Privacy Policy
Last updated: June 3, 2026
MadeReady is a Shopify app that helps creatives sell pieces with professional framing, matting, and customization options. This policy explains how we collect, use, and protect data when merchants install and use MadeReady.
Data We Collect
From Merchants (Shopify Store Owners):
- Shopify store domain and access token (via OAuth)
- Lumaprints fulfillment API credentials (entered by merchant)
- Piece images uploaded for print customization
- App configuration preferences (branding, COA settings)
From Customers (Shopify Store Visitors):
- Name, email, and shipping address — only when an order is placed, provided by Shopify via webhook
- No data is collected from browsing or using the print customizer
How We Use Data
- Order fulfillment: Customer name and shipping address are sent to Lumaprints to produce and ship print orders.
- COA delivery: Customer email is used to send a one-time Certificate of Authenticity email upon shipment.
- App functionality: Merchant credentials and configuration are used to operate the app's features.
We do not sell, rent, or share personal data with third parties for marketing. Data is only shared with service providers as described in this policy for the sole purpose of operating MadeReady.
Data Storage and Security
- All data is stored on secure, encrypted cloud infrastructure
- Data is encrypted at rest and in transit
- All Shopify webhook signatures are cryptographically verified
- Session tokens expire automatically
- Access is scoped per-merchant — merchants can only access their own data
Data Retention
- Merchant data is retained while the app is installed
- Upon uninstall, access tokens are immediately revoked and sessions deleted
- All merchant data (orders, pieces, configuration) is permanently deleted within 48 hours of receiving Shopify's shop/redact webhook
- Error logs are automatically purged after 30 days
GDPR Rights
We support the following rights for individuals in the EU/EEA:
- Right to access: Request a copy of your data
- Right to erasure: Request deletion of your data
- Right to rectification: Request correction of inaccurate data
- Right to portability: Request your data in a machine-readable format
To exercise these rights, contact us at the address below. We respond to all requests within 30 days.
CCPA Disclosure
For California residents: We do not sell personal information. We collect personal information solely for order fulfillment as described above. You have the right to know what data we collect, request deletion, and opt out of any future sale (though we do not sell data).
Third-Party Services
- Shopify: E-commerce platform (provides order data via webhooks)
- Lumaprints: Print fulfillment partner (receives shipping details for production). Support inquiries may be forwarded to Lumaprints on your behalf, including your store name and question details.
- Anthropic: AI service provider (powers the Vinci support assistant)
- Resend: Transactional email service (sends COA delivery emails)
- Cloudflare: Infrastructure provider (hosting, database, storage)
AI Support Assistant (Vinci)
MadeReady includes an AI-powered support assistant called Vinci, available in the merchant dashboard. When personalized answers are enabled (the default), Vinci accesses information about your account to provide specific, relevant support:
- Store name, plan tier, and configuration status
- Number of active pieces and total orders
- Recent failed orders and error messages
- Setup and integration status
- Your own order details and customer information when you ask about a specific order or customer - by default the customer's name and what they ordered; their email or shipping address only when you specifically ask for it
- Product catalog and pricing data from Lumaprints (queried in real time during chat)
This data is processed by Anthropic subject to their commercial terms, which prohibit training on your data. It is used solely during your chat session to generate support answers — never for advertising, profiling, or any other purpose.
You are in control. You can disable personalized answers at any time from the Vinci chat widget or from the Settings page in your dashboard. When disabled, Vinci provides only generic answers with no access to your account data.
Shopify access tokens and API credentials are never shared with AI services. End-customer personal information from your orders (such as a customer's name, and - only when you specifically ask for it - their email or shipping address) is shared with Anthropic solely to answer the support question you asked, under the same commercial terms above (no training, no advertising). Vinci only ever accesses your own store's data, never another merchant's. You can disable this entirely by turning off personalized answers.
AI-Assisted Diagnostics
When diagnosing technical issues with your store's integration, we may use AI-assisted tools to review order status, error logs, and configuration data. This data is processed by Anthropic subject to their commercial terms, which prohibit training on your data.
Shopify access tokens, API credentials, and end-customer personal information (emails, addresses, phone numbers) are never shared with AI services during diagnostics.
Changes to This Policy
We may update this policy from time to time. Changes will be posted at this URL. Continued use of MadeReady after changes constitutes acceptance.