Total Print Hub Privacy Notice

1. Who operates Total Print Hub

Total Print Hub is offered worldwide by ITLOX, Inc., incorporated in Delaware, USA. ITLOX, Inc. is the contracting and subscription-billing entity and the independent controller for merchant-account and business-administration data. ITLOX LTD, incorporated in England and Wales, may support development, operations, privacy, and customer support as an affiliated service provider acting for ITLOX, Inc. Together, where the context requires, they are referred to as ITLOX.

2. Our role and the merchant's role

For content and personal data submitted by a merchant or its customers, the merchant generally determines why the data is processed and acts as controller or business; ITLOX generally acts as processor or service provider and follows the merchant's documented instructions. ITLOX acts as an independent controller for merchant-account administration, platform-billing evidence, security, fraud prevention, support, product operations, legal compliance, and protection of ITLOX rights.

Customers of a Shopify or WooCommerce merchant should normally direct requests about an order or design to that merchant. ITLOX supports the merchant and applicable platform-privacy workflows when a verified request is received.

3. Information we process

Commerce platform and merchant account information

• Store domain, Shopify or WooCommerce installation identifiers, installation status, approved scopes or permissions, locale, plan and subscription status, and OAuth, application-password, signature, or session-validation metadata.
• Merchant-user contacts, roles, access records, feature preferences, onboarding progress, support communications, security events, and audit records.

Merchant configuration and content

• Product and supplier mappings, product images, mockups, print areas, sides, variants, colours, sizes, templates, artwork, fonts, pricing rules, gang-sheet sizes, storefront settings, export settings, and supplier profiles.
• Merchant-uploaded assets and merchant-specific derivatives of shared art or font packs. A private merchant override never overwrites the shared original; resetting or deleting the override can reveal that original again.

Customer design, cart, order, and production information

• Design documents, text, uploaded artwork, font references, previews, dimensions, placement data, saved-design IDs, cart properties, order references, and the minimum customer or order identifiers supplied by Shopify or WooCommerce for fulfilment.
• Export jobs, downloadable production packages and source resources, validation and approval records, supplier handoff status, and operational audit evidence.

Technical, supplier, and optional-feature information

• IP address, device and browser details, request IDs, timestamps, diagnostic logs, security events, and rate-limit evidence.
• Supplier connection metadata and protected credentials when a merchant chooses to connect a supplier.
• Bounded briefs, product context, generated draft plans, safety results, provider request IDs, and usage metadata when an authorised merchant enables optional AI.
• Contact enquiries and optional product-update subscriptions, including business contact details, the consent version and time, the source form, and an email hash used to honour unsubscribe choices.

Total Print Hub is not designed to collect payment-card data, government identification numbers, health information, or special-category or similarly sensitive personal data. Payment credentials remain with Shopify or the merchant's WooCommerce payment provider.

4. How and why we use information

• Provide the service: install and authenticate the app; configure products; operate Studio and Gang Sheet; calculate quotes; preserve designs; connect carts and orders; generate production resources; and complete merchant-requested supplier workflows.
• Protect the service: isolate tenants, validate uploads, scan for malware or abuse, investigate incidents, enforce entitlements, prevent fraud, and maintain security and audit records.
• Operate and improve: troubleshoot failures, measure reliability, provide support, and improve workflows using data minimised for the purpose.
• Answer and communicate: respond to requested sales or support enquiries and, only after explicit signup, send Total Print Hub product, release, and launch updates with a working unsubscribe route.
• Comply with law: answer verified privacy requests, preserve lawful evidence, resolve disputes, and protect merchants, customers, ITLOX, and third parties.

Where UK or EEA law applies, legal bases include performance of a contract, compliance with legal obligations, legitimate interests in securely operating and improving the service, and consent where legally required. ITLOX processes merchant-customer content primarily on the merchant's instructions.

5. Disclosure and subprocessors

ITLOX discloses information only as needed to operate the service, follow merchant instructions, protect the platform, or comply with law. Recipients may include:

• Shopify for installation, authentication, app billing, storefront, cart, checkout, order, and mandatory privacy-webhook workflows.
• WordPress and WooCommerce for connector authentication, products, storefront, cart, checkout, order, and merchant-directed lifecycle workflows.
• Amazon Web Services for isolated application infrastructure, databases, private object storage, delivery, backup, monitoring, and security.
• Merchant-selected suppliers only when the merchant intentionally synchronises or submits a production workflow.
• OpenAI only for the optional server-side AI workflow described in the AI policy, after the merchant enables it.
• Professional advisers, authorities, or transaction parties where reasonably necessary for law, claims, corporate transactions, or protection against harm.

ITLOX does not sell personal information, share it for cross-context behavioural advertising, or allow one merchant to access another merchant's private content.

6. International transfers

ITLOX operates through UK and US entities and uses approved providers that may process data in the United Kingdom, United States, and other approved locations. Where a restricted transfer requires safeguards, ITLOX uses an applicable adequacy decision, European Commission Standard Contractual Clauses, UK International Data Transfer Addendum, or equivalent lawful mechanism with technical and organisational safeguards.

7. Retention, deletion, and uninstall

ITLOX retains personal data only as long as reasonably necessary for its purpose. Merchant configuration and active designs are normally retained while the app is installed or until deleted. Order and production records follow merchant-configured retention and may be kept longer for fulfilment, accounting, disputes, fraud prevention, or legal hold. Security logs and backups follow bounded retention schedules.

Total Print Hub implements Shopify's required privacy webhooks: customers/data_request, customers/redact, and shop/redact. Verified deletion requests are completed unless law requires particular data to be retained. Uninstalling revokes active access but does not override a lawful retention obligation.

Marketing enquiries are retained only while reasonably needed to answer and manage the relationship. An update subscription remains active until withdrawn. Unsubscribing removes the address from the active subscription record and preserves only the minimum hashed suppression record needed to honour that choice. Subscription choices are not tenant content and are never shared with Shopify or WooCommerce merchants.

8. Security

Controls include Shopify OAuth and session validation, WooCommerce connector authentication and signatures, webhook HMAC verification, least-privilege access, tenant-scoped database enforcement, private object storage, signed short-lived asset access, encryption in transit and at rest where supported, upload validation, malware scanning, SVG sanitisation, restricted secret management, and audit logging. No service can guarantee absolute security. Merchants must protect commerce-platform, staff, supplier, and device credentials and report suspected compromise.

9. Cookies and similar technology

The app uses strictly necessary authentication, session, security, and load-balancing mechanisms required for an embedded Shopify app, a WooCommerce connector, and their storefront tools. Total Print Hub does not use merchant or customer data for third-party advertising or cross-site tracking. Required notice or consent controls will be introduced before any optional analytics or non-essential cookies are used.

10. Privacy rights

Depending on location and law, individuals may have rights to access, correct, delete, restrict, object, obtain portability, withdraw consent, or complain. California residents may also have applicable rights to know, correct, delete, limit certain uses, and receive equal service. ITLOX does not sell or share personal information as those terms are defined by California law.

Send requests to dpo@itlox.com. ITLOX may verify identity and authority. A merchant's customer should identify the relevant Shopify or WooCommerce store so ITLOX can coordinate with the merchant. UK individuals may complain to the Information Commissioner's Office; EEA individuals may complain to their local supervisory authority.

Product-update consent can also be withdrawn using the unsubscribe link included in each update. Withdrawing optional marketing consent does not affect essential security, billing, support, or service communications.

11. Children

Total Print Hub is a business application for Shopify and WooCommerce merchants and is not directed to children. Merchants must configure customer-facing experiences in accordance with applicable age, parental-consent, and consumer-protection requirements. ITLOX does not knowingly use children's data for advertising or profiling.

12. Changes and related terms

ITLOX may update this notice for product, legal, or operational changes. Material changes receive a new effective date and, where required, notice through the connected platform or the merchant's registered contact. Use is also governed by the Total Print Hub Terms, the billing policy, and the complete app-hosted privacy notice.