Policy
Privacy policy
Last updated 30 October 2026
Toolbox POD (“the app”) is a print-on-demand service operated by Toolbox Brands LLC. Merchants connect their Shopify store, upload artwork and publish products; we print and ship each order directly to their shopper. People can also order shirts for themselves on our website, with or without an account. This policy explains what we hold, why, who else sees it and for how long.
Who is responsible for what
If you are a merchant, we are the controller of your account data and a processor acting on your instructions for your shoppers’ data.
If you are a shopper who bought a shirt, your contract is with the merchant whose store you bought from. They decide what happens to your data; we are the fulfillment provider who prints and ships your parcel. Please contact the merchant first — and see “Your rights” below for what happens when they pass a request to us.
If you order shirts for yourself on our website, with or without an account, we are the controller of your order data.
What we collect
From merchants, and anyone else with a Toolbox POD account:
| Data | Why we hold it |
|---|---|
| Account name, your email address, and the staff you invite (email, role, which stores they may work in) | Signing in, access control, receipts and account notices |
| Your Shopify store domain and the Admin API access token Shopify issues | Reading the orders and writing the products and fulfillments the app needs |
| A saved payment method | Charging you per order. We never see or store a full card number — the card is saved with our payment processor and we hold only its identifier for the card plus the brand, last four digits and expiration date |
| Artwork files you upload, and the designs and products you build from them | Producing your garments |
| Your orders, quotes, payments, shipments and support conversations | Fulfillment, reprints, claims and accounting |
| Connections you create to API clients and AI clients (which client and what it may spend) | Letting a client act on your account as you, and letting an Owner cut it off |
From people who order on our website without an account:
- your email address, for your receipt, order updates and the private link to your order’s status page;
- the name and shipping address you give us, to ship your order;
- your order, and the brand and last four digits of the card you paid with, for your receipt. The card is entered directly into our payment processor's form, used for that one payment and not saved;
- a one-way hash of your IP address, kept only to review abuse. Your IP address and email address are also used for about an hour to limit repeated attempts.
If you later create an account with the same email address, once it is verified, those orders are added to your account.
From your shoppers, read through the Shopify Admin API when a Shopify order matches a product you mapped to one of your designs:
- the shipping recipient’s name and company;
- the shipping address (street lines, city, province or state, postal code, country);
- the shipping phone number;
- the order’s line items, quantities and SKUs, and the product data needed to produce them.
We use these only as the carrier’s delivery details for that parcel. We do not collect the shopper’s email address — since 15 October 2026 our Shopify order query no longer asks for it. An order imported before then may still hold the order email Shopify returned at the time, in the copy of the import kept while the order waits for confirmation; that copy is deleted when the order is confirmed or anonymized.
Since 15 October 2026 a Shopify order webhook is stored as the order’s ids only; the app reads the order itself from Shopify. Order webhook payloads stored before then contain the customer fields Shopify sent and are emptied on the schedule in “How long we keep it”.
If you sell through Whop. When your Whop business installs Toolbox POD, Whop sends us your business’s name and id, which of your admins may open the app, the ids of the products we create for you, and, for each order of our shirts, the order’s items, amounts and your buyer’s name and shipping address. We use them only to print and ship your orders and to show you their status. If you uninstall the app, we stop taking orders at once, ship the paid orders already in production, and within 30 days of the uninstall delete your buyers’ names and addresses, the copies of Whop’s messages and your admins’ access records. We keep order ids, amounts, quotes and payment records, without personal details, as our accounting records. If you buy an AI-image plan in the Whop app, Whop processes that payment.
If you sell through WooCommerce. When you connect a WooCommerce store, WooCommerce gives us an API key for your store, and your store sends us its orders and product changes. We use the orders that contain our products, including your buyer’s name, shipping address, and email and phone if given, only to print and ship them, to add tracking to them and to show you their status. We delete the content of the other orders your store sends us within a few days. If you disconnect the store or delete our plugin, we stop taking orders at once, ship the paid orders already in production, and within 30 days delete your buyers’ names and addresses and the copies of what your store sent us. We keep order ids, amounts, quotes and payment records, without personal details, as our accounting records.
We keep standard server and request logs. We do not use advertising trackers or marketing cookies.
Our public website, toolboxpod.com, and the signed-in web app at toolboxpod.com/app use Google Analytics to count visits and see which pages are used. On the order page it also records which shirts you look at and add to your cart (the garment, color, size, print position, price and quantity) and when you start a checkout. Page addresses from the web app are sent without order numbers, account numbers or other identifiers. The app inside the Shopify admin does not load Google Analytics. For visitors in the EEA, the UK and Switzerland, Google Analytics sets no cookies by default; it still receives a basic, cookieless record of the page visit. Google signals and Google’s advertising features are turned off, and we do not sell or share this data. Google explains how Google uses information from sites or apps that use its services.
Our servers also send Google Analytics a record of account and order events for every account and every order, including merchants who use only the app inside the Shopify admin and people who order without an account: signing up, signing in on the website, starting a checkout, a purchase, a refund, installing or uninstalling the Shopify app, and publishing a product. Each record carries a pseudonymous identifier derived from your account (never your email address), our internal order and design IDs, amounts in US dollars, and the garments ordered (type, color, size and quantity). It never includes a name, an email address, a postal address, a phone number, a store domain or card details. When the event starts in your browser on the website (for example signing up, signing in or paying at checkout) and your browser has a Google Analytics cookie, the record is linked to that browser’s visit.
Address suggestions at checkout use Google Maps features: as you type a shipping address on our website, your browser sends what you type to Google to suggest complete addresses. Your use of address suggestions is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.
Why we use it
- To produce and ship the physical orders you send us, through our print warehouse.
- To bill you for those orders and any AI image plan billed on our website, and to send your receipts. For a plan billed through Shopify, to read the plan’s status from Shopify and add its images to your account.
- To answer support requests and handle reprints, claims and refunds.
- To keep your account and your staff’s access secure.
- To meet our legal, tax and accounting obligations.
We do not sell personal data, and we do not use shopper data for our own marketing.
Who else receives it
We use the sub-processors below, named by category except for Google. Each receives only what it needs to do its job.
| Provider | What it receives |
|---|---|
| Our print and shipping warehouse (an affiliated company) | The recipient name, address and phone for each order, and your print files |
| AI image generation providers | The prompts, instructions and images you provide for AI designs and mockups, to create the artwork and pictures you ask for |
| Payment processing | Your card details, entered directly into our payment processor's form in your browser, and the charges we make |
| Sign-in and account security | Authentication for the Toolbox POD website (email address and session) |
| Email delivery | Delivery of transactional email — receipts, invitations and account notices |
| Customer support chat | Support conversations |
| Hosting, networking and security | The application, its database and its file storage, and the network in front of it (DNS, TLS, content delivery and protection against attacks) |
| Google Analytics (Google LLC) | Analytics for the public website toolboxpod.com and the web app toolboxpod.com/app (the pages viewed, the referring page, browser and device type, and approximate location), and pseudonymous account and order events from our servers for all accounts and orders, with no names, email addresses or postal addresses |
| Google Maps Platform (Google LLC) | Address suggestions at checkout: the address you type into a shipping address form on our website, sent from your browser, to suggest complete addresses as you type |
Business customers can ask for the current named list of our sub-processors at support@toolboxpod.com. If you connect a Shopify store, the products, fulfillments and tracking we write to it go to Shopify at your instruction.
We also disclose data where we are legally required to. The application, its database and its file storage are hosted in the United States. Where personal data is transferred out of the UK, the EEA or another region with transfer restrictions, it is done under Standard Contractual Clauses (EU SCCs and UK IDTA/Addendum) for transfers of EU/UK personal data to the United States.
How long we keep it
These are the retention periods in force today. If we change one, we update this page.
| Data | Period |
|---|---|
| Raw Shopify order webhook payloads | 30 days, then emptied. The order’s ids are kept |
| Shopper personal data on an order (name, street address, phone) | 90 days after the order is completed or canceled. Only the state or province and a postal-code prefix are kept, for sales-tax and accounting records |
| Artwork you uploaded | Kept until you ask us to remove it |
| Orders, quotes, money records and print files | Kept for as long as we are legally required to keep our accounting records, and for reprints and claims |
| The email address you ordered with, if you ordered without an account | Kept with those orders, for receipts, support and our accounting records |
| Shopify access tokens | Deleted immediately when the app is uninstalled, or when Shopify sends a shop/redact request |
| API request logs | 30 days |
| Backups of the database and stored files | Made every night and every week, and used only to restore the service after a failure. Copies on our own equipment, not separately encrypted: the 14 most recent nightly copies and the 2 most recent weekly copies, normally about two weeks. An encrypted offsite copy keeps daily, weekly and monthly restore points, normally reaching back about 6 months. These schedules keep a set number of copies rather than deleting by date, so if a backup or clean-up run fails, an older copy can be kept longer than this. We do not edit backups when we anonymize or delete data, so that data can remain in a backup until that backup is replaced on this schedule |
An order is never anonymized while it is still open: we cannot ship a parcel to an erased address. It is anonymized automatically once it closes, and an open support request, claim or refund also holds it.
Shopify compliance requests
Shopify requires every app to answer three mandatory privacy webhooks. Ours act on them rather than merely recording them:
| Request | What we do |
|---|---|
| customers/data_request | We assemble everything we hold about that shopper on that shop's orders — the recipient's name and company, street address, city, state or province, postal code, country and phone, an email address where an order imported before 15 October 2026 still holds one, and the line items — and show it on the request, where the store's Owner and Managers read it in the app. It is read from the orders each time the request is opened rather than copied onto it, so once the shopper's details are anonymized the request shows only what we keep. Nothing is emailed to the shopper — the merchant answers their own customer |
| customers/redact | We anonymize the shopper's name, street address and phone on the matching orders and on the production request we prepared for each, keeping only the state or province and a postal-code prefix for accounting; we delete any copy of the Shopify import an older order still holds; we empty the raw webhook payloads for those orders; we ask our production partner to anonymize its copy of each of those orders that was sent to it; and we keep the order, its line items, price, payment and shipment records, because we are required to keep our accounting records. We keep no separate copy of the details we anonymize. This does not edit what you or your staff wrote in support requests or support chat, emails already sent, or our database backups, and the carrier that delivered a parcel keeps the delivery details it was given under its own terms. An order that is still open, or held by an open support request, claim or refund, keeps its details until that clears and is then anonymized automatically; the request stays open until every matching order is done, including our production partner's copy of any order sent to it |
| shop/redact | We wipe the stored Shopify access token, mark the shop for redaction, and apply the same erasure across that shop's orders |
Your rights
Depending on where you live you may have the right to ask for a copy of your data, to correct it, to have it erased, to restrict or object to our use of it, to data portability, and to complain to a data protection authority. Under the CCPA you may also ask what categories we have collected and disclosed. We do not sell or share personal information, and we will never discriminate against you for exercising a right.
- Shoppers — ask the merchant you bought from. When they pass the request to Shopify, Shopify sends it to us and we act on it as described above.
- Merchants — a request that arrives from Shopify for one of your stores is answered inside the app, on that store’s Data requests page. For anything else, email us at support@toolboxpod.com.
- People who ordered for themselves on our website — email us at the address in “Changes and contact” below.
We respond within 30 days.
Security
- All traffic is over TLS. The application sits behind our network provider’s secure tunnel; the database and file storage are on a private host that is not exposed to the public internet.
- Shopify access tokens and outgoing webhook signing secrets are encrypted at rest with AES-256-GCM, using a key held outside the database.
- Other data — including shopper recipient details and uploaded artwork — is not encrypted by the application itself; it is protected by the host, the network boundary and access controls.
- Access inside a merchant account is role-scoped (Owner, Manager, Viewer) and scoped to individual stores.
- If we confirm a breach affecting your data, we notify affected merchants and Shopify. We maintain a written incident-response procedure covering containment, credential revocation, log preservation, notification and review; to report a suspected security issue, email support@toolboxpod.com.
No system is perfectly secure, and we cannot guarantee absolute security.
AI and API client connections
If you connect an API client or an AI app (for example ChatGPT or Claude) to your Toolbox POD account, that connection acts as you and can do only what your own role allows and the permissions you approved when you connected it. You choose what it may spend.
Depending on those permissions, the connected app’s tools can return:
- your account and store details, your role, and whether the account is ready to order;
- the product catalog and our prices, and your products with their retail prices;
- your uploaded artwork, designs and mockup pictures;
- your orders, including each recipient’s name, shipping address, and phone number or email address where the order holds one, the order totals and tracking;
- your receipts and a billing summary of charges and refunds (never card details);
- your support requests.
Anything the app reads leaves our systems for that app’s provider, under that provider’s own privacy policy.
For each tool call we log only the tool’s name, the outcome and how long it took, with the connection and account it came from. We never log the arguments the app sent or the results we returned.
The app signs in with OAuth. An access token lasts 1 hour; a refresh token lasts 30 days and is replaced each time it is used. We store tokens only as one-way hashes, and delete a token’s record about a day after it expires. The connection record (which app, who connected it, what it may do and spend, and when it was disconnected) stays with your account.
You can disconnect a connection at any time in Toolbox POD, under Connections; an Owner can disconnect any connection in the account. Disconnecting revokes its tokens at once, so its next request is refused, and ends its spending limits.
Children
Toolbox POD is for businesses and for adults ordering shirts for themselves. We do not knowingly collect data from children.
Changes and contact
We update this page when our practices change, and change the “Last updated” date. Material changes are notified to merchants by email. Questions, or to exercise a right: support@toolboxpod.com, Toolbox Brands LLC, 426 E 1750 N Unit C, Vineyard, UT 84059, USA.
See also our terms of service and our data processing addendum.