Privacy Policy

Shirt Bazaar, Inc. ("Shirt Bazaar", "we", "us") explains here how we collect, store, process, transfer and disclose personal data when you use our platform, website, generation studio and fulfillment services.

For individuals in the EEA, UK or Switzerland, Shirt Bazaar, Inc. is the Data Controller for your personal information.

We collect only what running the Platform requires:

• Account & Identity: Email, hashed credentials, public handle (/yourhandle), display name, avatar and communication preferences.
• Prompts & Reference Media: Text prompts, style settings and reference images sent to our generation provider (fal) to produce artwork, and short text sent to OpenRouter to draft listing copy. See Section 5.
• Order & Shipping: Recipient name, delivery address, phone number and garment selections. Card details are collected directly by Stripe and never reach our servers. We store only the plan, status, renewal date and Stripe customer reference it returns to us.
• Platform Messages: In-app messages between creators and buyers.
• Tee Reviews: If you rate a tee: the stars, the optional line you write and the colour and size you ordered. These are public on the design page as “Verified buyer”, with no name or account attached. The link to your order stays private.
• Coins, Tasks & Spins: Your Coin ledger (what you earned or spent, and why), which earning tasks you have claimed, and your spin history, including any design or render credits a spin awarded.
• Referrals: The referral code in your link, who referred whom, and a pseudonymised form of the network (IP) address a referral came from, used to detect self-referral and sign-up abuse. We do not keep the address itself.
• Partnership Applications: If you apply to the Creator Partnership Program: your name, email, handle, the platforms you use and a link for each, your audience band, portfolio link and project description.
• Technical Data: IP address, device and browser info, request timestamps and security logs.

What we don't collect: no card numbers, no government ID, no advertising identifiers, and no data from anyone we know to be under 13. See Section 10.

Under GDPR, we process your information under these lawful bases:

3.1 AI and your content: We do not use your prompts, uploads or designs to train AI models. Our generation providers process them to return results to you, under their own terms (see Section 5).

Our Cookie Notice lists each cookie and browser storage item we use, with its purpose and how long it lasts.

4.1 Summary: We use cookies to keep you signed in and to record who referred you, and browser storage to remember choices you make, such as muting interface sounds. We use Google Analytics to count visits; it sets analytics cookies outside the EEA, the UK and Switzerland. We do not use advertising cookies or advertising pixels.

4.2 Managing them: You can clear or block cookies and site data in your browser at any time. Blocking the sign-in cookies will stop you signing in or completing a purchase. The Cookie Notice explains how, browser by browser.

We do not sell personal data. To run the Services, we share limited data with these vetted sub-processors:

• Image generation: fal receives your prompt, style settings and any reference image, and returns the artwork.
• Text generation: OpenRouter drafts listing titles/descriptions and analyzes storefront style prompts. It receives the request text, not your account identity.
• Payments: Stripe, Inc. processes payments and billing and runs fraud checks. Stripe is PCI-DSS Level 1 certified and collects card details directly; we never receive them.
• Fulfillment: Printify, Inc. and its print providers receive the recipient name, email, address, phone number, garment selection and print-ready artwork to manufacture and ship your order.
• Database & storage: Supabase, Inc., on Amazon Web Services, holds account records, designs, messages and uploads.
• Hosting: Vercel, Inc. serves the application and processes request metadata, including IP address.
• Analytics: Google LLC runs Google Analytics for us and receives the pages you view, browser and device type, the referring site and an approximate location derived from your IP address. Its advertising features are switched off.
• Email: Resend sends transactional mail and the newsletter, and receives your email address and message content.

We update this list when we add or replace a sub-processor.

6.1 Standard: We keep personal data only as long as needed to service your account, honor guarantees, resolve disputes, and meet tax/financial reporting duties (typically 7 years).

6.2 Claim Records: Because a Genesis Claim conveys permanent IP assignment and royalty rights, the claim record (its date, the claimant, the maker and the design) is kept permanently to support ownership and royalty accounting.

6.3 Coin Ledger: Coin ledger entries and spin records are kept for as long as your account exists, because your Coin balance is the sum of those entries.

6.4 Partnership Applications: We keep an application while we review it and afterwards as a record of the decision. Ask us to delete yours at any time using the contact details in Section 14.

Our infrastructure is hosted in the United States. If you access the Platform from the EEA, UK or another region with data transfer laws, your data is transferred to and processed in the US, safeguarded by Standard Contractual Clauses and applicable transfer addenda.

Depending on where you live, you have the right to:

• Access & Portability: confirmation of processing and a machine-readable copy of your data.
• Rectification: correction of inaccurate or incomplete information.
• Erasure: deletion of your account and data, subject to legal/tax retention exemptions.
• Restrict or Object: object to processing based on legitimate interests or direct marketing.
• Non-Discrimination (CCPA): no penalty for exercising your privacy rights.

To exercise any of these, use the Delete Account button in your dashboard's Security settings, or email privacy@bazaar.america.co. We respond to verified requests within 30 calendar days.

We use technical and organizational measures designed to protect personal data against loss and unauthorized access, including encryption of data in transit and at rest, and access controls that limit who can reach personal data. No system is completely secure, so we cannot guarantee the security of information you send us.

Shirt Bazaar is not directed to children under 13 (or under 16 in applicable European jurisdictions), and account signup requires confirming you're at least 18. We do not knowingly collect data from minors. If you believe a child has given us personal information, email privacy@bazaar.america.co and we'll promptly delete the account and associated records.

11.1 Newsletter: To stop receiving our newsletter, use the Unsubscribe link at the bottom of any newsletter email; one press on the page it opens takes you off the list, and mail apps that show their own Unsubscribe button use the same link. You can also write to support@bazaar.america.co. We keep an unsubscribed address marked so it is never mailed again; write to us and we delete it.

11.2 Service emails: While you have an account we still send emails about your orders, claims, billing and account security, because they are part of the service.

11.3 Your account: You can update your profile at any time, and delete your account from your dashboard's Security settings.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar state laws. Residents of those states may exercise the rights in Section 8, and we will not discriminate against you for doing so.

We may update this Privacy Policy from time to time. When we do, we change the "Last updated" date at the top of this page. If a change is material, we will notify you by email or in the product before it takes effect.

For questions about this Policy or to exercise your rights, contact us: