Legal
Privacy Policy
Bootleg Gift ("we", "our", "us") respects your privacy. This Privacy Policy explains what personal information we collect when you visit bootleggift.com (the "Site") or place an order, how we use it, who we share it with, and the choices you have.
1. Information we collect
We collect only what we need to deliver your order:
- Order details – name, shipping address, billing address, email, phone number, order items. Payment details (card numbers, etc.) are handled directly by our payment processor (Shopify Payments) and never stored on our servers.
- Photos you upload – the images you submit on the design page. Used only to generate your custom bootleg design and (after purchase) to print your order. Auto-deleted from our servers within 24 hours after the generated design is delivered and the order is fulfilled. See "Data retention" below.
- The name and template you pick – saved with your design so we can print exactly what you previewed.
- Browsing data – IP address, device type, browser, pages visited, referral source. Collected via cookies and the analytics tools listed in section 4.
- Support messages – the email content when you write to us at [email protected].
2. How we use your data
- Generate your preview, print your order, ship it, and follow up with tracking + confirmation emails.
- Respond to support requests and process refunds or replacements.
- Detect fraud, prevent abuse, and comply with tax + regulatory obligations.
- Improve the Site and measure ad performance (only with cookies you accept).
- Send promotional emails – only if you opted in. Every promotional email has a one-click unsubscribe link.
3. Who we share data with
Bootleg Gift never sells your personal information. We share only what each partner needs to do their job:
- Shopify – our e-commerce platform. Hosts checkout, processes payment, stores order records.
- Our production partner – receives the finished design file and shipping address to print and ship your order. Bound by contractual obligations to use the data only for fulfillment.
- Shipping carriers – USPS, UPS, FedEx, or local postal partners (selected based on destination). They receive your shipping address only.
- Sub-processors involved in design generation – we use third-party infrastructure to process your uploaded photos and generate the design. These sub-processors receive only what is required for the generation step and are bound by data-protection terms that prohibit any other use (including training third-party AI models on your data).
- Analytics & advertising – Meta (Facebook) Pixel and Conversions API. We send pseudonymous event data (page views, add-to-cart, purchase) so we can measure how our ads perform. Event data sent server-to-server includes hashed email/name/address (one-way SHA-256, never the plaintext) when you provide them at checkout, plus your IP address and a randomly-generated visitor ID. We do not currently use Google Analytics.
4. Cookies & tracking
We use cookies for: keeping your bag, recognising returning visitors, measuring ad performance (Meta Pixel + Conversions API), and product analytics. You can disable cookies in your browser settings - the design + checkout flow will still work, but personalisation and ads will not.
5. Your rights
Depending on where you live (EU/EEA, UK, California, etc.), you may have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion ("right to be forgotten") - subject to our legal record-keeping duties.
- Object to processing or request data portability.
- Withdraw consent for marketing emails at any time.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, email [email protected]. We'll reply within 30 days.
6. Data retention
- Uploaded photos: deleted from our servers within 24 hours after the generated design is delivered and the order is marked fulfilled. If you previewed a design but did not buy, the upload is deleted within 7 days.
- The watermarked preview: kept for up to 12 months so you can revisit the result-page link and decide to purchase later.
- The clean (un-watermarked) print file: deleted within 60 days after order fulfillment.
- Order records (name, address, items, amount): kept for 7 years to meet tax and accounting requirements.
- Email list: kept until you unsubscribe.
7. Security
We use HTTPS/TLS everywhere, Shopify's PCI-DSS-compliant payment processing, role-based access controls on internal tools, and short-lived server-side credentials. No system is 100% secure, but we apply industry-standard precautions and review them regularly.
8. International transfers
Our partners are based in the United States. We ship to the US, Canada, and Australia only. If you order from Canada or Australia, your data is transferred to and processed in the US under Standard Contractual Clauses where required.
9. Children
Our Site is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this policy
If we update this policy, the "Last updated" date at the top will change. Material changes will be highlighted on this page; if we have an account email for you we will notify you directly.
11. Contact
Questions, deletion requests, or anything else - email [email protected] or use our contact form.