Privacy Policy

PrintMind is operated by Tech Innovation Hub LLC, a Wyoming limited liability company headquartered in Houston, Texas ("we", "us"). PrintMind helps print-on-demand sellers research niches, generate designs, build listings, and publish to marketplaces. This policy explains what personal data we collect, why, who we share it with, and the rights you have over it.

We aim for plain English. If anything below is unclear, email [email protected] and we'll explain.

• Account data: email, name, hashed password, plan/subscription state.
• Connection metadata: OAuth tokens for Etsy, social platforms (X, Pinterest, Instagram, Facebook, TikTok), and fulfillment providers (Printful, Printify). These tokens are encrypted at rest with AES-256.
• Content you create: trend reports, designs, listing copy, scheduled posts, mockups.
• Marketplace activity: orders, fulfillment status, customer name and email when imported from the marketplace (we are a processor for that data — see §6).
• Usage analytics: events such as "trend analyzed" or "design generated", attached to your user id. Used for plan limits, the AI cost dashboard, and anomaly detection.
• Operational logs: IP address and user agent on auth events, kept in the audit log for security investigations.

• To provide the service you signed up for (contractual basis under GDPR 6(1)(b)).
• To enforce plan limits and bill correctly (contractual + legitimate interest).
• To detect abuse, fraud, and brute-force attempts (legitimate interest).
• To send transactional emails: verification, password reset, billing, scheduled-post outcomes.
• Never to train third-party AI models on your designs or listings without your explicit consent.

We split cookies into strictly necessary (session, CSRF, security — always on) and optional (analytics, marketing — only with consent). The cookie banner on first visit lets you accept all, reject optional, or pick per-category. You can change your mind any time by clearing the printmind:consent:v1 entry from your browser's local storage.

We use service providers under their applicable business and data-protection terms. The current register, purposes, optionality, and retention notes are published at Subprocessor Register.

• Stripe — payment processing, billing portal.
• Resend — transactional email delivery.
• OpenAI — model inference for AI generation. We do not opt content into training.
• Google Gemini, fal.ai, and Ideogram — optional text or image inference when the corresponding provider is configured.
• Sentry — technical error diagnostics with limited request context.
• Cloudflare and contracted infrastructure providers — DNS, edge security, tunnels, application hosting, database, cache, and object storage.
• Etsy, Printful, Printify, Pinterest, X (Twitter), Meta (Instagram / Facebook), TikTok — only the data needed to publish your content or fulfill orders.
• Google (Trends, Autocomplete) — public APIs called server-side for the niche keyword you submitted; we do not send your account data with them.

We do not sell personal data. We do not share it for cross-context behavioural advertising.

When you import marketplace orders, the customer's name, email, and shipping address pass through our systems so we can attribute revenue and trigger fulfillment. For that data we act as a processor on your behalf — you remain the controller. We keep it while the account and enabled commerce workflow require it, then delete it under the retention schedule below and the seller's lawful instructions.

Production application, database, cache, and object-storage services are currently operated on contracted infrastructure. Providers may process data in the United States and other regions. We use recognized contractual safeguards for restricted transfers where required. Backups are encrypted.

• Account and content data: while the account is active; targeted for removal from active systems within 30 days after a valid deletion request.
• Encrypted backups: expire on the operational backup cycle, normally within 30 days, unless a legal hold applies.
• Audit logs: 365 days, then automatically pruned.
• Webhook delivery records: 90 days.
• Order data: while needed for the active seller workflow, then up to 30 days after account deletion or the seller's valid deletion instruction, subject to legal retention.

You can exercise these rights from Settings or by emailing [email protected]:

• Access: download a JSON export of your account data.
• Erasure: request deletion of the account and associated active-system content, subject to legal retention, fraud prevention, dispute records, and backup expiration.
• Rectification: change your email, name, or plan.
• Portability: the export is machine-readable JSON.
• Objection / restriction: contact us; we'll discuss what we can pause without breaking the service.
• Complaint: if we've let you down, you have the right to lodge a complaint with your local supervisory authority.

Passwords are bcrypt-hashed at cost 10. OAuth tokens are encrypted with AES-256 at rest. We enforce HTTPS and a Content Security Policy. Failed-login activity is tracked per email and triggers adaptive lockouts. Webhook secrets are compared in constant time. Our current controls and limitations are described in the Trust Center. Report suspected vulnerabilities privately to [email protected].

We'll bump the "Last updated" date at the top whenever we change anything material. For significant changes we'll also email signed-in users.