Merchant agreement
Data processing terms
These terms form part of the Stitchproof merchant terms between the merchant that accepts them in the authenticated app and Derek Zhang, an individual based in China (Stitchproof). Contact: whitleylobalbo315@gmail.com. The person accepting must be authorized to act for the merchant. We record the store, agreement version, acceptance time and installation reference. Installing the app alone is not recorded as acceptance.
Roles, purpose and instructions
The merchant determines why customer data is used for its orders and is the controller of that data. Stitchproof processes customer data on the merchant's instructions to provide item-specific embroidery proofs, private review links, version history, customer decisions and requested drafting. Instructions include the merchant's authenticated actions and lawful written requests. We do not sell this data, use it for advertising or make significant legal decisions about customers. Limited account, billing, security and support records may be processed for our own necessary operational or legal purposes.
Scope and duration
Data may concern merchant staff, customers and people named or shown in personalization content. Processing can include store and order identifiers, item names and quantities, customization attributes, proof text and artwork, customer messages, decisions and timestamps. Our order query does not request customer contact, address or payment-card fields. Free text and artwork can still contain personal information. Processing continues while needed to provide the requested service, subject to the retention and deletion rules below.
Merchant responsibilities
Send only information you are authorized to process. Provide required customer notices and establish the applicable lawful basis for processing, private review links and any optional AI disclosure. Do not submit sensitive personal information, payment details or unrelated personal data. Keep links and exports private. Review every proof and AI suggestion; a recorded customer decision does not itself authorize production.
Confidentiality and security
We limit access to the operator and providers that need it to deliver or secure the service, and require confidentiality from anyone we authorize to access customer data. We use HTTPS, Shopify session authentication, verified webhook signatures, encrypted stored Shopify credentials, private access links and controls separating each store's data. Order records rely on the database provider's encryption at rest. We do not promise that all content has separate application-layer encryption or that any service is absolutely secure.
Providers
The merchant authorizes the providers listed below for these purposes. Provider services are subject to their applicable terms. We remain responsible for obligations that applicable law places on us and will provide available information about our providers on request. We will update this page for material provider changes and give notice in the app before a new provider processes customer proof content. A merchant with a reasonable data-protection objection can contact support and stop using the affected feature pending resolution.
| Provider | Purpose and location |
|---|---|
| Cloudflare | Application delivery, hosting and scheduled cleanup through its global network. |
| Neon | PostgreSQL storage; the current application database is in the United States. |
| Shopify | Store authentication, authorized order access, subscription status and privacy requests under Shopify's platform terms. |
| MiniMax | Optional text drafting using the China API endpoint, subject to the separate AI choice below. |
| Google / Gmail | Support email when you contact us; locations follow Google's service arrangements. |
Separate choice for optional AI
Manual proof preparation is available without AI. When you expressly authorize an AI request, the entered note, five current proof fields and interface language are sent to MiniMax's China service. Artwork, Shopify credentials, order identifiers and customer contact fields are not intentionally included, but any personal information typed into those text fields is included.
MiniMax's public terms permit processing input and output to provide and improve its services, including algorithm or model improvement. Stitchproof has no separate zero-retention or no-training commitment from MiniMax for this account. AI is therefore a separate, optional choice; acceptance of these merchant terms does not automatically enable an AI request. Do not authorize an AI request unless that processing is permitted for the data you supply and you have any required permissions. MiniMax's independent retention is not limited by Stitchproof's 180-day rule.
International processing
The operator is in China; providers may process information in the United States, China and other locations. We do not represent that signing these terms itself creates EU Standard Contractual Clauses, a UK transfer addendum or another transfer safeguard. If the data you intend to submit requires additional contractual safeguards, contact us and complete those arrangements before submitting it. Do not send such data until the required arrangements exist.
Access, correction, return and deletion
We will reasonably assist with requests concerning data held by Stitchproof. Authenticated merchants can use recorded Shopify privacy requests to export retained order records. Exporting a file does not deliver it to the customer. Verified customer-erasure requests remove the specified orders and associated proofs and links. Store-erasure requests remove app content for an inactive installation; a conflict with a current installation must be checked to avoid deleting a reinstalled store's live records. Contact support for corrections or additional assistance. We will explain if a requested instruction cannot lawfully be carried out.
180-day content retention
Order proof content expires 180 days after first import or the most recent actual saved change to that order, proof publication or customer decision. Viewing, routine refreshes, copying links and AI drafting do not renew the period. Expired content is unavailable through the app and is removed by access-time and scheduled cleanup. Provider outages may delay background deletion. Deletion removes proof versions, artwork, messages, review links and associated content references. Deleted orders cannot be restored or re-imported through the app.
Uninstall removes live order/proof content, links and saved Shopify credentials. Necessary allowance, installation, billing, privacy-request and opaque deletion records may remain for their stated purposes. Deletion does not replenish used allowances. Provider backups and independent logs follow provider schedules. Keep any business records you need before expiry or uninstall; contact support before ending use if you need assistance returning retained data.
Incidents and evidence
We will notify affected merchants without undue delay after confirming a breach of customer data under our control and provide available details and reasonable assistance with their response obligations. We will provide relevant available information about our processing and security on reasonable request, subject to confidentiality and the security of other merchants. We do not claim independent SOC 2, ISO or other certifications for Stitchproof.
Changes and precedence
These data-processing terms control if they conflict with the general merchant terms on customer-data processing. Mandatory legal rights remain unaffected. A material change requiring renewed acceptance will be presented in the app; we do not infer agreement from an old acceptance record.