Privacy Policy

1. Information We Collect

Information you provide: Name, email address, shipping address, and payment details when you place an order. Design prompts you submit for AI image generation. Optional customer notes on orders.

Automatically collected: IP address, browser type, device information, and pages visited. We use a persistent cookie (onetee_anon_id) to track free generation usage per device. We do not use third-party analytics or advertising trackers.

2. How We Use Your Information

• Process and fulfill your orders
• Send transactional emails (order confirmation, shipping updates)
• Generate AI images based on your prompts
• Enforce usage limits and prevent abuse
• Improve our products and services

We do not sell, rent, or trade your personal information.

3. Third-Party Services

We share data with the following service providers, solely to operate OneTee:

• Stripe — payment processing. Stripe receives your payment details directly; we never store card numbers. Stripe Privacy Policy
• Fal.ai — AI image generation. Your design prompts are sent to Fal.ai to produce images. Fal.ai Privacy Policy
• Supabase — database and authentication. Supabase Privacy Policy
• Resend — transactional email delivery. Resend Privacy Policy
• Vercel — website hosting. Vercel Privacy Policy

4. Cookies

We use the following cookies:

• onetee_anon_id — tracks free generation usage per device (1 year, httpOnly)
• admin_secret — admin session authentication (8 hours, httpOnly)

We do not use advertising or third-party tracking cookies.

5. Data Retention

Order records and associated data are retained for 7 years for legal and accounting compliance. Generated images not associated with an order are retained for up to 30 days. You may request earlier deletion by contacting us.

6. Your Rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data
• Object to or restrict processing of your data
• Request a portable copy of your data
• Opt out of the sale of personal information (we do not sell data)

California residents (CCPA): You have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information.

EU/UK residents (GDPR): Our legal basis for processing is contract performance (order fulfillment) and legitimate interest (fraud prevention, service improvement). You may lodge a complaint with your local data protection authority.

7. Security

We use HTTPS encryption, rate limiting, input validation, and server-side access controls to protect your data. Payment information is handled entirely by Stripe and never touches our servers.

8. Children

OneTee is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, please contact us for removal.

9. Changes

We may update this policy from time to time. Material changes will be noted with a revised date at the top of this page.

10. Contact

For privacy inquiries or data requests, email us at printshop818@gmail.com.