TSHIRT.UK · HELP & INFORMATION

Privacy policy

Updated 26 October 2026

This notice explains how tshirt.uk uses personal information. For privacy requests, contact info@tshirt.uk with “Privacy” in the subject. The legal controller name and business postal details are being completed during owner testing.

Website performance

We record aggregate image-load failures, first-image timing and largest-contentful-paint timing for the home and gallery pages. These measurements contain no artwork URLs, prompts, account IDs, delivery addresses or persistent visitor identifiers. They help us diagnose slow or broken images.

Information we use and why

• Account: sign-in identity, name and email supplied through ChatGPT sign-in, to identify your account and keep orders and artwork accessible to you. We do not receive your ChatGPT password or unrelated conversations.
• Orders: items, size, colour, delivery address, recipient contact details, payment references, order status and support messages, to quote, take payment, manufacture, deliver, refund and support purchases. Stripe collects card details on its hosted checkout; the shop does not store full card numbers.
• Designs: uploaded photos, prompts, generated images, edits, layout and print files, to provide the designer and prepare your requested product. AI editing sends the selected image and instructions to the AI provider; automatic enlargement may send artwork to an upscaling provider.
• Gallery: submitted artwork, your chosen public account username, a stable public creator ID, username-change history, any shared prompt, votes and sales counts, to run the community gallery. Submission is optional and reviewed by an administrator. Your current username appears consistently across submissions; the original submission name is retained privately for attribution and dispute handling. Previous usernames stay reserved to your account to prevent impersonation. Approved content is public and can be purchased; do not submit private information. A prompt is shared only according to your submission choice.
• Support and security: correspondence, technical request information, IP-derived abuse-prevention identifiers and usage limits, to answer enquiries, prevent misuse, diagnose faults and protect the shop. Hosting providers also process connection information such as IP addresses.

We need delivery and contact details to fulfil an order, and an image or prompt for the corresponding creative feature. If you choose not to supply them, that feature or purchase cannot proceed. You can browse without submitting artwork.

Legal bases and choices

Under UK data-protection law, we use contractual necessity for requested account, design and purchase services; legal obligations for required records; and legitimate interests for proportionate security, fraud prevention, service support and dispute handling. Our interests are keeping the service reliable and protecting customers and the business. Optional public gallery participation uses your permission; where personal-data consent is the basis, you can withdraw it by emailing us. Withdrawal does not undo earlier lawful processing or completed orders.

You can object to processing based on legitimate interests. Contact us and we will assess your request. We do not use shop data for targeted advertising or sell personal information. Transaction and support emails concern your requested service, not a marketing subscription.

Who receives information

• OpenAI / ChatGPT Sites and Cloudflare: hosting, sign-in, database and file storage; OpenAI also processes requested AI generation, image edits and prompt refinement.
• Replicate: artwork processing when AI enlargement is used.
• Gelato and its production/delivery partners: print artwork, product specifications and recipient details needed to make and deliver your order. If you choose Generate product mockup, Gelato also receives your composed artwork and selected variant before any order is placed, and retains a preview product in our private supplier workspace. No delivery address is sent for a mockup. Generated supplier previews are served by Gelato; the composed artwork is stored in our Hetzner storage.
• Stripe: payment, transaction and fraud-prevention services.
• Resend: sending order, support and contact emails.
• Google Fonts and product-image hosts: your browser requests font or reference-image files, which exposes connection information such as IP address to their hosts.
• Authorised shop administrators: artwork review, customer service and order management; professional advisers or authorities where legally necessary.

AI suppliers may retain inputs and outputs under their service terms and security policies. We do not promise immediate provider deletion or that all processing stays in the UK. Avoid uploading sensitive documents or information you do not want processed. Only upload pictures you have permission to use, especially photographs of other people or children.

International processing

Suppliers and print partners may process data in the UK, United States and other countries, including the delivery country. Applicable legal safeguards for international transfers must be in place. The provider agreements, processing locations and transfer safeguards are being verified during owner testing; the final transfer disclosures will be completed before general sales. Contact us for available details or copies of relevant safeguards.

How long information is kept

Private saved designs, including cards and purchased copies, are retained for 90 days from saving. Existing private designs without an expiry receive a full 90-day period when first accessed under this policy. Existing 30-day saved-copy expiries are extended by 60 days. Pending and approved gallery submissions are retained beyond that period while participating in the gallery. Rejected or removed gallery copies normally receive a 90-day expiry.

Deleting a saved design does not immediately erase every linked file: files referenced by another design, an order or a gallery submission remain protected. Unreferenced artwork becomes eligible for storage cleanup after 90 days from its first unused-file scan. Cleanup is a maintenance operation, so expiry removes the saved design from the account but does not guarantee physical file deletion on that exact day.

Orders, print files, payment references and correspondence are retained as needed for fulfilment, reprints, disputes and legal/accounting requirements. We assess these purposes when considering deletion requests. Browser storage has separate lifetimes described in our cookies notice. You can request deletion or a retention explanation at any time.

File hosting

Uploaded artwork, generated images, print files and gallery thumbnails is stored privately with Hetzner Object Storage in Helsinki, Finland. Access continues through the shop’s permission-checked routes. Existing Cloudflare storage copies may be retained for migration recovery. The site and order database remain on Sites hosting.

Public creator shops

Optional social profile links you save are public on your shop and approved gallery entries. Share pages expose approved artwork and public creator details so social services can build link previews. Those services may cache previews; removal here cannot immediately recall their cached copies. Remove a profile link in your shop settings to stop showing it here.

Approved gallery submissions are also grouped in a public shop under your chosen username, linked from the gallery. Private, pending, rejected and removed designs are not shown. Sharing buttons open the selected social service only when you use them; no social tracking widgets are embedded.

Optional creator promotion pages

You can prepare a public creator name, short bio and permanent promotion link in Creator Studio. Publishing requires your explicit choice and an enabled creator programme. Only approved gallery designs appear. Drafts are visible only to you and the shop administrator. The public page does not expose your email, account identifier, earnings or customer information. You can unpublish it at any time; account-erasure processing also withdraws it.

Email accounts and creator participation

Email sign-in is an alternative to ChatGPT sign-in. We store your verified email, a salted bcrypt password hash, account identifier, hashed session/reset tokens, and security counters. We never store plaintext passwords. Verification and reset links expire after 30 minutes; email sessions expire after seven days. Expired tokens and sessions are removed during account-service maintenance requests. IP/email-derived abuse counters are removed after 24 hours during those requests. These are essential security measures, not advertising tracking.

You can explicitly add email sign-in while authenticated with ChatGPT, using the same verified email. We do not automatically merge separate accounts based on email. Your designs remain tied to a stable shop account identifier.

Optional creator participation records your chosen public name, terms version and acceptance, design permissions and test approvals, agreed rates, earnings, refunds, payment references and support decisions. We use this to perform the creator agreement, protect rights and meet applicable legal/accounting obligations. Creator dashboards do not receive buyers’ contact or delivery details. Payment account details are handled through the secure payout process disclosed before activation; do not upload bank details into design or support fields.

Use your account to export account data or submit an access, correction, erasure, restriction or objection request. The export includes available structured records and artwork references; you can ask for a fuller access response and copies. Erasure requests are reviewed to separate removable data from financial or dispute records that must lawfully be retained. Submitting a request does not instantly delete your account. We aim to respond within one calendar month and will explain any lawful extension or retention. Programme activation requires the owner to finalise the legal controller, retention schedule and supplier arrangements.

Your rights

Depending on applicable law and the circumstances, you may request access, correction, deletion, restriction, a portable copy of your information, or withdrawal of consent. We may retain records required for legal obligations or disputes and will explain any refusal. We verify identity proportionately and respond within applicable legal deadlines. Contact info@tshirt.uk; you do not need to buy anything or pay to make an ordinary request.

UK customers can complain to the Information Commissioner’s Office. Canadian customers may contact the Office of the Privacy Commissioner of Canada or the relevant provincial regulator. UAE and US residents may also have local privacy rights and complaint routes, subject to the scope of the relevant laws. We do not discriminate against you for exercising applicable rights.

We apply automated checks for usage limits, product availability and security. Print approval is reviewed by an administrator. Contact us to query a blocked request or order decision. The shop is intended for adult account holders; children’s garments should be ordered by an adult.

Versions and private comparison links

The designer saves recent artwork versions with their layout and prompt to your account for 90 days. Creating a comparison link is optional: anyone with that link can view the selected artwork and editable wording, and vote without signing in. Prompts and your account identity are not included. Links expire after 30 days and you can revoke them sooner under Versions & private sharing. Recipients may copy what they see; revoking cannot recall their copies.

A random browser identifier records one current preference per browser and link. IP-derived identifiers help limit abuse. Counts are informal preferences, not verified individual votes. Active versions and links protect their image files from storage cleanup; expiry ends access but does not guarantee immediate deletion of all metadata or files.

Public designs and removal

To request gallery removal or withdraw personal-data consent, email us with the design reference. We can stop future display and sale, but cannot recall completed printed orders or copies made independently by visitors. Order records and required print files may still be retained. Changes to this notice will be dated here.