Privacy Policy

1. Who we are

BashMerch is a sole proprietorship based in the United States. We are the data controller for the personal information described in this Policy.

• Entity: BashMerch (sole proprietorship)
• Mailing address: BashMerch, #1126, 265 Chelmsford Street STE 7, Chelmsford, MA 01824, United States
• Contact: support@bashmerch.com

2. Information we collect

2.1 Information you provide

• Account information. When you sign up, our authentication provider collects your email address, name, and authentication credentials. We receive a stable user identifier and your email address from that provider.
• Workspace and organization data. The workspace name, organization membership, and roles you create within the Service.
• Integration credentials. When you connect a third-party platform (Shopify, Printify, and other supported integrations), we receive and store OAuth access tokens and refresh tokens issued by that platform. All such tokens are encrypted at rest. We never receive your password for those third-party platforms.
• Payment information. When you purchase credits or subscribe to a paid plan, our payment processor collects and processes your payment information directly. We receive a customer reference and your subscription status from the processor; we do not receive or store your full card number, CVV, or bank credentials.
• Content you upload. Design files, product images, prompts, and other content you upload to the Service are stored with our cloud object-storage provider (see Section 5.1). We process this content only to provide the Service.
• Support communications. If you contact us by email or in-app, we retain that correspondence to help us respond and to improve the Service.

2.2 Information from connected platforms

When you connect Shopify, Printify, or another supported integration, the Service receives data about your business on that platform — shop information, product catalogs, inventory levels, listing metadata, and similar operational data. We use this data solely to perform the actions you instruct (for example, publishing a product, syncing inventory).

We do not store personal information about your customers. No end-buyer record is written to our database, and we never receive or handle buyer payment details — those remain with the platform that took the payment.

When you open an order view inside the Service, we retrieve a limited set of order details from the connected platform in real time, over an encrypted TLS connection, solely to display them back to you. That view is deliberately minimized: it shows a shortened recipient name (for example, “John S.”), the destination city, region and country, the order status, the items ordered, shipping and tracking information, and — where the platform reports them — refund records. We do not request, display, or accept a buyer’s street address, postal code, email address, or telephone number; where a platform returns those fields, they are discarded on our servers before the response reaches your browser.

Order details retrieved this way are held only for as long as it takes to render the view you requested. They are not written to our database and not written to our logs, are not retained after the response is sent, and are not used for any purpose other than displaying the view you asked for. To see a buyer’s full shipping address, use the link we provide to the order on the platform that holds it.

2.3 Information collected automatically

• Usage and telemetry. API request counts, feature usage, credit consumption, and performance metrics used to operate, secure, and improve the Service.
• Diagnostic and error data. When the Service encounters an error, we collect technical information about the error through our error-monitoring service to help us identify and fix bugs. This typically includes the error message, the route, your user identifier, and the browser environment.
• Log data. Server logs include IP address, browser type, operating system, request URL, response status, and timestamps. We retain logs for operational and security purposes.
• Cookies and similar technologies. See Section 11.

3. How we use information

We use personal information to:

• Operate, maintain, and provide the Service to you.
• Authenticate you and protect your account from unauthorized access.
• Process payments and manage subscriptions or credit balances.
• Execute the integration actions you instruct (e.g., publish a product to Shopify).
• Communicate with you about your account, security alerts, and Service changes.
• Provide customer support.
• Improve, test, and develop new Service features.
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms.
• Comply with legal obligations, enforce our Terms, and protect our rights.

We do not use your information to train general-purpose machine-learning models. AI features that you use (such as AI-generated text or images) submit your prompts, and any design or image you submit for analysis or editing, to the AI model providers we use for that feature (see Section 5.1) only at the moment you request that feature.

4. Legal basis for processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

• Performance of a contract — to provide the Service you signed up for.
• Legitimate interests — to secure the Service, prevent fraud, improve the product, and operate our business. We have assessed that these interests are not overridden by your rights.
• Consent — for any optional processing where we ask for it. You can withdraw consent at any time.
• Legal obligations — to comply with applicable laws (e.g., tax, anti-fraud).

5. How we share information

5.1 Subprocessors

We share personal information with the following categories of service providers (“subprocessors”), each of which processes it on our behalf to operate the Service:

Each of these providers is contractually obligated to protect personal information and to process it only on our instructions.

AI model providers. More than one provider may sit behind our AI features. Text generation and design analysis send the prompts and designs you submit to the provider we use for that feature. For image generation, the AI model you choose determines which provider receives your prompt and returns the generated imagery; image editing tools such as upscaling and background removal send the image you submit to the provider that performs that step. In every case, your data reaches a provider only at the moment you use that feature; this applies to every AI model provider we use, whichever models are on offer at the time, and each of them is bound by the same contractual obligations as the other providers listed above.

We describe these providers by category rather than by company name. If you need to know which specific provider handles your personal information in one of these categories — to exercise your rights under Section 8, or to complete a data-protection assessment of your own — email support@bashmerch.com from the address on your account and, once we have verified your identity, we will identify that provider to you.

5.2 Third-party integrations (controlled by you)

When you connect a third-party marketplace (Shopify, Printify, or similar) and instruct the Service to take an action, we send the necessary data to that platform on your behalf. Those platforms operate as independent controllers of the data you send them and are governed by their own privacy policies.

5.3 Legal disclosures

We may disclose information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law or legal process; (b) protect the rights, property, or safety of BashMerch, our users, or others; (c) detect, prevent, or investigate fraud or security incidents; or (d) respond to lawful requests from public authorities.

5.4 Business transfers

If BashMerch is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections and continued application of this Privacy Policy or a successor policy at least as protective.

5.5 We do not sell personal information

We do not sell personal information as that term is defined under the California Consumer Privacy Act (CCPA / CPRA) or comparable laws. We do not share personal information for cross-context behavioral advertising.

6. International data transfers

Our primary infrastructure is located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States.

For users in the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards for these transfers, including the European Commission’s Standard Contractual Clauses where required, and we ensure our subprocessors offer comparable protections.

7. Data retention

We retain personal information for as long as your account is active and for a limited period afterward as follows:

• Active account data — retained for the life of your account.
• Closed or deleted accounts — we retain operational data for up to 30 days after deletion to permit account recovery, then we delete or anonymize it. Encrypted database backups are purged on their normal rotation cycle, generally within an additional 30 days.
• Financial and tax records — retained for the period required by applicable tax and accounting laws (typically 7 years), even after account deletion.
• Security and audit logs — retained for up to 12 months for security and abuse-prevention purposes.

You can request earlier deletion at any time by contacting support@bashmerch.com (see Section 8).

8. Your rights

8.1 Rights for everyone

You can ask us to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Export your data in a portable format.
• Close your account and delete associated data, subject to the retention rules above.

To download a copy of your data or close your account, use Settings → Your data in the app. Both are self-service: the download is immediate, and account closure takes effect immediately and completes after the 30-day recovery period described in Section 7. For anything else — correcting your details, restricting or objecting to processing, or a question about a request — email support@bashmerch.com from the address on your account. We may need to verify your identity before acting on a request. We will respond within the timeframes required by applicable law (generally 30 days under GDPR; 45 days under CCPA, with an option to extend).

8.2 Additional rights under GDPR / UK GDPR

If you are in the EEA, the UK, or Switzerland, you also have the right to:

• Restrict or object to processing based on our legitimate interests.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority. We would appreciate the chance to address your concerns first, so please contact us before filing a complaint.

8.3 Additional rights under CCPA / CPRA (California residents)

If you are a California resident, you have the right to:

• Know what personal information we have collected about you and how we use it.
• Delete your personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Limit the use of sensitive personal information. We do not use sensitive personal information for any purpose beyond what is necessary to provide the Service, so this right is satisfied by default.
• Opt out of the sale or sharing of personal information. As stated above, we do not sell or share personal information for cross-context behavioral advertising.
• Non-discrimination — we will not deny you services, charge you a different price, or provide a different level of service because you exercised any of these rights.

You can exercise these rights by emailing support@bashmerch.com.

9. Security

We use industry-standard measures to protect personal information, including:

• TLS (HTTPS) encryption in transit between your browser and our servers.
• Encryption at rest for sensitive integration credentials (OAuth tokens).
• Role-based access controls limiting which BashMerch personnel can access production data.
• BashMerch personnel access account information only to resolve a support request you have raised, to keep the Service running, or to meet a legal obligation. We do not sign in to your account as you. Every such access, and every action taken on an account, is logged.
• Regular security reviews of our infrastructure and dependencies.
• Audit logging of administrative actions.

No system is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If we become aware of a personal-data breach, we will notify affected users as required by applicable law.

10. Children’s privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information to us, please contact support@bashmerch.com and we will delete it.

11. Cookies and similar technologies

We use a small number of cookies and similar technologies that are strictly necessary to operate the Service:

• Session cookies placed by our authentication provider to keep you signed in and to protect your account.
• CSRF and security cookies to prevent cross-site request forgery and other attacks.
• Error reporting through our error-monitoring service, which may set a cookie or identifier when an error occurs to help us reproduce the issue.

Our product analytics is cookieless: it stores nothing on your device — no cookie, no local storage and no session storage — and it identifies signed-in users only by an opaque account identifier, never by name or email address.

We do not use cookies for advertising or cross-site tracking. You can configure your browser to refuse cookies, but the Service will not function correctly without the authentication cookies.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will provide additional notice (for example, by email or an in-app notice) before the change takes effect. Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the updates.

13. Third-party trademark notices

Shopify

Shopify is a trademark of Shopify Inc. This application uses the Shopify API but is not endorsed or certified by Shopify Inc.

Printify

Printify is a trademark of Printify, Inc. This application uses the Printify API but is not endorsed or certified by Printify, Inc.

14. Contact us

If you have questions about this Privacy Policy, want to exercise your rights, or need to report a privacy concern:

• Email: support@bashmerch.com
• Mailing address: BashMerch, #1126, 265 Chelmsford Street STE 7, Chelmsford, MA 01824, United States