Privacy Policy

Information we collect

• Account and profile information: your name, email address, phone number, company if provided, mailing or billing address, account identifiers, authentication information, and selected subscription plan. Authentication is handled through Supabase and, when you choose it, Google sign-in.
• Artwork and sheets: files you upload or choose to import, filenames, image dimensions, file sizes, duplicate-detection fingerprints, quantities, layout settings, saved sheets, completed exports, and related timestamps.
• Billing information: subscription, payment, invoice, and cancellation records, Square customer identifiers, and limited payment-method details such as card brand, last four digits, and expiration. Square collects and processes complete card details through its payment interface; we do not store full card numbers or security codes.
• Support and feedback: messages you send us, your signed-in name and email, the page associated with feedback, and correspondence needed to respond.
• Technical information: service providers may process IP addresses, browser and device information, request times, security events, and error logs to operate and protect the service.

Development diagnostics and active-user presence

While signed in, the app reports recent activity so the owner can see active users and troubleshoot issues. When development logging is enabled, we save limited samples of page paths, API methods and paths, response codes, and request durations with your account name and email. These diagnostics exclude request bodies, URL query strings, artwork, filenames, passwords, and payment details. Activity records are scheduled for cleanup after 30 days and presence records after one day. The live presence view expires after two minutes without a report.

How we use information

We use information to create and secure accounts; arrange, preview, export, and save gang sheets; maintain your image library; apply storage limits; process authorized subscriptions; provide support; troubleshoot errors; prevent fraud and abuse; and meet legal obligations. Profile and address details support account administration and billing. We do not use your artwork or imported Google or Canva content to train artificial intelligence or machine-learning models.

Google sign-in and Google Drive imports

Google sign-in provides account information used to authenticate you, such as your name, email address, and account identifier. Drive imports are optional and request the drive.file permission to work with files you select or otherwise authorize for this app, rather than unrestricted access to your entire Drive. The Picker displays file information so you can choose images; the app reads selected file identifiers, names, types, sizes, and image contents to complete your import.

Choosing to import copies the selected image into your private GangMasterDTF image library on our cloud storage. We use that copy to provide your library and sheet-building features. Importing does not modify or delete the original file in Drive. When you link Google Drive, we store access and refresh tokens in encrypted private server storage under your account so future imports can reuse your connection. A short-lived access token is supplied to the Google Picker in browser memory. Refresh tokens and client secrets are never returned to your browser. If saved connections have not been configured, a temporary browser-only authorization is used instead. Separate sign-in session information is managed by our authentication provider.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or transfer it for unrelated purposes. Human access to Google data is limited to your affirmative permission for specific support, necessary security investigation, or legal requirements.

You can disconnect Google Drive in My Profile or revoke access in your Google Account connections. Revocation stops future authorized access but does not automatically delete copies you previously imported. Delete those copies from My Image Library, delete saved sheets containing them, or contact us for a data-deletion request.

Canva imports

When enabled and connected by you, Canva lets us display available design information and export selected designs as images for your library. The current import exports the first page of each selected design. We store connection and refresh tokens privately on the server so the connection can continue until revoked or disconnected. We do not receive your Canva password. Imported copies are stored with your library and may be included in saved sheets. You can disconnect Canva in My Profile or revoke access through Canva's account settings. Revoking access does not delete previously imported copies or alter the originals in Canva.

When information is shared

We use service providers to deliver the app: Amazon Web Services for hosting, private file storage, operational logs, and feedback email; Supabase for authentication; Square for payments and subscription management; and Google or Canva when you choose their features. We share information with these providers only as needed for their functions. Their handling of data is also governed by their own privacy policies.

Authorized administrators may access account details, billing status, and service records to operate and support the app. Artwork is private to your account by default and is not published to other customers. We do not sell personal information or share it for targeted advertising. We may disclose information where required by law or necessary to protect users, investigate abuse, or defend legal rights. Any business transfer involving personal information will remain subject to this policy, applicable law, and any additional consent required for Google data.

Cookies and browser storage

We use essential authentication cookies and temporary browser storage to keep you signed in, secure account flows, and remember your last opened sheet during a browser session. Blocking these technologies may prevent account features from working. We do not currently use advertising cookies or third-party advertising trackers. Google, Canva, and Square may use their own technologies within their services.

Storage, retention, and deletion

Account information and library images are retained while needed to provide your account and the services you request. Saved sheets are subject to a 30-day retention period measured from their original creation; completing, editing, or renaming a sheet does not restart that period. Sheets become unavailable after expiry, and storage cleanup may occur afterward. This sheet expiry does not delete separate My Image Library files.

You can delete library images and saved sheets using the app. Removing a library image does not automatically remove a copy embedded in an existing saved sheet, and removing a sheet does not remove the separate library original. Please remove both when you want both copies deleted. You may request account deletion and removal of associated data by email. We may retain limited records for billing, legal obligations, security, and dispute resolution. Residual backup or log copies may remain until their normal retention cycles end; immediate erasure from every system is not guaranteed.

Your choices and requests

You can update personal details in My Profile, rename or delete library images and sheets, download completed sheets, manage subscriptions and payment methods when available, and revoke optional provider connections. Contact us to request access to, correction of, a copy of, or deletion of personal information, or to exercise privacy rights available where you live. We may verify your identity before processing a request. Deleting an account and canceling a paid subscription are separate steps; contact support if you need help with both.

Security and location of processing

We use measures such as encrypted connections, restricted account access, private cloud storage, and server-side handling of sensitive credentials. No online service can guarantee absolute security. Information is processed in the United States and may also be handled in other locations used by our providers.

Children

GangMasterDTF is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and remove it as appropriate.

Policy updates

We may update this policy as features and practices change. The date above identifies the current version. We will provide additional notice and obtain consent when required, including before using Google data for a new purpose that requires consent.

Contact us

For questions about this policy or your account, contact KBKB Enterprises LLC at support@gangmasterdtf.com.