Privacy Policy

This Privacy Policy describes how Jasa Apparel LLC ("TPU Builder", "we", "us", "our") collects, uses, and shares personal information when you install or use the TPU Builder Shopify application (the "Service") at tpu.gangsheetbuilderpro.com.

Two distinct roles exist for the data we handle:

• For your own account data (your contact information, shop subscription, etc.) we act as a data controller.
• For your customers' data (designs uploaded by your storefront visitors, order details fetched from Shopify) we act as a data processor on your behalf. You remain the controller of that data.

1. Information We Collect

1.1 Information about your shop (merchant)

• Shopify shop domain (e.g., yourshop.myshopify.com)
• Shop owner email address (from Shopify's session payload)
• OAuth offline access token for the Shopify Admin API
• Shopify-granted access scopes (read_products, write_products, read_customers, read_orders)
• Subscription state (active plan tier, line item id, current period end date, lifetime commission accrued)
• App settings you configure (image library, brand logo, size helper, output format preferences)

1.2 Information from your Shopify store

• Product information (id, title, variants, options) for products you link to the builder
• Order data for orders containing line items created by TPU Builder — specifically the order id, line items, customer name and email, presentment currency, total price, financial status. Used to map orders to designs, populate filename templates, and (for Free tier) calculate commission
• Customer ids for customers placing orders that include a customized design

1.3 Information from your storefront visitors

• Uploaded images and text content that storefront visitors place into the builder canvas
• The resulting canvas configuration (positions, sizes, fonts, colors) stored as JSON
• Rendered print-ready files (PNG, PDF, or TIFF)
• A randomly-generated design id used as a shared secret to reference the design from cart and order line items

We do not intentionally collect personally identifiable information from your storefront visitors. We do not require them to log in or provide contact details. If a visitor uploads an image containing personal information (e.g., a photograph of themselves), that image is stored in connection with the design id only.

1.4 Technical information

• IP address and user-agent of requests to our server (logged for security and abuse prevention; retained 7-30 days)
• Application logs (errors, render durations, queue depth, billing webhook activity)
• A signed authentication cookie for our owner-side administrative dashboard (not used for merchant or customer access)

We do not use third-party analytics, tracking pixels, or advertising trackers.

2. How We Use Information

• Provide the Service. Render print-ready files, sync them to your Dropbox folder (if connected), display them on your admin order pages, populate filename templates from order data.
• Billing. Track quota usage in square inches per billing cycle; submit commission usage records to Shopify Billing for Free-tier shops that exceed quota.
• Operate and improve the Service. Diagnose errors, monitor performance, identify abuse, develop new features.
• Support. Respond to your inquiries sent to support@gangsheetbuilderpro.com.
• Comply with legal obligations. Including Shopify's GDPR webhook program (data_request, customers/redact, shop/redact).

3. Third-Party Sub-Processors

We use the following service providers to deliver the Service. Each is bound to confidentiality and appropriate data-protection commitments:

We do not sell personal information. We do not share it with advertisers, data brokers, or marketing partners.

4. Data Retention

• While your subscription is active — Shop and design data is retained for as long as you use the Service.
• After uninstall — Shopify sends us ashop/redact GDPR webhook approximately 48 hours after you uninstall the app. On receipt, we cascade-delete the shop record and all associated designs, orders, subscription history, and uploaded files. The 48-hour grace period gives you a window to re-install without losing your configuration.
• Customer redact requests — On receipt of a Shopify customers/redact webhook, we delete designs and order references associated with the specified customer id.
• Application logs — 7 to 30 days, depending on system.
• Database backups — Daily snapshots retained for up to 30 days.

5. Your Rights

5.1 California residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know — Request the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to delete — Request deletion of personal information we collected from you, subject to exceptions allowed by law.
• Right to correct — Request that we correct inaccurate personal information.
• Right to opt-out of sale or sharing — We do not sell or share personal information as those terms are defined under CCPA/CPRA. We do not use personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information — We do not collect or use sensitive personal information for purposes that trigger this right.
• Right to non-discrimination — We will not deny service, charge different prices, or provide a different level of quality because you exercised a privacy right.

5.2 Other US state residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive consumer privacy laws have substantially similar rights of access, deletion, correction, portability, and opt-out. We honor verified requests from residents of all such states. Appeals of denied requests may be submitted to the same support address.

5.3 EEA / UK residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have rights of access, rectification, erasure, restriction, objection, and portability under the General Data Protection Regulation, and the right to lodge a complaint with your local supervisory authority.

5.4 How to exercise your rights

Send a request to support@gangsheetbuilderpro.com with your shop domain (so we can locate your data) and the specific right you wish to exercise. We will respond within 45 days (90 days if the request is complex), as required by applicable law. We may need to verify your identity using information you provided at sign-up. An authorized agent may submit a request on your behalf with proof of authorization.

6. Security

• All traffic is served over HTTPS (TLS 1.2 or higher).
• Cloudflare R2 objects are encrypted at rest.
• Database connections use SSL/TLS.
• Shopify OAuth tokens are stored encrypted and never exposed to clients.
• Access to our infrastructure is limited to the app owner and requires multi-factor authentication.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we strive to follow industry best practices.

7. International Data Transfers

We are based in the United States, and our primary infrastructure providers process data in the United States with global edge presence (Cloudflare). If you access the Service from outside the United States, you consent to your data being transferred to and processed in the United States, which may have data-protection laws different from your jurisdiction.

For residents of the European Economic Area, the United Kingdom, or Switzerland, transfers are made in reliance on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, where required.

8. Cookies

We use only essential cookies:

• A Shopify session cookie when you access the embedded admin interface (set by Shopify).
• A signed authentication cookie for our owner-side administrative dashboard (only relevant to the app operator, not merchants or customers).

We do not use marketing, analytics, or third-party tracking cookies.

9. Children's Privacy

The Service is intended for use by businesses operating Shopify stores. We do not knowingly collect personal information from children under 13 (or the applicable local minimum age). If you believe we have, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via email to the shop owner email on record and posted at the top of this page with a revised "Last updated" date. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

11. Contact

For privacy questions, complaints, or to exercise your rights, please contact:

Jasa Apparel LLC
Email: support@gangsheetbuilderpro.com
Postal address: 3601 Oakstone Dr, Plano, TX 75025