Privacy Policy

REACH.GR ("we", "us") is committed to protecting your privacy and the privacy of your customers. This Privacy Policy explains how we collect, use, and store data when you install the Imprint Shopify App, and when you visit our website, imprintfiles.com (see Section 7).

1. Information We Collect

We collect information from two sources: the Merchant (you) and your End-Customers.

1.1. From the Merchant (You)

When you install the App, we collect the following via the Shopify API:

• Store Information: Shop URL, shop name, the store owner's name and email, and country/currency settings.
• App Usage Data: Plan selection, feature usage, and installation date.
• Files Uploaded for Leak Tracing: If you use leak tracing, the copies of your files that you upload so we can identify the order they came from. These files are stored only temporarily (see Section 5).
• Cookies & Session Data: We use session cookies to maintain your login session within the App dashboard.

1.2. From Your End-Customers

To provide the watermarking and delivery service, we process the following data when an order is placed, or when a visitor asks the Merchant for a free sample:

• Personal Information: Customer Name, Surname, Email Address.
• Order Details: Shopify Order ID, Order Number, Purchase Date, Product SKUs, the customer's language, and the order record Shopify sends us, which includes the billing and shipping details (such as the company name) and any product or cart fields the customer filled in at checkout.
• Download Records: For every download, the time, the country it was made from, the device and browser (User-Agent), and a one-way hash of the IP address, used for download logs, leak tracing, and fraud prevention. The IP address itself is not stored in these records. Each download is also given a unique copy code, and each order a licence code.
• Free Sample Sign-ups: If the Merchant offers free samples, the email address a visitor enters to get one, whether they agreed to the Merchant's marketing emails, the consent text they were shown, when they agreed and when they first downloaded the sample, their language, and a one-way hash of their IP address. Sample downloads are recorded like other downloads, and the visitor's email is stamped on the sample.

Note on Watermarking: The customer details the Merchant chooses (by default the customer's Email; optionally their name, order number, company, or fields they entered at checkout) are stamped visibly onto the PDF files they download. Downloaded files may also carry their copy code and licence code, in the visible stamp, in hidden tracing marks inside the file, or in a small visible QR code. This is a core function of the Service.

2. How We Use Your Information

We use the collected data to:

1. Provide the Service: Generate unique download links and stamp PDFs with customer data.
2. Leak Tracing: At the Merchant's request, analyze files the Merchant uploads to identify the order and download that a leaked copy came from.
3. Free Samples: At the Merchant's request, email a sample download link to visitors who sign up for one, and add them to the Merchant's Shopify customers with the Merchant's tags. If a visitor agreed to the Merchant's marketing emails, we record that in the Merchant's Shopify store when they first download the sample. We never send marketing emails to them ourselves.
4. Billing: Process subscription payments via Shopify.
5. Communication: Send transactional emails (download links) to your customers on your behalf.
6. Product Updates: Send you occasional emails about new features and changes to the App, at the store owner email Shopify gives us. Every email has an unsubscribe link, and you can ask us to stop at any time.
7. Security & Abuse Prevention: Detect excessive download attempts, scan file metadata for prohibited content (as defined in our Terms of Service), and prevent fraud.
8. Legal Compliance: Comply with applicable laws, regulations, and legal requests.

3. Data Security & Encryption

We take the security of your data seriously. We employ industry-standard security measures to protect Personally Identifiable Information (PII):

• Encryption in Transit: All data transferred between your customers, Shopify, and our servers is encrypted using TLS 1.2+ (Transport Layer Security).
• Encryption at Rest: Sensitive customer information stored in our database (specifically Name, Surname, and Email Address) is encrypted using AES-256 encryption. This ensures that even in the unlikely event of a database breach, the raw personal data remains unreadable.

4. Sharing Your Information

We do not sell your data. We only share data in the following circumstances:

4.1. Service Providers (Subprocessors)

We authorize these third parties to process data on our behalf to provide the Service:

4.2. Legal Requirements

We may disclose your information or your customers' information if we are required to do so by law, or if we believe in good faith that such action is necessary to:

• Comply with a legal obligation, court order, or government request (including Greek and EU authorities).
• Protect and defend the rights or property of REACH.GR.
• Prevent or investigate possible wrongdoing in connection with the Service (e.g., piracy, distribution of illegal content).

5. Data Retention and Deletion

We adhere to a strict data minimization policy:

• Active Stores: Data is retained as long as the App is installed to ensure service continuity.
• Uninstalled or Terminated Stores: If you uninstall the App, or if your account is terminated for violating our Terms of Service, your data is queued for deletion. 48 hours after uninstallation/termination, all data is permanently wiped from our databases and storage buckets.
• Download Records: The hashed IP address, country, and device details of each download are deleted after 24 months. The copy code and its link to the order are kept, so that a leaked file can still be traced. When Shopify asks us to erase a customer's data, these details are removed from the download records of that customer's orders.
• Leak Tracing Uploads: Files uploaded for leak tracing are deleted as soon as they have been analyzed, and are never kept for more than 24 hours. We keep only the result: the file's name, size, and page count, the tracing codes found, and the order and download they matched. Takedown notices drafted in the App are not stored.
• Free Sample Sign-ups: The hashed IP address is deleted after 24 months. A sign-up is deleted when Shopify asks us to erase that customer's data, when the Merchant deletes the product, and with the rest of the store's data after uninstallation. Customers already added to the Merchant's Shopify store stay there under the Merchant's control.

6. GDPR Compliance (Europe)

Since we are located in Greece (EU), we are fully compliant with the General Data Protection Regulation (GDPR).

• Data Controller: You (the Merchant) are the Controller of your customers' data, including the data of visitors who sign up for your free samples. You choose the consent text they see and decide what to send them.
• Data Processor: REACH.GR acts as the Processor.
• Your Rights: You have the right to request access to, correction of, or deletion of your data. You may export your data or request deletion by contacting us or uninstalling the App.

7. Our Website

When you visit imprintfiles.com, we measure how the website is used with two tools: our own analytics, which runs on our server at marketing.reach.gr, and Google Analytics, provided by Google.

• Your Choice: If you visit from the European Economic Area, the United Kingdom, or Switzerland, we ask first. Until you click Accept in the banner, neither tool stores anything on your device and our own analytics does not run. Google Analytics only receives a signal for each page you view, without cookies or any identifier, which Google uses to estimate the number of visits. Elsewhere, both tools run when you arrive. Wherever you are, you can change your choice at any time with the Cookie settings link at the bottom of our pages, or here: Cookie settings.
• What We Collect: The pages you view, how long you stay and how far you scroll, the page that sent you to us and any campaign or ad tags in the link, your device type, browser, operating system, screen size, language, and time zone.
• Location: Your country, region, and city, worked out from your IP address. Our own analytics also stores approximate coordinates (to about 1 km). Neither tool stores the IP address itself.
• Cookies and Browser Storage: Our own analytics keeps a random identifier in your browser's local storage and session storage, so that the pages you view in one visit are counted together. Google Analytics sets the cookies _ga and _ga_G08YLK5YT4, which keep a random identifier for up to 2 years so it can recognize you when you come back. Your choice in the banner is saved in local storage so we don't ask again.
• Links in Our Emails: If you open the website from a link in an email we sent you, such as a product update, your visit is linked to your email address in our mailing list.
• Google: Google processes the Google Analytics data for us under its data processing terms, and we have turned off the settings that would let Google use it for its own purposes. If you accept, it may also be used to measure our ads on Google and to show our ads to people who have visited the website. Google may process this data outside the EU, including in the United States, under the EU-US Data Privacy Framework and standard contractual clauses.
• Purpose: We use this data only to understand how people find and use the website, to improve it, and to see which of our emails and ads bring people to it.
• Retention: Our own analytics keeps visit data for 1 year, and Google Analytics keeps it for 14 months. It is then deleted.

For this data, REACH.GR is the Controller. You can ask us for a copy of it or ask us to delete it using the contact details in Section 9.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will notify you of any material changes via the App dashboard or email.

9. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

REACH.GR
Privacy Officer
85300 Kos, Greece
Email: [email protected]