Sprintify privacy policy

Last updated: 2026-10-13

Sprintify is a Shopify app that lets shoppers personalise products: they upload a photo and type texts, see a preview on the product page, and the personalisation goes with their order. This policy explains what data Sprintify handles, why, where it goes and how long it is kept. Sprintify is provided by STL Embeded Creations SRL (Romania).

For the data of a store's customers, the merchant (the store) is the controller and Sprintify processes it on their behalf, under the data processing terms below. Shoppers with questions about their data should contact the store they bought from first.

Data from merchants

• Store and access: when a merchant installs Sprintify, Shopify gives it the store's domain and an access token, kept in Sprintify's database so the app can work for that store.
• Settings: templates, fonts, loading masks, each template's photo processing and the templates each product offers are stored in the merchant's own Shopify store (as app data). Images and fonts used in templates are in the store's Shopify Files. How long ordered files are kept and whether shoppers see the photo notice are kept in Sprintify's database.
• Template backups: each time a template is saved, Sprintify keeps a copy of it (its design, settings, photo processing and the products offering it) in its own database, so the merchant can restore templates if the store loses them. They contain no shopper data.
• Plan and billing: Shopify bills the merchant's Sprintify plan. Sprintify reads the store's plan, its free trial and billing period from Shopify, keeps them with the store's count of AI-processed photos per period, its limit for extra photos, the extra photos charged and any AI photos STL Embeded Creations SRL gives the store, and tells Shopify only how many extra photos to charge (no shopper data). Card and payment details stay with Shopify.
• Support tickets: what a merchant writes to Sprintify support in the app (the subject, messages and the email address to answer to) and the answers, in Sprintify's database; pictures attached to a ticket in Sprintify's private file storage. A new ticket or a merchant's reply is also passed to STL Embeded Creations SRL's own automation server (in the same DigitalOcean region), which tells STL Embeded Creations SRL's support staff; it keeps no copy.

Data from shoppers

• Photos: a photo a shopper uploads is reduced in their browser (at most 1024 pixels), sent through Shopify to Sprintify's server and processed as the merchant chose for the template (below). The processed image is sent back to the shopper's browser. Merchants can show shoppers a short notice under the upload about how the photo is used, with a link to the store's privacy policy.
• Texts: the texts a shopper types are added to the cart and the order, where the merchant sees them. They aren't sent for processing.
• The final design: when a shopper adds a personalised product to the cart, an image of their design, and one of the preview as they saw it, are saved if the merchant has chosen to. When the merchant asks for them, production files of the design (a PNG for print, a PDF, an SVG) are made once it's ordered, from the template, the text the shopper typed and their processed photo.
• Where the files go: the shopper's photo, the processed image, the final design and the preview are kept in Sprintify's private file storage (Frankfurt, Germany), in a separate folder for each store. Nothing there is public: the merchant opens them from a link on the order (visible to the merchant only) or downloads them in the app, through addresses that work for a short time only. When the order arrives, Sprintify notes its number and the product's name, to name the downloaded files.
• Images made with AI carry a mark in their metadata saying so (the IPTC “digital source type”), as do designs that include one.
• Limits: to limit how many photos one shopper can send in an hour, Sprintify uses a scrambled form (a hash) of the shopper's internet address, or of their customer number when they're logged in, combined with the store. The hash and a count are kept in Sprintify's database for at most an hour; the address itself is never stored.

Sprintify sets no cookies on the store and doesn't track shoppers across sites.

Photo processing

Effects (such as black and white or a pencil sketch) are applied by Sprintify's own server. For other processing, the photo and the instructions for the chosen processing are sent to Sprintify's processing service, run by STL Embeded Creations SRL on DigitalOcean (Frankfurt, Germany), which returns the result without keeping either. AI styles have the image edited by OpenAI's image service, which receives the photo and the instructions only, under its API terms: they don't allow it to use them to train its models, and it may keep them for up to 30 days to detect abuse.

Usage statistics

To show merchants how the app is used, Sprintify records, for each store, each photo sent (whether it was processed, how long it took, or why it was turned away), each design saved and each personalised add to cart, with the template and product involved. For orders with a personalised product it records the order and line numbers, the product, template, quantity, amount, currency, the link to the files and the storefront's country (the market the shopper browsed, not their address). It receives no names, email addresses, phone numbers or addresses for this: Shopify is asked to send only the fields above. These records are kept for twelve months.

To count how many different shoppers use it (for Sprintify's own usage figures), each record of a photo, a design or an add to cart carries an anonymous identifier valid for one day: the scrambled form used for the hourly limit (above), scrambled again with a random key that is replaced every day and deleted the day after. The same shopper can't be recognised from one day to the next, and nobody can be identified from it.

Error reports

When something fails on Sprintify's server, a report of the error (what failed, where in the code, the store's domain and the page's path) is sent to Sentry, an error monitoring service, so it can be fixed. Reports carry no photos, texts, request bodies, cookies, internet addresses or access tokens: they're removed before sending. Sentry keeps them for 90 days at most.

Who else processes the data

Transfers to the United States (OpenAI) rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses in the provider's terms.

How long data is kept

• Photos, processed images, designs and previews of personalisations that aren't ordered within 14 days: deleted then.
• Those of ordered personalisations: for the time the merchant chooses in the app (12, 24 or 36 months from the order, 24 unless changed, or until the merchant deletes them), and until a customer's erasure request (below).
• Deleted files (for any of the reasons above or below) can still be restored by STL Embeded Creations SRL for 7 days, to recover from mistakes; then they're gone for good.
• Usage statistics and order records: twelve months.
• Photo counts per billing period and extra photos charged: a little over a year.
• Customer data requests listed for the merchant: until the merchant marks them done.
• Template backups: the last five copies of each template; those of a template the merchant deletes, 30 days.
• Support tickets: until the merchant deletes them (with their pictures) or uninstalls Sprintify.
• Error reports: 90 days at most.
• Server logs (request numbers, store domains, durations and error causes, for fixing problems): a limited time, by the hosting provider.
• Everything about a store, files included: deleted 48 hours after the merchant uninstalls Sprintify, when Shopify asks for it. Merchants can download their order files in the app (Settings) before uninstalling.

Requests about personal data

Shopify passes customers' requests to see or erase their data to Sprintify. A request to see their data is listed for the merchant in the app (Settings), with a download of what Sprintify holds for that customer's orders (their personalisations' files and order records), for the merchant to send to the customer. On an erasure request, Sprintify deletes the customer's photos, processed images, designs and previews (gone for good 7 days later, see above) and its records of their orders. Merchants can also have their store's data deleted by uninstalling the app or by writing to us.

Security

All traffic is encrypted (HTTPS). Shoppers' requests reach Sprintify only through Shopify, which signs them; requests to Sprintify's processing service carry a secret of its own. Files are kept in private storage, readable only through short-lived signed addresses. Access tokens and secrets are kept out of the code, logs and error reports.

Data processing terms

When Sprintify handles the personal data of a store's customers (their photos, designs and the order records above), the merchant is the controller and STL Embeded Creations SRL the processor. Using Sprintify, the merchant and STL Embeded Creations SRL agree that STL Embeded Creations SRL:

• processes that data only to provide Sprintify as the merchant sets it up (their documented instructions), for the purposes and as long as this policy describes;
• has the people who can access it bound to confidentiality;
• protects it with the measures under Security above (encryption in transit, private storage, access limited to what's needed, secrets kept out of code and logs);
• uses only the sub-processors listed above, under terms with equivalent protections, and announces changes to them on this page at least 30 days ahead, so the merchant can object or stop using the app;
• helps the merchant answer customers' requests (as described above) and with their obligations on security, breach notification and impact assessments, as far as the app is concerned;
• tells the merchant without undue delay after becoming aware of a breach affecting their customers' data;
• deletes the data when the merchant uninstalls the app (48 hours after, on Shopify's request), leaving the merchant time to download it first;
• makes available the information needed to show these terms are kept, and allows reasonable audits on request, with notice.

Data is processed in the European Union, except the image editing for AI styles by OpenAI (United States, above). Merchants who need a signed data processing agreement can ask at [email protected].

Changes and contact

This policy changes when the app's handling of data does; the date above shows the latest version. Questions or requests: [email protected].