envelope encryption). Customer design states and uploaded artwork are encrypted at rest using AES-256-GCM. Each shop has its own random data key; that per-shop data key is itself stored wrapped (encrypted) by a master key that lives only in the server environment — never in the database and never in source control. A database dump alone therefore decrypts nothing.
• Hashed lookup tokens. Tokens used to resume a saved design or open a hosted quote are stored only as a SHA-256 hash; the raw token exists only in the link.
• Hashed passwords. Merchant passwords are stored only as salted scrypt hashes, never in plain text.
• Crypto-shredding on deletion. Because each shop's design data is encrypted with that shop's own key, deleting the shop's wrapped data key renders any remaining ciphertext for that shop permanently unreadable, in addition to deleting the underlying rows.
• Multi-tenant isolation. Each merchant's data is scoped to their own shop record; one merchant cannot access another merchant's configuration, designs, or orders.
• Access controls. Access to production systems is limited to Big Chato's Apparel personnel who need it to operate and support the Service.

4. How long we keep data (retention)

• Saved customer designs and artwork are retained only as long as needed to provide the Service to you and, where the auto-purge feature is enabled, are deleted after the retention window you choose (7, 30, or 90 days; default 30) by an automated job.
• Order/quote records and shop configuration are retained while your account is active, so you can operate your shop.
• On account closure, we delete your PrintKit Anywhere data as described in Section 5.

5. Your data-deletion and access rights (merchants and customers)

We honor data-access and data-deletion requests. Merchants can request access to or deletion of their PrintKit Anywhere data by contacting us at the address in Section 1; closing your account deletes your shop's records — configuration, designs, artwork, order/quote logs, and the shop's encryption key (crypto-shredding). Customers who want their data accessed or deleted should contact the merchant they ordered from (the controller); the merchant can trigger deletion through us, and anyone may also contact us directly at support@printkit.tech. We record deletion requests in an internal audit log so we can demonstrate they were received and actioned.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal data, and to appeal a decision. Residents of California (CCPA/CPRA), Virginia (VCDPA), and other U.S. states with comprehensive privacy laws, and individuals in the EU/UK (GDPR/UK GDPR), may exercise the rights their law provides by contacting us. We do not sell personal data or share it for cross-context behavioral advertising, so no "Do Not Sell" action is required, but you may still contact us with any request.

6. Sub-processors and hosting

We use a small number of trusted service providers to run the Service. We do not add sub-processors casually.

Hosting region: United States. The application server, database, and encrypted file storage are hosted on a Hostinger VPS in the United States.

We do not sell, rent, or trade merchant or customer data to anyone, and we do not share it except with the sub-processors above as needed to run the Service, or where required by law.

7. We do not sell your data

PrintKit Anywhere does not sell merchant or customer personal data, and does not share it for third-party or cross-context behavioral advertising. We never have and we don't intend to.

8. International users (GDPR / UK GDPR)

The Service is hosted in the United States. If you or your customers are in the EU, UK, or Switzerland, personal data will be transferred to and processed in the United States. Where required, such transfers are governed by the Standard Contractual Clauses and the safeguards described in our DPA. Merchants who are subject to the GDPR/UK GDPR act as controllers and should enter into our DPA, which reflects our processor obligations.

9. Cookies

PrintKit Anywhere uses a single, essential session cookie to keep merchants signed in to their dashboard. It is a strictly necessary cookie set with Secure and HttpOnly flags. We do not use advertising, analytics, or cross-site tracking cookies, and the embedded builders do not set tracking cookies on your customers.

10. Children's data

PrintKit Anywhere is a business tool for merchants and is not directed at children. We do not knowingly collect data from children under 13 (or the applicable age in your jurisdiction).

11. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above and, where appropriate, notify merchants through the app or by email. Continued use of the Service after a change means you accept the updated policy.

12. Contact us

Questions or privacy requests:

Big Chato's Apparel LLC — Reva, Virginia, USA
Privacy & support: support@printkit.tech