Privacy Policy for AutoGangSheet (Pro)

Last updated: August 25, 2026

This Privacy Policy describes how your personal information is collected, used, and shared when you install or use AutoGangSheet (the "App") in connection with your Shopify-supported store, or when you use the AutoGangSheet gang sheet builder as a customer of one of our merchants.

1. Personal Information the App Collects

When you install the App, we are automatically able to access certain types of information from your Shopify account:

• Shop Information: Store name, shop domain, email address, and currency.
• Order Information: Order IDs, order numbers, line items (products ordered), quantities and amounts, for orders that contain a product created with the App.
• Customer name: The customer's first and last name, and only when the merchant's file name or sheet label format is configured to include it. This is the only protected customer field the App accesses. We do not read street addresses, cities, postal codes, countries, e-mail addresses or phone numbers. Where the name is not present on the customer record (for example a guest checkout), we read only the first and last name fields of the billing or shipping address — never any other part of an address.
• Design Data: Images, designs, or files uploaded by your customers to our App for processing.
• Variant Information: SKU, title, and price details for the products generated by our App.

Merchant control. The customer name is used to label generated gang sheets so that print operators can match a physical sheet to its order. The name placeholders are part of the default templates. A merchant can remove them at any time in the App under Settings → Requested File Name Format and Gangsheet Name Text; once removed, the App no longer reads a customer name at all.

Access logging. Every read of a customer name is recorded in an access log with the time, the store, the order, the reason for the read, and whether it was performed by a signed-in staff member or by automated order processing. The name itself is never written to the log.

2. How We Use Your Personal Information

We use the personal information we collect to provide the App’s services and to operate our business. Specifically, we use it to:

• Generate production-ready gang sheets from customer orders.
• Sync order statuses, tags, and metafields back to your Shopify store.
• Manage communication between your store and our App's backend for design processing.
• Provide support and improve the App's functionality.

3. Third-Party Integrations (Canva, Google Drive)

The App optionally lets end users connect their own third-party accounts to import artwork into the gang sheet builder. These connections are strictly optional and are only established when the user explicitly clicks "Connect" and authorizes access through the third party's own consent screen (OAuth 2.0).

• Canva: If you connect your Canva account, we access your Canva data on a read-only basis: we list your designs (titles and thumbnails) so you can choose one, and we export the design you select as an image so it can be placed on your gang sheet. We never create, modify, or delete anything in your Canva account.
• Google Drive: If you connect your Google Drive account, we list and download only the files you choose to import into the builder.
• Access tokens: The OAuth access tokens for these integrations are stored in encrypted form in your own browser only — they are never saved in our database. Each request is made with your token and the token never appears in our logs.
• Imported files: The only data we retain from these integrations is the image file you explicitly chose to import, which is stored as a normal upload in your workspace until you delete it.
• Disconnecting: You can disconnect an integration at any time from the same panel. Disconnecting immediately revokes the access token with the third party and removes it from your browser. Logging out also removes the tokens from the browser. You can additionally revoke access from your Canva or Google account settings at any time.

4. Sharing Personal Information

We share your Personal Information with third parties to help us use your Personal Information, as described above:

• Shopify: We share information with Shopify to ensure the App integrates correctly with your store.
• Canva / Google: When you use the optional integrations described in Section 3, your requests (authenticated with your own token) are forwarded to Canva or Google to list and export the content you selected. We do not send them any other personal data.
• Image processing: If you specifically enable background removal or image enhancement in the App settings, the design image is sent to a third-party image-processing service. Only the image is sent; no customer name or other personal information accompanies it.
• Legal Compliance: We may share your Personal Information to comply with applicable laws and regulations or to respond to a lawful request for information.

5. Data Security

All communication with our services takes place over HTTPS. Application data is stored in access-controlled databases, stored credentials are encrypted, third-party OAuth tokens are encrypted and kept client-side only, and access to production systems is restricted to authorized administrators. Each store's data is isolated from every other store's, test and production environments are kept separate, and we maintain a written security incident response policy under which affected merchants are notified without undue delay.

6. Your Rights

If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information below.

7. Data Retention

We keep personal information only for as long as it is needed to provide the App, and the App applies the following retention periods automatically:

• Generated print files: deleted after 7 days by default. A merchant can change this retention period in the App's settings.
• Temporary uploads and working files: deleted after 24 hours by default, also configurable by the merchant.
• Saved builder designs: expire after 90 days and are deleted.
• Order records containing the customer name: kept while the App remains installed, so that the merchant can reprint an order, and deleted as described below.
• Files imported from Canva or Google Drive: treated as normal uploads and subject to the same rules.

8. Deletion and Data Subject Requests

The App implements Shopify's mandatory privacy webhooks, and every request is processed on a durable queue with retries so that a temporary failure cannot silently drop a deletion:

• Customer data request: we produce an export of the data we hold for that customer, which the merchant receives through us.
• Customer redaction: we delete the matching orders, print jobs, generated files, stored webhook records and related billing rows.
• Shop redaction (uninstall): we delete all data belonging to that store, remove its files from object storage, and delete the corresponding rendering account.

A merchant or customer can also contact us directly at the address below to request access, correction or deletion.

9. Our Role and Data Processing Terms

For personal information belonging to a merchant's customers, the merchant is the data controller and AutoGangSheet acts as a data processor: we process that information only on the merchant's instructions and for the purposes described in this policy. We do not use customer personal information for marketing, advertising, profiling, analytics, automated decision-making, model training, or resale, and we do not sell or share it with third parties for their own purposes. Merchants who require separate data processing terms can request them at the address below.

10. Subprocessors

We use the following subprocessors to operate the App:

• Our rendering backend (operated by us) — processes designs and the customer name when it appears in a configured file name, in order to generate print files.
• Cloudflare R2 — object storage for uploaded artwork, generated sheets and previews.
• An image-processing provider — only if the merchant enables background removal or image enhancement, and only for the design image itself, as described in Section 4.

Customer personal information is not sent to any party outside this list, other than the optional integrations you choose to connect as described in Section 3.

11. Changes

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

12. Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint (including security concerns), please contact us by e-mail at info@autogangsheet.com.