Privacy Policy

Last updated: April 13, 2026

DTFGSA, Inc. ("we," "our," or "us"), a Delaware C-corporation, operates the DTF Gang Sheet App website and services at dtfgangsheetapp.com and builder.dtfgangsheetapp.com (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, including when our Service is embedded within third-party platforms such as Shopify stores.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

We may collect the following information that you voluntarily provide:

• Account information: Name, email address, and password when you create an account.
• Design files: Images and graphics you upload to the gang sheet builder (PNG, JPG, SVG, PDF, AI, EPS, PSD, TIF, WEBP formats).
• Order information: Gang sheet specifications (size, quantity, nesting preferences), order history, and delivery details.
• Communication data: Messages you send to our support team.

1.2 Information Collected Automatically

When you access the Service, we automatically collect:

• Device and browser information: IP address, browser type and version, operating system, device type, and screen resolution.
• Usage data: Pages visited, features used, time spent, referral URLs, and interaction patterns.
• Cookies and similar technologies: Session identifiers, preferences, and analytics data. See our Cookie Policy for details.

1.3 Information from Shopify Integration

When our Service is embedded within a Shopify store via our Shopify app, we receive:

• Store information: The merchant's Shopify domain name, store name, currency, and locale settings.
• Referral data: Which Shopify store referred you to our builder.

We do not access, collect, or store the Shopify merchant's customer lists, order data, product catalogs, or any other Shopify store data beyond what is listed above.

1.4 Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not collect, store, or have access to your full credit card number, debit card number, or bank account details. Stripe's privacy policy governs the handling of your payment data: https://stripe.com/privacy

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including processing your gang sheet orders.
• Create and manage your account.
• Process transactions and send related information (confirmations, invoices, receipts).
• Respond to your inquiries and provide customer support.
• Improve and optimize the Service, including analyzing usage patterns.
• Send administrative communications about updates, security alerts, and policy changes.
• Send marketing communications (only with your consent, and you may opt out at any time).
• Detect, prevent, and address fraud, abuse, and technical issues.
• Comply with legal obligations.

3. How We Share Your Information

We do not sell your personal information. We may share your information with:

• Payment processor: Stripe, Inc., to process payments.
• Hosting and infrastructure providers: Cloud services that host and deliver our Service.
• Analytics providers: Services that help us understand usage patterns (e.g., Google Analytics). These providers receive anonymized or aggregated data where possible.
• Shopify merchants: If you access our Service through a Shopify store, we may share order status and completion information with the referring merchant for attribution purposes only.
• Legal requirements: When required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy:

• Account data: Retained while your account is active and for 30 days after deletion request.
• Uploaded design files: Retained while your account is active. Deleted within 30 days of account deletion or upon your request.
• Order records: Retained for 7 years for tax and legal compliance purposes.
• Usage and analytics data: Retained in aggregated form for up to 26 months.

5. Your Privacy Rights

5.1 Rights for All Users

Regardless of your location, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information.
• Data portability: Request your data in a structured, machine-readable format.
• Opt-out of marketing: Unsubscribe from marketing emails at any time.

5.2 European Economic Area (EEA) and United Kingdom — GDPR

If you are in the EEA or UK, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis for processing: We process your data based on contractual necessity (to provide the Service), legitimate interests (to improve the Service and prevent fraud), your consent (for marketing), and legal obligations.
• Right to restrict processing: You may request we limit how we use your data.
• Right to object: You may object to processing based on legitimate interests.
• Right to lodge a complaint: You may file a complaint with your local data protection authority.
• Data transfers: Your data may be transferred to and processed in the United States. We use Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard international data transfers.

5.3 California — CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to know: You may request details about the categories and specific pieces of personal information we have collected.
• Right to delete: You may request deletion of your personal information.
• Right to opt-out of sale/sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

5.4 Other US State Privacy Laws

We comply with applicable state privacy laws including those in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with enacted consumer data protection legislation. Residents of these states may exercise similar rights as described above.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, and analyze usage. For detailed information about the cookies we use and how to control them, please see our Cookie Policy.

7. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.

8. Security

We implement appropriate technical and organizational measures to protect your information, including encryption in transit (TLS/SSL), secure storage, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

9A. Google API Services and Google User Data

The Service integrates with Google API Services, including Google Sign-In and Google Drive, for authentication and file-handling features that DTFGSA users explicitly authorize during their use of the platform.

9A.1 Google API Services User Data Policy — Limited Use Disclosure

DTFGSA Inc.'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9A.2 Google User Data We Access

When you sign in with Google or connect a Google Drive account to DTFGSA, we may request the following Google API scopes, only with your explicit consent:

• Identity and basic profile (openid, email, profile): your Google account email, display name, and profile photo. Used solely to create or sign you into your DTFGSA account.
• Google Drive file access (drive.file or equivalent): read and write only the specific DTF gang sheet files that you upload, generate, or open within DTFGSA. We do not request, access, or scan any other Drive content. Used to import design files, save production-ready exports back to your Drive, and let you open files you previously created within DTFGSA.

We do not use Google user data for any purpose other than providing and improving user-facing features within the Service. We do not transfer Google user data to third parties except (a) as necessary to provide or improve user-facing features that are prominent from the application's user interface, (b) to comply with applicable law, or (c) as part of a merger, acquisition, or sale of assets with notice to users.

9A.3 What We Do NOT Do

DTFGSA does not, and will not:

• Use Google user data to serve advertisements
• Sell Google user data, or transfer it for sale or for advertising purposes
• Allow humans to read Google user data, except (a) with the user's explicit, affirmative consent for specific support cases, (b) where necessary for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized for limited internal operations such as auditing
• Use Google user data to train generalized machine learning models

9A.4 Google API Data Retention

We retain Google user data only as long as necessary to provide the Service to you. Specifically:

• Google account profile data (email, name): retained while your DTFGSA account is active. Deleted within 30 days of account closure.
• Google Drive OAuth refresh tokens: retained while the integration is active. Revoked immediately when you disconnect Google Drive from DTFGSA, or within 30 days of account closure.
• Files imported from or exported to Google Drive: not stored by DTFGSA beyond the active production session. Files reside in your Google Drive under your control.

9A.5 Revoking Access and Deleting Google User Data

You can revoke DTFGSA's access to your Google account at any time:

• From DTFGSA: sign in to your DTFGSA dashboard and click "Disconnect Google Drive" or "Disconnect Google Account" in Settings → Integrations.
• From Google directly: visit https://myaccount.google.com/permissions and remove DTFGSA's access.
• Full account deletion: email support@dtfgangsheetapp.com with the subject "Delete my account and Google data". We confirm deletion within 30 days.

9A.6 Security of Google User Data

Google user data is encrypted in transit (TLS/SSL) and at rest. OAuth refresh tokens are stored in encrypted form and accessed only by the specific DTFGSA service responsible for executing the user-authorized action. Access to systems handling Google user data is limited to authorized DTFGSA personnel under documented access-control policies.

9A.7 OAuth Application

The OAuth application that requests these Google API scopes is operated by DTFGSA Inc. under the Google Cloud project name "DTF Admin" (project ID: dtf-admin). All OAuth flows initiated by DTFGSA originate from dtfgangsheetapp.com or builder.dtfgangsheetapp.com. If you encounter an OAuth consent screen requesting Google scopes from any domain other than these, do not authorize it.

10. International Data Transfers

DTFGSA, Inc. is based in the United States with operations coordinated from North Macedonia. Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses for transfers from the EEA/UK.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us