Privacy Policy

Last updated: August 6, 2026

This Privacy Policy explains how HEDDLEY LLC (“Heddley,” “we,” “us,” or “our”) collects, uses, and shares personal information when we operate the Heddley platform and provide it to print shops and similar businesses (“Merchants”) who sell through it. It covers our platform and our own websites.

1Our role

For information about a Merchant and its account, Heddley acts as the party responsible for that information (a controller). For personal information about a Merchant’s Customers that we process to run the Merchant’s storefront (for example, order and shipping details), Heddley acts as a service provider, processing that information on the Merchant’s behalf and on the Merchant’s instructions. Each Merchant is responsible for its own privacy notice to its Customers.

2Information we collect

• Merchant account information, such as name, business name, email address, and team member details.
• Customer information submitted through a storefront, such as name, email address, shipping address, optional phone number, and business information for resellers.
• Order and design information, including the artwork files Customers upload and the orders they place.
• Tax documentation, such as resale or exemption certificates a Merchant chooses to collect.
• Technical and security information, including IP address and browser user agent, which we record in audit logs to help protect accounts and investigate suspicious activity.
• Payment information is handled by Stripe. We do not store full payment card numbers; card processing is performed by Stripe.

3How we use information

• To provide, operate, and maintain the platform and storefronts.
• To process orders, payments, and refunds, and to calculate and collect applicable taxes.
• To send transactional messages such as receipts and order status updates.
• To secure the platform, prevent fraud and abuse, and keep audit records.
• To provide support and to improve the platform.
• To comply with legal obligations.

We rely on the information being necessary to provide the service you or a Merchant requested, on our legitimate interest in operating and securing the platform, and on compliance with our legal obligations.

4How we share information

We do not sell personal information. We share it with service providers who help us run the platform, each acting under contract and only as needed to provide their service:

• Stripe, for payment processing and tax tools.
• Resend, for sending transactional email.
• Vercel, for application hosting and content delivery.
• MongoDB Atlas, for our application database.
• Amazon Web Services (S3), for file and asset storage.

We may also share information with a Merchant about that Merchant’s own Customers and orders, and we may disclose information when required by law or to protect our rights, users, or the public.

5Cookies

We use a small number of cookies that are necessary for the platform to function, such as keeping you signed in. We do not use advertising cookies, and we do not use third-party analytics or ad-tracking cookies at this time. If that changes, we will update this policy.

6How long we keep information

• Tax-related audit records are kept for at least seven years to meet audit requirements.
• Other audit records are kept for a shorter period, generally two to three years, and technical fields such as IP address may be shortened sooner.
• Resale and exemption certificates are kept as long as tax rules require, typically seven years or more.
• Order records may be kept indefinitely so that Merchants can support reorders and meet their own tax and recordkeeping needs.
• Uploaded designs are tied to the related account and order and are removed in line with account lifecycle, subject to records we must retain.

7Security

We use reasonable technical and organizational measures to protect personal information, including access controls and reliance on established infrastructure providers. No system is perfectly secure, and we cannot guarantee absolute security.

8Your rights and choices

Depending on where you live, you may have rights to access, correct, or delete personal information, or to know what we collect and why. To make a request, contact us using the details below. If your request concerns information we process on behalf of a Merchant, we may direct it to, or act on the instructions of, that Merchant.

• We honor deletion requests where we can, but some records are exempt because we must keep them, for example audit and tax records retained under legal-compliance and legitimate-interest grounds.
• If you are a Customer of more than one Merchant, deleting your information from one Merchant does not delete it from others.

9Children

The platform is intended for businesses and is not directed to children under 13. We do not knowingly collect personal information from children.

10Where we operate

The platform is offered to Merchants and Customers in the United States, and information is processed in the United States.

11Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, provide additional notice.

12Contact

Questions about this policy, or requests about your information, can be sent to support@heddley.com.