Merchant data terms

Version 1.0 · Effective November 4, 2026

These data-handling terms govern Gang My Sheets for merchants admitted to its controlled pilot. The service operator is Sakurami LLC, reachable at admin@readymyprints.com. The merchant controls its store, customer transactions, product prices and fulfillment. For processing on the merchant's behalf, the merchant provides lawful documented instructions and Sakurami LLC provides the application functions described here.

The merchant instructs us to receive and store artwork; create, save, recover and share gang-sheet projects as directed; prepare Shopify checkout; reconcile relevant purchases; create print files; support the merchant; and respond to verified privacy and security requests. We will not sell the data, use it for advertising audiences or train AI artwork models with it.

Covered people are merchant users, customers and project collaborators. Covered data includes store identifiers and configuration, authorized sessions, customer identifiers/names/emails needed by the app, uploaded artwork, project layouts, sharing instructions, and relevant order, production and download records. Processing includes collection, storage, retrieval, rendering, merchant-directed sharing, reconciliation, export and deletion. Shopify processes payments; the app does not collect card credentials.

The merchant must have the authority to provide the data/artwork and to instruct its processing, provide applicable customer notices, and communicate relevant consent restrictions and verified requests. We will use data only for the documented service purposes and applicable obligations, and notify the merchant if we cannot follow an instruction lawfully or securely.

We restrict operator access to authorized people who need it and are subject to confidentiality duties. Production safeguards include encrypted data storage and backups, HTTPS, merchant-scoped access, protected credentials and access logging. We will help with verified rights requests, relevant security/compliance review and incident response. We will notify affected merchants of an actual or suspected merchant-data breach immediately and within 24 hours of awareness, and provide available information as the investigation proceeds.

The merchant authorizes the service providers named in the published privacy policy: Shopify, OVHcloud, Cloudflare R2, Resend and PrivateEmail, for their stated service functions. We remain responsible for the protection obligations we place on providers. We will notify the merchant before adding or materially changing a provider that processes its personal data and allow a reasonable opportunity to object before the change applies. We will not expand a merchant's processing into a jurisdiction requiring an additional transfer agreement without first arranging that agreement with the merchant.

The service relationship and documented retention purposes determine processing duration. The published privacy policy states the current 90-day completed-file and order-contact rules, continued saved-project storage for reuse, temporary upload handling and backup limitations. Automatic financial-record cleanup is deferred for this pilot. Open orders, privacy requests, documented holds and applicable obligations must be reconciled before removal; data must not be kept for an unrelated purpose.

When the relationship ends, we will work with the merchant to return or delete its data, subject to documented applicable retention requirements and the published backup/recovery process. We will provide relevant compliance information and cooperate with reasonable documented reviews without exposing another merchant's data, credentials or security secrets.

Acceptance is recorded with the merchant/store, accepted version, date and authorized representative before store admission. These terms do not authorize charges, public-store changes, new recipients or any unrelated use of data.