Privacy Policy

We collect information you provide directly and information generated through your use of our platform.

Information You Provide

• Account information: Name, email address, business name, phone number when you create a SpreeShop account.
• Order data: Shipping address, order items, quantities, and payment confirmation (we do not store full card numbers — Stripe handles payment processing).
• Profile information: Profile photo, preferences, and settings you configure.
• Communications: Messages you send to our support team.

Google OAuth Data

If you choose to sign in with Google, we receive your name, email address, and profile photo from Google. We use this solely to authenticate you and do not access your Google Drive, Gmail, or other Google services.

Automatically Collected Information

• Log data: IP address, browser type, pages visited, time and date, referring URL.
• Device information: Device type, operating system, screen resolution.
• Cookies and tracking data: See Section 3 for details.

We use the information we collect for the following purposes:

• Order fulfillment: Processing orders, sending confirmation emails, providing tracking information.
• Account management: Creating and maintaining your account, authenticating you when you sign in.
• Email notifications: Sending transactional emails (order confirmations, shipping updates, password resets) via SendGrid. You may also opt into marketing emails.
• Platform improvement: Analyzing usage patterns to improve features, fix bugs, and develop new functionality.
• Customer support: Responding to your inquiries and resolving issues.
• Legal compliance: Meeting legal obligations, resolving disputes, and enforcing our agreements.

We do not sell your personal information to third parties. We do not use your data for advertising targeting on external platforms.

We use cookies and similar tracking technologies. You can control your preferences through our cookie consent banner.

Essential Cookies

Required for the platform to function. These include session cookies that keep you logged in and security cookies that prevent fraud. These cannot be disabled without breaking the service.

Analytics Cookies

Help us understand how visitors interact with our platform. Data is aggregated and anonymized. You can opt out via our cookie settings panel.

Third-Party Cookies

• Stripe: Sets cookies for fraud prevention and payment processing. See Stripe's Privacy Policy.
• Google Sign-In: Sets authentication cookies when you use Google to sign in. See Google's Privacy Policy.

For full details, see our Cookie Policy.

We share your information only in these circumstances:

• Service providers: Stripe (payments), SendGrid (email), Linode (hosting/CDN), Google (authentication). These providers are contractually bound to protect your data.
• Store operators: If you place an order on a SpreeShop-powered store, the store operator (apparel shop) receives your name, email, shipping address, and order details to fulfill your order.
• Legal requirements: If required by law, court order, or to protect the rights and safety of users.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you in advance.

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten"), subject to certain exceptions.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to restriction: Request that we limit how we process your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email privacy@spreeshop.xyz. We will respond within 30 days.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

• Right to know: Request disclosure of the categories and specific pieces of personal information we collect about you.
• Right to delete: Request deletion of personal information we have collected from you, subject to exceptions.
• Right to opt-out of sale: We do not sell personal information. If that changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, email privacy@spreeshop.xyz with "CCPA Request" in the subject line.

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained until you close your account, plus 90 days for backup purposes.
• Order data: Retained for 7 years for tax and accounting compliance.
• Log data: Retained for 90 days.
• Marketing preferences: Retained until you unsubscribe or request deletion.

After these periods, data is securely deleted or anonymized.

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, bcrypt password hashing, and access controls. However, no system is 100% secure. If you discover a security issue, please report it to security@spreeshop.xyz.

SpreeShop is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at privacy@spreeshop.xyz and we will delete it promptly.

We may update this Privacy Policy periodically. When we make material changes, we will notify you by email or by posting a notice on our website at least 14 days before the change takes effect. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact us at: