Draft – pending legal review. Text in [brackets] still has to be completed.

Privacy policy

Gang Sheet Builder · Last updated 20 October 2026

Gang Sheet Builder ("the app") is provided by [Bee Creative legal name], [registered address] ("we", "us"). This policy explains what personal data the app processes when a Shopify merchant installs it, and when that merchant's customers use the gang sheet builder in the merchant's online store. Contact: [privacy contact email].

Our role

For data about a merchant's customers we act as a processor on the merchant's behalf; the merchant is the controller. Our data processing agreement (/dpa) sets out the terms. For the merchant's own account data we are the controller.

What we process

Merchant data: the shop's myshopify domain, the access token Shopify issues to the app, app settings, size presets and sheet product settings.
Designs customers upload and their file names, to build the gang sheet and create print files.
Order data: order number, order and line item IDs of orders containing a gang sheet, to match the paid order to its sheet and name the print files.
Customer identifier: for logged-in customers, the Shopify customer ID, so they can reopen saved sheets. We store only a one-way keyed fingerprint of it, never the ID itself.
Guest token: a random token kept in the guest's browser storage so they can reopen saved sheets on that browser. We store only a fingerprint of it.

We do not collect or store customer names, email addresses, phone numbers, postal addresses or payment details, and we do not use tracking, analytics or advertising cookies in the storefront builder. The builder stores only functional preferences (such as the preview background) in the visitor's browser.

Why we process it

Only to provide the app to the merchant: building gang sheets, saving drafts, adding sheets to the cart and creating print files for paid orders. We do not sell or share personal data, use it for marketing, or make automated decisions with legal or similarly significant effects.

How we protect it

All data is sent over encrypted connections (HTTPS/TLS).
Order numbers, order and line item IDs and upload file names are encrypted in our database (AES-256-GCM); customer IDs and guest tokens are stored only as keyed fingerprints (HMAC-SHA256).
Uploaded designs and print files are kept in private object storage and are only reachable through short-lived signed links.
Access to production systems is limited to [who, e.g. named Bee Creative staff].

How long we keep it

Unfinished drafts: deleted after 90 days without changes.
Uploads not used on any sheet: deleted after 14 days.
Shipped sheets, their print files and uploads: deleted after the period the merchant sets (default 180 days).
Everything for a store: files 48 hours after the app is uninstalled; all remaining data when Shopify asks us to erase the shop's data.
Customer deletion and data requests sent through Shopify are handled automatically.

Sub-processors and location

Shopify – the platform the app runs on.
Contabo GmbH – hosting and file storage ([data centre region, e.g. United States (central)]).

Your rights

Customers should contact the merchant whose store they used; merchants can contact us at [privacy contact email]. We help merchants respond to access, correction and deletion requests. Depending on where you live you may also have the right to complain to a data protection authority.

Changes

We will update this page and the date above when this policy changes, and tell merchants about material changes.