Privacy Policy — Canvas Design Studio

Canvas Design Studio is a Shopify app built and operated by Craig Lubbe t/a Lubbe Labs, based in South Africa.

If you have any questions about this policy or how we handle your data, please contact us at info@lubbelabs.com.

When we say “we”, “us”, or “our”, we mean Lubbe Labs. “Merchant” means the Shopify store owner who has installed Canvas Design Studio. “Customer” means the end customer of that merchant who personalises a product using the app. We process customer data on behalf of merchants: the merchant is the data controller, and Lubbe Labs acts as a data processor.

Merchant data

• Your Shopify store domain (e.g. yourstore.myshopify.com)
• Shopify session data required to operate the embedded app. For staff who sign in with an online session this can include the staff member’s name and email address, and an access token used to call the Shopify API on your behalf.
• Your store’s display name and logo, cached from Shopify.

Customer data

When a customer personalises a product, we collect and store:

• The design they create (canvas content), which may include any text they type, such as names or messages
• Any images the customer uploads to use in their design
• The customer’s email address, if provided
• Order linkage (order ID and line item) for completed custom orders, used for usage-based billing

We do not collect payment information, passwords, or any special-category personal data.

We process merchant data to identify and operate your store’s installation (legal basis: performance of contract). We process customer data — designs, uploaded images, and any email — to store and render personalised designs and attach them to orders, on behalf of the merchant (legal basis: performance of contract). Order linkage is processed to calculate usage-based billing (legal basis: legitimate interest / performance of contract).

We retain merchant and customer data while the app is installed on the merchant’s store. When a merchant uninstalls the app, Shopify sends us a shop-redaction request (typically about 48 hours later) and we delete all data associated with that store — in any case within 30 days. If a merchant or customer submits a data-erasure request, we action it within 30 days (see Section 7).

We do not sell personal data, and we do not share data with third parties for marketing purposes. We use the following sub-processors to operate the app:

• Fly.io — application hosting and database infrastructure
• Tigris — object storage for uploaded images and generated design files
• Shopify — e-commerce platform; merchant and order data originates here
• Unsplash — optional in-app stock-photo search; receives only the search terms entered, never personal data

The app does not send email, and we use no email or marketing sub-processor. Each provider processes only the data necessary for its function.

If you are in the EU/EEA (GDPR) you have the right to access, rectify, erase, port, object to, and restrict processing of your personal data. If you are a California resident (CCPA) you have the right to know what personal information we collect and to request its deletion; we do not sell personal data, so the opt-out of sale does not apply. To exercise any right, contact info@lubbelabs.com; we respond within 30 days. You may also lodge a complaint with your local supervisory authority.

Canvas Design Studio complies with Shopify’s mandatory GDPR webhooks:

• customers/data_request — we compile all personal data we hold related to the customer and provide it to the merchant.
• customers/redact — we permanently delete the customer’s designs, uploaded images, and stored personal data; order-level billing records are retained without any personal identifiers.
• shop/redact — when a merchant uninstalls, we delete all data associated with their store.

We use no marketing cookies and do not engage in cross-site tracking or behavioural advertising. We use a strictly-necessary session cookie solely to authenticate merchant sessions within the app’s admin interface.

We take reasonable technical and organisational measures to protect personal data, including encrypted transmission (HTTPS), access controls, and reputable infrastructure providers (see Section 5). No method of transmission over the internet is completely secure; if you have concerns, contact info@lubbelabs.com.

We may update this policy from time to time. When we do, we will update the “Last updated” date above, and for significant changes we will make reasonable efforts to notify affected merchants.

Craig Lubbe t/a Lubbe Labs
Email: info@lubbelabs.com

This policy applies specifically to the Canvas Design Studio app. Lubbe Labs operates other apps which have their own separate privacy policies.