Privacy Policy

When you order. Your email address, the shipping name and address you enter, what you ordered, what it cost, and the order's status. We keep an identifier for the PayPal payment so we can match a payment to an order and issue refunds.

We never see your card. Payment runs inside PayPal's own checkout. Card numbers, expiry dates, and security codes go to PayPal directly and never reach our servers, so we have no card data to store, leak, or hand over.

When you make an account. Your email address and, if you set one, a password — stored only as a bcrypt hash, never as text we could read. If you sign in with Google we get your email address from Google and never receive a password at all.

Your artwork. Images you upload, designs you build in the editor, and images you generate with AI, along with how you placed them on a garment.

Messages. What you write to us, or to a seller, through the messaging on the site.

Traffic analytics. Which pages and products get looked at, what goes in carts, and what turns into a sale. Each event records a random per-browser identifier, the page or product involved, the time, and — where you arrived from a link — the referring site's host name only, never the full URL. If you're signed in, the event is linked to your account.

What the analytics deliberately leave out. No IP address and no user-agent string is written, ever. The visitor identifier is the same random token that keeps your cart working; it means nothing outside this site and identifies a browser, not a person.

Notifications, if you turn them on. A subscription for your browser's push service, including the keys needed to encrypt a message only that browser can open. Created only when you opt in, and deleted automatically once the browser stops accepting pushes.

We use one cookie: the session cookie the site needs to function. It holds a random cart token so your cart survives a page load, your sign-in state if you're signed in, and a small amount of design-editor bookkeeping. Your light or dark theme choice is stored in your browser too.

There are no advertising cookies, no third-party analytics scripts, and no cross-site tracking pixels. We don't have a cookie banner because we don't set the kind of cookie that needs one.

Two third parties do load in your browser: Google Fonts serves the site's typefaces, and on checkout PayPal's payment script loads to render the payment buttons. Both can see the request your browser makes to them.

To take payment, print your order, ship it, and talk to you about it; to keep your account, cart, and order history working; to answer your messages; to understand which designs and pages people actually look at, so we know what to make more of; to detect fraud and abuse; and to keep the tax and business records we're legally required to keep.

Where the law requires a legal basis, ours is performing our contract with you for order and account data, your consent for browser notifications, and our legitimate interest in running and improving the shop for aggregate analytics.

When you generate or upscale an image in the design editor, your prompt — and, if you asked the model to match your current design, that image — is sent to our AI provider to produce the result. Their handling of it is governed by their own policies, and they may retain it for a period to operate and abuse- monitor the service.

Don't put anything confidential or personal in a prompt.

We don't sell your personal information, and we don't share it for anyone else's advertising. We do share what's necessary with the companies that make the shop work:

• PayPal — to take payment and process refunds.
• Our AI provider — prompts and images you generate or upscale, as described above.
• Google — your email address when you choose to sign in with Google, and your browser's request when it loads the site's fonts.
• Shipping carriers — the delivery address on your order.
• Hosting, database, and email providers — who store and transmit the above on our behalf.
• Your browser's push service — an encrypted notification, if you turned notifications on.

If you buy from a seller who ships their own orders, that seller receives your name, shipping address, and order contents so they can send it to you. Sellers can see their own store's traffic totals, never anyone else's, and never a named list of who visited.

We'll also disclose information where the law requires it, and in a sale or reorganization of the business, in which case this policy follows the data.

Orders and their shipping details are kept as long as we need them for support, returns, and tax and accounting records.

Raw analytics events are deleted after 90 days. Before that they are rolled into day-by-day totals — counts with no visitor identifier in them — which we keep indefinitely.

Account data lasts until you ask us to delete the account. Push subscriptions are deleted as soon as the browser stops accepting them.

Email prints@basslineprinting.com and we'll help you see what we hold about you, correct it, or delete it. We may need to keep records of completed orders even after deleting an account, since the law requires us to.

Depending on where you live you may have additional rights — to a copy of your data in portable form, to object to or restrict certain processing, or to appeal a refusal. We apply these to everyone who asks, rather than checking where you live first. We won't treat you differently for exercising them.

You can turn browser notifications off in your browser at any time, and clear the session cookie by clearing site data — which will also empty a guest cart.

The site is served over HTTPS. Passwords are stored as bcrypt hashes. Card details never touch our systems at all. Access to the admin area is restricted to accounts we create.

No system is perfectly secure, and we can't guarantee against every possible breach — but we've built this so that the most damaging thing to lose, your payment details, is something we never hold.

This site isn't intended for children under 13, and we don't knowingly collect their information. If you believe a child has given us personal information, email us and we'll delete it.

We operate in the United States and our providers may process your information there. If you're using the site from elsewhere, you're sending your information to the United States, where privacy law differs from your own.

We'll update this page when what we do changes, and the "last updated" date at the top will change with it. If a change is significant we'll say so somewhere you'll see it rather than quietly editing the text.

Bassline Printing LLC
[MAILING ADDRESS]
prints@basslineprinting.com