Privacy Policy

Depending on the context, we act as both a data controller and a data processor.

As a data controller, we determine how and why personal information is processed when we operate our website, manage user accounts, provide customer support, or carry out other core activities related to offering our Services.

As a data processor, we process personal information on behalf of the businesses that use Jifup (our "Merchants") and according to their instructions. This happens when a Merchant connects an online store or marketplace to Jifup or accepts orders through Jifup, and the Services are used to store and manage that Merchant's orders, including the names, shipping addresses, personalization details and images of the Merchant's own buyers. For this data, the Merchant is the controller. If you bought a product from a Merchant and want to exercise your privacy rights, please contact that Merchant first; we will help the Merchant respond.

We collect personal information that you provide directly, information generated automatically when you use our Services, and information obtained from third-party tools that support our operations. The specific personal information we collect depends on how you interact with our Services, the features you use, and the choices you make.

Personal information we receive directly from you or collect automatically includes:

• Identifiers: name, email address, phone number, physical address.
• Account and transaction data: account or profile information, payment and billing information, transaction history.
• Technical and device data: IP address, device identifiers, browser type and operating system, technical logs and system data.
• Usage data: pages visited, actions taken, features used, navigation patterns.
• Analytics and tracking data: cookie data, analytics events, usage logs.
• Communication data: messages or information provided through forms or support.
• Preferences and localization data: language settings, time zone, city-level location (if available).
• Content and order data: images, artwork and text uploaded or created in the product configurator; order, product and personalization data from stores you connect (Etsy, Shopify, WooCommerce, Wix), including your buyers' names and shipping addresses.

All personal information you provide must be accurate, complete, and up to date. You are responsible for notifying us if any of your information changes so we can maintain accurate records.

Data Required for Our Services

Some information is necessary to provide certain features of our Services. Specifically, we need an email address or Google sign-in to create an account, billing information for paid plans, and order and artwork data to process your orders. If you choose not to provide this information, you cannot create an account, subscribe to a paid plan, or have your orders processed.

We collect personal information through a combination of information you provide directly, information gathered automatically when you use our Services, and information supplied by third parties that support our operations.

Information You Provide Directly

We collect personal information that you choose to provide when you interact with our Services. This includes information submitted when you:

• create an account or update profile details;
• complete forms, make purchases, or contact customer support;
• upload images or artwork, or create designs in the configurator;
• respond to surveys, request information, or communicate with us.

Information Collected Automatically

When you visit our website or use the Services, we automatically collect certain technical and usage information. This data does not usually reveal your identity but may include:

• IP address and device identifiers;
• browser type, operating system, and device characteristics;
• language settings and time zone;
• pages viewed, links clicked, and navigation patterns;
• error logs, performance data, and diagnostic information;
• cookie data, analytics events, and usage logs.

This information helps us operate, secure, and optimize the Services, and supports internal analytics, reporting, and service improvement.

Information From Your Interactions With the Services

We collect information related to your actions within the Services, including the features you use, the content you view, the settings or preferences you configure, and your interactions with user interfaces or in-app tools. This data helps us personalize the experience and understand how users engage with our platform.

Information From Third-Party Login Providers

If you choose to sign in with Google, we receive certain profile information that Google makes available, such as your name, email address, and account identifier.

Information From Connected Stores and Marketplaces

When you connect an online store or marketplace to Jifup (for example Etsy, Shopify, WooCommerce or Wix), we receive order, product and personalization data from that platform, including your buyers' names, shipping addresses and the images or text they provided. We process this data on your behalf, as described in "Our Role in Data Processing."

Information From Third-Party Service Providers

We may receive information from service providers that support our operations, such as analytics platforms that provide aggregated usage insights, email systems that log delivery or engagement details, payment processors that confirm payments, and hosting and infrastructure providers that supply technical metadata.

We only process personal information when we have a valid legal basis under applicable data protection laws. This means we process data when it is necessary to provide our Services, fulfill our contractual obligations, comply with legal requirements, protect important interests, or pursue legitimate business purposes that do not override your rights.

Legal Bases We Rely On

• Contract: when processing is necessary to provide the Services or take steps at your request.
• Consent: when you voluntarily provide information for a specific purpose; you may withdraw consent at any time.
• Legitimate interests: when processing is necessary for our business operations and does not override your rights.
• Legal obligation: when we must process data to comply with applicable laws.
• Vital interests: when necessary to protect the safety or vital interests of an individual.

Purposes for Which We Process Personal Information

• To create, maintain, and manage user accounts or profiles. Legal basis: to perform our contract with you.
• To provide customer support, answer inquiries, and resolve issues. Legal basis: to perform our contract with you.
• To process transactions, manage billing, and fulfill orders or service requests. Legal basis: to perform our contract with you.
• To process uploaded images and artwork, including with AI tools (for example upscaling, background removal and artistic styles), and to prepare print-ready files and shipping labels for your orders. Legal basis: to perform our contract with you.
• To send newsletters, updates, or promotional content. You can opt out at any time. Legal basis: your consent.
• To analyze usage data to understand how our Services are used and to improve functionality, performance, and user experience. Legal basis: your consent.
• To detect, prevent, or investigate fraud, abuse, or security incidents. Legal basis: our legitimate interests in preventing fraud and abuse and keeping the Services and user accounts secure.
• To comply with applicable laws, regulations, or legal processes. Legal basis: to comply with legal obligations.

We process personal information in ways that are appropriate to the nature of the data and the purposes for which it is collected. This includes storing, organizing, using, transmitting, and deleting information when it is no longer required. We apply principles of data minimization, purpose limitation, and accuracy to ensure that personal information is processed only when necessary and for clearly defined purposes.

Access to personal information is limited to authorized personnel who require it to perform their job duties and who are bound by confidentiality obligations. We implement technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or misuse. These measures may include access controls, authentication procedures, logging, encryption in transit and at rest (where appropriate), monitoring, and routine security assessments.

Payments are processed by our payment processor, Stripe. Card details are entered with and handled by Stripe; we receive only limited payment information, such as the card brand, the last four digits, and billing details.

We may combine information collected from different sources when this is necessary to operate the Services or when required to meet a lawful purpose, such as preventing fraud or maintaining the security of our platform.

We retain personal information only for as long as needed for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. For more details, see the "How Long We Retain Information" section.

Where required by applicable laws, we provide users with the ability to access, update, delete, restrict, or withdraw consent to the processing of their personal information. Additional rights may apply depending on your location; see the "Your Rights" section for more information.

We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects. If this changes in the future, we will update this Policy and provide any required notices or options.

We use cookies and similar tracking technologies (such as web beacons, tags, and pixels) to operate our website, understand how it is used, improve performance, and enhance your experience. These technologies help us maintain platform security, remember your preferences, prevent errors, and support essential site features.

We may use the following categories of cookies:

• Necessary / Essential Cookies: required for the website to function properly and to provide services explicitly requested by the user.
• Functional / Preference Cookies: enable the website to remember user preferences or settings.
• Analytics / Performance Cookies: collect aggregated or behavioral data to help us understand usage and improve performance.
• Advertising / Marketing Cookies: track user behavior across sites to deliver targeted ads or measure ad performance.

Some cookies are set directly by us ("first-party cookies"), while others may be placed by third-party providers that support our operations ("third-party cookies"), such as analytics or advertising tools. We use Google Analytics.

Where required by law, we display a cookie banner to obtain consent and to give users control over cookie settings. Necessary cookies are always active, while Functional, Analytics and Advertising cookies are used only with your consent where the law requires it. You can change your choice at any time through the "Cookie settings" link at the bottom of every page.

We may share personal information with trusted third-party service providers that help us operate our Services, perform functions on our behalf, or support our business operations. These third parties may access personal information only as necessary to perform their tasks, must protect it through appropriate contractual safeguards, and are not permitted to use it for their own purposes. They must also retain the data only for the period we instruct.

We may share personal information with the following categories of third parties:

• Hosting and infrastructure providers: support the operation, storage, and hosting of our website and Services.
• Analytics providers: help us understand how our Services are used and improve performance.
• Payment processors: manage and process payments securely (Stripe).
• Email or messaging platforms: send notifications, updates, and transactional communications.
• Advertising or marketing partners: support promotional activities or measure advertising effectiveness.
• Security and fraud prevention tools: detect, prevent, and investigate unauthorized or harmful activities.
• AI image-processing providers: process the images and artwork you upload so that we can upscale, clean up or restyle them.
• Connected platforms, shipping carriers and label providers: the sales platforms you connect (Etsy, Shopify, WooCommerce, Wix) and the carriers and label providers used when you create shipping labels.

We may also share information in the following situations:

• Business transfers: we may disclose or transfer information in connection with (or during negotiations of) any merger, sale of assets, financing, or acquisition of all or part of our business.
• Affiliates: we may share information with our affiliates, in which case they must honor this Privacy Policy. Affiliates include subsidiaries, parent companies, or other entities under common ownership or control.
• Business partners: we may share information with partners to offer joint products, services, or promotions when applicable.

We only share personal information when necessary to provide our Services, comply with legal obligations, or protect our rights and the rights of others.

We are based in the United States, so personal information may be transferred to countries outside the European Union (EU), the European Economic Area (EEA), or the United Kingdom, including the United States. These countries may have different data protection laws than those in your region.

When we transfer personal information internationally, we take appropriate steps to ensure it remains protected. We rely on Standard Contractual Clauses (SCCs), which are approved contractual terms designed to ensure your information receives adequate protection, and may also perform Transfer Impact Assessments to evaluate the laws of the destination country.

If applicable, certain third-party providers may participate in internationally recognized data transfer frameworks designed to ensure adequate protection of personal information. When such frameworks apply, transfers are handled in accordance with those requirements.

You may request additional information about the safeguards we use for international transfers by contacting us using the details provided in the "How to Contact Us" section. We only transfer personal information when permitted by applicable data protection laws and when appropriate safeguards are in place.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory requirements, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data and the reason it was collected.

When we no longer have a legitimate business need to process personal information, we will delete or anonymize it. If deletion is not immediately possible (for example, due to technical constraints or backup systems), we will securely store the information and isolate it from further processing until deletion is feasible.

We retain personal information for the following periods:

• Account information: until you delete your account.
• Profile and preferences: until you close your account.
• Usage logs and activity data: 1 year.
• Cookies and tracking data: up to 2 years (Google Analytics cookies).
• Payment and billing information: 7 years.
• Purchase and order history: 5 years.
• Security logs: 1 year.
• Legal and regulatory records: 7 years.
• Customer support records: 3 years after resolution.
• Marketing communications: 90 days after you unsubscribe.
• User-generated content (images, artwork, designs): until you delete it or close your account.

Data we process on behalf of Merchants is kept for as long as the Merchant keeps it in Jifup and is deleted when the Merchant deletes it or closes their account, unless the law requires otherwise.

We implement appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, or destruction. These measures are designed to provide a level of security appropriate to the risks associated with processing personal information.

Our safeguards may include:

• encryption of data in transit and at rest;
• access controls to limit who can view or handle information;
• monitoring and logging of system activity to detect potential issues;
• regular security assessments and updates to our systems;
• secure data storage and transmission practices;
• employee training on data protection and security.

While we take reasonable steps to safeguard personal information, no system or method of transmission over the internet is completely secure. Because of this, we cannot guarantee absolute security.

If we identify a data breach that affects your personal information, we will notify you and any applicable supervisory authorities when required by law.

Individuals have certain rights regarding their personal information. These rights vary depending on where they live, but we aim to provide clear and accessible options for all users.

Rights for Users in the European Union (EU/EEA)

If you are located in the EU/EEA, you have the following rights under the GDPR:

• Right of access: request a copy of the personal information we hold about you.
• Right to correction: request that we correct inaccurate or incomplete information.
• Right to deletion: request deletion of your personal information in certain circumstances.
• Right to restrict processing: request that we limit how your data is used.
• Right to object: object to processing based on legitimate interests or direct marketing.
• Right to data portability: request your information in a structured, commonly used format.
• Right to withdraw consent: withdraw consent at any time when processing is based on consent.

If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with a data protection authority. You can usually contact the authority in your country of residence, place of work, or where you believe a violation has occurred.

Rights for Users in the United Kingdom

If you are located in the United Kingdom, you have the following rights under the UK GDPR: access, correction, deletion, restriction of processing, objection, data portability, and the right to withdraw consent.

If you believe we are processing your personal information unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Rights for Users in Switzerland

If you are located in Switzerland, you have the following rights under the Swiss Federal Act on Data Protection. This section supersedes any other possibly divergent or conflicting information contained in this Privacy Policy. Further details regarding the categories of data processed, the purposes of processing, the categories of recipients of the personal data, if any, the retention period and further information about personal data can be found in the relevant sections within this document.

You may exercise certain rights regarding your personal information within the limits of the Swiss Federal Act on Data Protection, including:

• the right of access to personal data;
• the right to object to the processing of your personal data (which also allows you to demand that processing of personal data be restricted, personal data be deleted or destroyed, or specific disclosures of personal data to third parties be prohibited);
• the right to receive your personal data and have it transferred to another controller (data portability);
• the right to ask for incorrect personal data to be corrected.

Any requests to exercise these rights can be directed to us through the contact details provided in this document. Such requests are free of charge and will be answered as early as possible, providing you with the information required by law.

Rights for Users in Brazil

This section integrates with and supplements the information contained in the rest of the Privacy Policy and is provided by us and, if the case may be, our parent, subsidiaries and affiliates (for the purposes of this section referred to collectively as "we", "us", "our").

This section applies to all users in Brazil ("you", "your", "yours"), according to the "Lei Geral de Proteção de Dados" (the "LGPD"), and for such users, it supersedes any other possibly divergent or conflicting information contained in the Privacy Policy. This part of the document uses the term "personal information" as it is defined in the LGPD.

The grounds on which we process your personal information. We can process your personal information solely if we have a legal basis for such processing. Legal bases are as follows:

• your consent to the relevant processing activities;
• compliance with a legal or regulatory obligation that lies with us;
• the carrying out of public policies provided in laws or regulations or based on contracts, agreements and similar legal instruments;
• studies conducted by research entities, preferably carried out on anonymized personal information;
• the carrying out of a contract and its preliminary procedures, in cases where you are a party to said contract;
• the exercising of our rights in judicial, administrative or arbitration procedures;
• protection or physical safety of yourself or a third party;
• the protection of health, in procedures carried out by health entities or professionals;
• our legitimate interests, provided that your fundamental rights and liberties do not prevail over such interests; and
• credit protection.

To find out more about the legal bases, you can contact us at any time using the contact details provided in this document.

Categories of personal information processed and why. To find out what categories of your personal information are processed and why, you can read the relevant sections within this document.

Your Brazilian privacy rights. You have the right to:

• obtain confirmation of the existence of processing activities on your personal information;
• access your personal information;
• have incomplete, inaccurate or outdated personal information rectified;
• obtain the anonymization, blocking or elimination of your unnecessary or excessive personal information, or of information that is not being processed in compliance with the LGPD;
• obtain information on the possibility to provide or deny your consent and the consequences thereof;
• obtain information about the third parties with whom we share your personal information;
• obtain, upon your express request, the portability of your personal information (except for anonymized information) to another service or product provider, provided that our commercial and industrial secrets are safeguarded;
• obtain the deletion of your personal information being processed if the processing was based upon your consent, unless one or more exceptions provided for in art. 16 of the LGPD apply;
• revoke your consent at any time;
• lodge a complaint related to your personal information with the ANPD (the National Data Protection Authority) or with consumer protection bodies;
• oppose a processing activity in cases where the processing is not carried out in compliance with the provisions of the law;
• request clear and adequate information regarding the criteria and procedures used for an automated decision;
• request the review of decisions made solely on the basis of the automated processing of your personal information, which affect your interests, including decisions defining personal, professional, consumer, and credit profiles or aspects of your personality.

You will never be discriminated against, or otherwise suffer any sort of detriment, if you exercise your rights.

How to file your request. You can file your express request to exercise your rights free from any charge, at any time, by using the contact details provided in this document, or via your legal representative.

How and when we will respond to your request. We will strive to promptly respond to your requests. In any case, should it be impossible for us to do so, we will make sure to communicate to you the factual or legal reasons that prevent us from immediately, or otherwise ever, complying with your requests. In cases where we are not processing your personal information, we will indicate to you the physical or legal person to whom you should address your requests, if we are in the position to do so.

In the event that you file an access or personal information processing confirmation request, please make sure that you specify whether you would like your personal information to be delivered in electronic or printed form. You will also need to let us know whether you want us to answer your request immediately, in which case we will answer in a simplified fashion, or if you need a complete disclosure instead. In the latter case, we will respond within 15 days from the time of your request, providing you with all the information on the origin of your personal information, confirmation on whether or not records exist, any criteria used for the processing and the purposes of the processing, while safeguarding our commercial and industrial secrets.

In the event that you file a rectification, deletion, anonymization or personal information blocking request, we will make sure to immediately communicate your request to other parties with whom we have shared your personal information in order to enable such third parties to also comply with your request, except in cases where such communication is proven impossible or involves disproportionate effort on our side.

Transfer of personal information outside of Brazil permitted by the law. We are allowed to transfer your personal information outside of the Brazilian territory in the following cases:

• when the transfer is necessary for international legal cooperation between public intelligence, investigation and prosecution bodies, according to the legal means provided by the international law;
• when the transfer is necessary to protect your life or physical security or those of a third party;
• when the transfer is authorized by the ANPD;
• when the transfer results from a commitment undertaken in an international cooperation agreement;
• when the transfer is necessary for the execution of a public policy or legal attribution of public service;
• when the transfer is necessary for compliance with a legal or regulatory obligation, the carrying out of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

Rights for Users in the United States

To the extent permitted by applicable law, you have:

• the right to access personal information (the right to know): you have the right to request that we confirm whether or not we are processing your personal information, and to access such personal information;
• the right to correct inaccurate personal information that we maintain about you;
• the right to request the deletion of your personal information;
• the right to obtain a copy of your personal information in a portable and usable format that allows you to transfer data easily to another entity, provided that this is technically feasible;
• the right to opt out from the sale of your personal information;
• the right to non-discrimination: we will not discriminate against you for exercising your privacy rights.

In addition to the rights listed above, as a user residing in Virginia, Colorado, Connecticut, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Montana, Indiana, Kentucky or Rhode Island, you have:

• the right to opt out of the processing of your personal information for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
• the right to freely give, deny or withdraw your consent for the processing of your sensitive personal information. Certain exceptions outlined in the law may apply, such as, but not limited to, when the collection and processing of sensitive personal information is necessary for the provision of a product or service specifically requested by you.

In Minnesota, users also have the right to obtain a list of the specific third parties to which the controller has disclosed the consumer's personal data. In some states like Minnesota, you also have the following rights connected to profiling: the right to question the results of the profiling; the right to be informed of the reason that the profiling resulted in the decision, if feasible; the right to be informed of what actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future; the right to review your personal data used in the profiling; and, if inaccurate, the right to have the data corrected and the profiling decision reevaluated based on the corrected data.

Additional rights for users residing in Utah and Iowa. In addition to the rights listed above, as a resident of Utah or Iowa, you have the following additional rights under the Utah Consumer Privacy Act (UCPA) or the Iowa Consumer Privacy Act (ICPA): the right to opt out of the processing of your personal information for targeted advertising, and the right to opt out of the processing of your sensitive personal information, subject to the exceptions outlined in the law.

Additional rights for California residents. If you are a resident of California, in addition to the rights listed above, you have the following rights under the CCPA/CPRA:

• the right to know the categories of personal information we collect and how it is used;
• the right to access specific pieces of information we hold;
• the right to deletion of your personal information, with certain exceptions;
• the right to correct inaccurate information;
• the right to opt out of the sale or sharing of personal information;
• the right to limit the use and disclosure of sensitive personal information;
• the right to non-discrimination for exercising your rights.

We do not use sensitive personal information for inferring characteristics or for purposes other than those that are reasonably necessary to provide the requested services. Sensitive personal information is not sold or shared for cross-context behavioral advertising.

California residents may opt out of the sharing of personal information for cross-context behavioral advertising and limit the use of sensitive personal information through the "Your Privacy Choices" link at the bottom of every page.

How to exercise your privacy rights under US state laws. To exercise the rights described above, submit your request using the details in the "How to Contact Us" section. For us to respond to your request, we must know who you are. We will not respond to any request if we are unable to verify your identity and therefore confirm the personal information in our possession relates to you. You are not required to create an account with us to submit your request. We will use any personal information collected from you in connection with the verification of your request solely for verification and shall not further disclose it, retain it longer than necessary for purposes of verification, or use it for unrelated purposes. If you are an adult, you can make a request on behalf of a child under your parental authority.

How to exercise your rights to opt out. To opt out of sale or sharing and targeted advertising, you can also use the cookie banner or the "Your Privacy Choices" link on this website. You may also submit opt-out requests via a user-enabled global privacy control, such as the Global Privacy Control ("GPC"), and we will honor such requests.

How and when we will handle your request. We will respond to your request without undue delay, and in all cases within the timeframe required by applicable law. Should we need more time, we will explain the reasons why and how much more time we need. Should we deny your request, we will explain the reasons behind our denial; you may then contact the relevant regulatory authority to submit a complaint. We will not charge a fee to process or respond to your request unless such request is manifestly unfounded or unduly excessive, or in other cases where it is permitted by the applicable law. In such cases, at our discretion, we may charge a reasonable fee or refuse to act on the request, and we will explain our choice.

Rights for All Users

Regardless of where you live, we provide all users with the ability to:

• request access to the personal information we hold;
• request corrections or updates;
• request deletion where appropriate;
• withdraw consent where processing is based on consent.

You can submit a request to exercise your rights by contacting us using the details provided in the "How to Contact Us" section. Users in jurisdictions requiring consent for cookies and tracking (for example the EU/EEA) may withdraw consent at any time via the cookie banner, the "Cookie settings" link, or by contacting us. Withdrawal does not affect the lawfulness of processing performed before withdrawal. We may need to verify your identity before processing your request.

Our Services are intended for businesses and are not intended for children under 16. We do not knowingly collect personal information from individuals under this age. If we become aware that we have collected personal information from a child under 16, we will delete it as soon as reasonably possible.

If you believe that a child has provided personal information to us, please contact us using the details in the "How to Contact Us" section.

We may update this Privacy Policy from time to time to reflect changes in our practices, operational needs, or applicable laws. When we make changes, we will update the "Last updated" date at the top of this Policy.

We use the following methods to notify users of significant changes to this Privacy Policy: posting a notice on our website, sending an email notification, and an in-app notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal information.

If you have questions, concerns, or requests related to this Privacy Policy or our handling of personal information, you may contact us:

• By email: andrew@jifup.com
• By post: Rexit LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States