Privacy policy

This is the English language version. In case of discrepancies between language versions, the version more favourable to the Consumer applies (§ 24(1) of the Terms of Service).

Privacy Policy – CollectMerch
Version 1.0 · effective from 29 October 2026

In this Policy we explain what personal data we process when you use the website and shop collectmerch.com (the “Service”), for what purposes, on what legal basis, to whom we disclose it, how long we keep it and what rights you have. This Policy fulfils the information obligations under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”). Capitalised terms have the meanings given to them in the Terms of Service.

1. Data controller

The controller of your personal data is Snapwear sp. z o.o. with its registered office in Łódź, ul. Dostawcza 3, 93-231 Łódź, Poland, KRS (National Court Register number) 0000513284, NIP (tax identification number) 7792422363, REGON (statistical identification number) 302754840 (“we”, the “Controller”).

In matters concerning personal data, you can contact us by email at support@snapwear.pro (subject: “Personal data”) or in writing at our registered office address.

2. Key information at a glance

• We process the data needed to fulfil orders, maintain your account and operate the features of the Service (the Designer, Group Orders, Organisation Shops, AI tools).
• The AI tools (the AI Assistant and the AI Generator) use Google Gemini models – the content you enter or upload in them is sent to Google in order to generate a response.
• Products are manufactured in Poland (orders for the EU and the United Kingdom), and orders for the USA are manufactured by our production partner in the USA; the production facilities receive the data necessary for production and shipping.
• We do not sell your data. We do not take decisions about you based solely on automated processing which would produce legal effects concerning you or similarly significantly affect you.
• You can exercise your rights at any time – see Section 11.

3. Where we get your data from

• Directly from you – when you create an account, place an order, create a Design, a Group Order or an Organisation Shop, sign up for a Group Order, use the AI tools or contact us.
• From other people – your data may have been provided by:
  • the person organising a Group Order or an Organisation Shop (e.g. the first name and surname, class or size of a Participant or of the recipient of a consolidated parcel);
  • a person purchasing in an Organisation Shop who indicates you as the recipient;
  • our Sales Representative – if you are our business customer or a contact person of a customer (the data comes from correspondence, business cards and publicly available registers, e.g. CEIDG (the Polish register of sole traders), KRS, VIES);
  • Google – when you log in with a Google account (first name, surname, email address).
• Automatically – technical data from your device and browser (e.g. IP address, browser identifiers, cookies and data in browser storage).

4. Purposes, legal bases and retention periods

4.1. Orders and sales contracts

Data: first name and surname, email address, telephone number, delivery and billing address, company details and NIP (if you buy as a business), order contents, Designs and print files, payment information (status, method – without full card data), communication history.
Purposes and legal bases: conclusion and performance of the contract, including production and delivery (Article 6(1)(b) GDPR); issuing invoices and keeping accounting records (Article 6(1)(c) GDPR in conjunction with tax legislation and the Accounting Act (ustawa o rachunkowości)); handling complaints and withdrawals (Article 6(1)(b) and (c) GDPR); establishment, exercise and defence of legal claims (Article 6(1)(f) GDPR).
Period: for the duration of the contract and thereafter until the limitation periods for claims expire; accounting documents – for 5 years from the end of the calendar year in which the tax payment deadline expired.

4.2. Account and saved Designs

Data: email address, first name and surname, address, order history, saved Designs and graphic files, links to your Group Orders and Organisation Shops.
Legal basis: the contract for the provision of the Account service (Article 6(1)(b) GDPR).
Period: until the Account is deleted; Designs – until you delete them or the Account is deleted. Order data – in accordance with Section 4.1.

4.3. Designer and order files

Graphic files and texts that you add in the Designer are stored and transferred to production together with the order. Files attached to orders may be stored at an unpublished, hard-to-guess URL, accessible to anyone who knows that address (including the production facility). Do not include in Designs any data that is not meant to appear on the product.
Legal basis: Article 6(1)(b) GDPR. Period: as in Section 4.1; draft designs that have not been ordered – on the server, up to 12 months from the last modification; in browser storage – 3 days.

4.4. AI Assistant (chat)

Data: the content of your messages (the most recent messages of the conversation), language, a random browser identifier, a hash of your IP address for the purpose of usage limits.
Purpose and legal basis: providing answers and preparing proposals at your request (Article 6(1)(b) GDPR); protection against abuse (Article 6(1)(f) GDPR).
How it works: messages are sent to the Google Gemini model in order to generate a response. We do not store the content of conversations on our servers – the conversation history is stored only in your browser for 24 hours. Do not enter sensitive data, other people’s data or payment details into the chat.

4.5. AI Generator

Data: the description (prompt), the selected style, the graphic you upload (when using the enhancement feature), the generated graphics, the number of generations and the status of packs, a customer identifier in hashed form, a hash of your IP address.
Purposes and legal bases: providing the service and accounting for packs (Article 6(1)(b) GDPR); content moderation, prevention of abuse and of system overload (Article 6(1)(f) GDPR).
How it works: the prompt and – when enhancing quality – the uploaded image are sent to the Google Gemini model, which returns a graphic. Graphic previews are stored at an unpublished URL; originals and final versions are stored in private storage accessible only to you via time-limited links.
Period: up to 12 months from generation; graphics used in an order – as in Section 4.1.

4.6. Group Order (Collective Basket)

Organiser: name of the Group Order, school/team, Designs, deadline, settlement methods and payment details (e.g. a telephone number for BLIK or a bank account number – visible to anyone who knows the Group Order link).
Participant: first name and surname (or another identifier), size, number of items, personalised inscription, comments, selected settlement method, payment status; for a Design proposal – the first name shown next to the Design; for voting – a random browser identifier (in hashed form).
Who can see the data: the full list of Participants with sizes and payments is visible only to the Organiser (who may download it as a CSV file). The Group Order page, the Designs, the first names of the authors of proposals and the voting results are visible to anyone who knows the link.
Purposes and legal bases: providing the Group Order service to the Organiser and Participants (Article 6(1)(b) GDPR); with regard to Participants’ data provided by the Organiser – our legitimate interest in enabling a group order to be organised (Article 6(1)(f) GDPR); prevention of abuse (Article 6(1)(f) GDPR).
Period: up to 12 months from the end of the Group Order (expiry of the deadline or placement of the consolidated order), unless the Organiser deletes the data earlier; order data – as in Section 4.1.
Provision of payment details by the Organiser is voluntary (legal basis: Article 6(1)(b) GDPR) – please remember that they will be visible to anyone who knows the link. When proposing Designs, please provide only a first name or initials.
Roles: the Organiser is responsible for ensuring that Participants know that their data will be entered into the Service and for entering only necessary data. With regard to Participants’ data which the Organiser collects and whose purpose the Organiser determines (the sign-up list, settlements, the CSV file), the Organiser – or, where the Organiser acts on behalf of a school or other organisation, that organisation – is a separate controller. We are the controller of that data with regard to the provision of the Group Order service, moderation, security and the fulfilment of orders. We are not joint controllers within the meaning of Article 26 GDPR.

4.7. Organisation Shop

Organiser: first name and surname, contact email and telephone number (not visible to buyers), organisation details, consolidated delivery address, logo and graphics.
Buyer / recipient: order data (Section 4.1) and, for consolidated delivery, the recipient’s first name and surname and optionally class or department (visible to the Organiser and transferred to production for the purpose of distributing the parcel).
Legal bases: Article 6(1)(b) GDPR (contract with the Organiser and the buyer); Article 6(1)(f) GDPR (verification of Shops before publication, security).
Period: for as long as the Shop operates and for up to 12 months after its closure; order data – as in Section 4.1.

4.8. Business customers and the Sales Representative panel

Data: company details, NIP, details of contact persons (first name and surname, email, telephone number, address), notes, correspondence, files sent by the customer, offers and orders; the assigned Sales Representative.
Purposes and legal bases: preparing an offer and concluding a contract at the customer’s request (Article 6(1)(b) GDPR); maintaining the business relationship and the database of business partners, including contact with persons representing customers (Article 6(1)(f) GDPR); accounting obligations (Article 6(1)(c) GDPR).
AI in the Sales Representative panel: the content of email messages, attachments and lists of business partners may be processed by the Google Gemini model solely for the purpose of automatically extracting data for an offer or an invoice. Each result is verified by the Sales Representative before it is saved.
Period: for the duration of the cooperation and thereafter until the limitation periods for claims expire (as a rule 3 years for claims related to business activity) or until an effective objection is raised.
Access to customer data is granted to the assigned Sales Representative and to persons with director and administrator permissions.
We send commercial information by electronic means or by telephone to contact persons only after obtaining their consent (Article 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej)). Persons whose data we have obtained from sources other than themselves are informed of the processing at the time of first contact, and no later than within one month.

4.9. Contact and handling of enquiries

Data: the data provided in the message. Legal basis: Article 6(1)(f) GDPR (responding to an enquiry), Article 6(1)(b) GDPR (where the enquiry concerns a contract), Article 6(1)(c) GDPR (notices under the DSA, complaints). Period: up to 3 years from the closure of the matter.

4.10. Newsletter and marketing

Data: email address, information on message opens. Legal basis: your consent (Article 6(1)(a) GDPR) and consent to receiving commercial information by electronic means (Article 398 of the Electronic Communications Law). Period: until consent is withdrawn. You can withdraw your consent at any time using the link in the message.

4.11. Service security and abuse prevention

Data: IP address (stored mainly in the form of a cryptographic hash), browser identifiers, operation counters, solutions to security challenges, the reCAPTCHA verification result, error logs.
Purpose and legal basis: protecting the Service and its users against spam, bots, abuse and attacks, enforcing limits, content moderation (filters of offensive and hateful words) – legitimate interest (Article 6(1)(f) GDPR).
Period: data for limits and security measures – up to 30 days; system logs – in accordance with the provider’s retention period, no longer than 90 days.

4.12. Statistics and analytics

If you give your consent in the cookie banner, we may use the analytics and marketing tools of the Shopify platform to measure traffic and the effectiveness of our activities (Article 6(1)(a) GDPR). Without your consent, we use only technologies necessary for the operation of the Service.

5. Artificial intelligence – additional information

• Model provider: Google (Gemini API). Google processes the content submitted on our behalf as a processor, under Google’s data processing terms, in order to generate responses and – for a limited period – to detect abuse. We use the paid version of the service, in which Google does not use the submitted content to train its models.
• No automated decisions within the meaning of Article 22 GDPR. Automated content filters and limits may reject an instruction or block content; this does not produce legal effects concerning you, and you may appeal against a moderation decision (§ 15 of the Terms of Service).
• Transparency: we indicate in the Service when you are talking to an AI and which graphics have been generated by AI.
• Recommendation: do not upload photographs of people, special categories of data (e.g. health data) or third-party data to the AI tools.

6. Children and minors

The Service is not directed at children. An Account may be created by persons aged 16 or over. Younger persons may sign up for a Group Order or purchase in an Organisation Shop with the knowledge and consent of their parents or guardians. Group Orders and Organisation Shops may relate to schools – in such a case, the Organiser (e.g. a teacher or parent) may enter pupils’ data to a minimal extent (e.g. first name and surname, class, size). We require this to take place with the knowledge of parents or guardians. If you are a parent or guardian and wish to have a child’s data deleted, write to us – we will delete it without undue delay, except for data necessary to fulfil an order that has already been paid for.

7. Recipients of data

We disclose data only to the extent necessary, to the following categories of recipients:

• Shopify (Shopify International Limited, Ireland, and group companies) – the shop platform, customer accounts, the checkout process, Shopify Payments, sending email notifications;
• Supabase (Supabase Inc.) – the database, file storage and server functions of the Service; data is stored in a data centre in the European Union (Ireland);
• Google (Google Ireland Limited / Google LLC) – Gemini AI models, reCAPTCHA (bot protection), Google account login, Google Fonts web fonts;
• production partners – the production facility in Poland (orders for delivery to the EU and the United Kingdom) and the production partner in the USA (orders for delivery to the USA): shipment recipient details, Designs and print files and, for consolidated delivery, the recipient’s first name, surname and class/department;
• carriers and postal operators – data necessary for delivery;
• payment service providers (e.g. Shopify Payments, Przelewy24, PayPal, card operators and BLIK) – data necessary to process payments; some of them (e.g. PayPal) act as separate controllers;
• IFIRMA SA – accounting and invoicing system; National Revenue Administration (Krajowa Administracja Skarbowa; KSeF – National e-Invoicing System, Krajowy System e-Faktur) – with regard to invoices;
• accounting firm, legal advisers, IT companies providing services to us;
• the Organiser of a Group Order or an Organisation Shop – with regard to the data of Participants and recipients described in Sections 4.6–4.7;
• public authorities – where required by law.

Entities processing data on our behalf act on the basis of data processing agreements and in accordance with our instructions.

8. Transfers of data outside the European Economic Area

Certain recipients (e.g. Shopify, Google, Supabase and their subcontractors) may process data in third countries, in particular in the USA and Canada. In such cases, the transfer takes place on the basis of a European Commission decision finding an adequate level of protection (including for Canada and for entities certified under the EU-U.S. Data Privacy Framework) or of standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). The transfer of data to the production partner in the USA (in the case of orders for delivery to the USA) takes place on the basis of standard contractual clauses (Article 46(2)(c) GDPR). You can obtain a copy of the safeguards by contacting us.

9. Cookies and similar technologies

The Service uses cookies and browser storage (localStorage, sessionStorage, IndexedDB). We use technologies that are necessary for the operation of the Service or for providing a service you have explicitly requested without consent (Article 399 of the Electronic Communications Law); we use analytics and marketing technologies only after you have given consent in the banner, which you can change at any time.

Category	Examples	Purpose	Period
Necessary – shop	Shopify cookies (basket, session, checkout process, login, consents)	operation of the shop, basket and account	from session to 1 year
Necessary – Service features	data in browser storage: draft design and saved designs, your Group Orders and Shops, organiser links, sign-up tokens, identifier for voting and AI limits, recipient details in an Organisation Shop, draft of a Sales Representative’s offer	remembering your actions on this device	until you delete it or it expires (e.g. draft designs – 3 days)
Necessary – AI chat	chat history and the AI Assistant’s plan	continuing the conversation	24 hours
Security	computational security challenge, AI session tokens; Google reCAPTCHA – triggered only for features requiring additional verification (AI Generator, suspicious activity). With regard to reCAPTCHA, Google acts as a separate controller (Google Privacy Policy)	protection against bots and abuse	session / in accordance with Google’s policy
Analytics and marketing	Shopify tools and, where applicable, advertising partners’ tools	statistics, personalisation of offers	only with consent, up to 2 years

You can delete cookies and site data in your browser settings; however, this may result in the loss of draft designs and of access to Group Orders via links saved on the device.

10. Do you have to provide data?

Providing data is voluntary, but necessary to conclude and perform a contract (e.g. the delivery address), to create an Account or to use a given feature. Providing invoicing data is mandatory if you wish to receive an invoice. Consent to the newsletter and to analytics cookies is voluntary.

11. Your rights

Right to object (Article 21 GDPR). You may at any time object, on grounds relating to your particular situation, to the processing of your data based on our legitimate interest (Sections 4.4–4.9 and 4.11), and you may object to processing for direct marketing purposes at any time and without giving reasons.

In addition, you have the right to:

• access your data and obtain a copy of it (Article 15 GDPR);
• rectification of your data (Article 16 GDPR);
• erasure of your data (Article 17 GDPR);
• restriction of processing (Article 18 GDPR);
• portability of data processed on the basis of a contract or consent (Article 20 GDPR);
• withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodge a complaint with a supervisory authority – in Poland with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO – the Polish data protection authority) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in the country of your habitual residence or place of work.

To exercise your rights, write to support@snapwear.pro. We respond without undue delay, within one month (in justified cases this period may be extended by a further two months). We may ask for information enabling us to confirm your identity, e.g. the email address used for the order.

12. Data security

We apply technical and organisational measures appropriate to the risk, in particular: encryption of connections (HTTPS/TLS), role-based access control, row-level security in the database, passwordless login (one-time codes or a Google account), storage of organiser and participant tokens only in the form of cryptographic hashes, pseudonymisation of IP addresses and customer identifiers, time-limited links to private files, limits and safeguards against automated abuse, and restriction of employees’ and Sales Representatives’ access to the data necessary for their work.

13. Changes to the Privacy Policy

We may update this Policy in connection with changes in the law, technology or features of the Service. We will inform you of significant changes in the Service and, in the case of Account holders, also by email. The current version, together with its effective date, is always available on this page.