Privacy Policy
Last updated: 17 October 2026
This Privacy Policy explains how Big Van Studio ("we", "us") collects, uses and protects personal data when merchants install and use the Qstomizer app for Shopify ("the App"), when their customers use the Qstomizer product designer, and when anyone visits qstomizer.com. It should be read together with our Terms of Service.
1. Who is responsible for your data
Big Van Studio, Avda. Sudamérica 15, 11407 Jerez de la Frontera (Cádiz), Spain. Email: info@bigvanstudio.com.
Our role depends on whose data it is:
Merchants and website visitors: we are the controller of the data described in sections 2.1 and 2.3.
Merchants' customers (shoppers): the merchant who runs the store is the controller, and we act as the merchant's processor. We process this data only on the merchant's behalf and to provide the App. Shoppers who want to exercise their rights should contact the store where they used the designer; we will assist the merchant.
2. What data we collect
2.1 Merchants. When you install the App, Shopify gives us access to information about your store. We store:
Store details: store name and domain, store email and contact email, business address, phone number, currency, time zone and Shopify plan.
The IP address used at installation, and the access tokens Shopify issues to the App.
Your App configuration and content: templates, product images, clipart, fonts, settings, plan and usage (for example, AI credits used).
Messages you send us when you request support.
We do not receive or store your payment card details: billing is handled entirely by Shopify.
2.2 Shoppers (on behalf of the merchant). When a shopper uses the product designer, we process:
Images uploaded by the shopper, texts and design choices, and the resulting design previews and print files.
Prompts written for AI features and the images generated from them.
If the shopper saves a design: their email address and Shopify customer ID, linked to the saved design.
Order references (order number, product, variant and quantity) to link each order to its design.
Only if the merchant uses a print-on-demand integration and sends an order to the provider: the recipient's name, shipping address, phone and email, which we read from Shopify and pass to the provider to fulfil the order.
Shoppers should not upload images containing sensitive personal data. The App is not directed to children under 16.
2.3 Website visitors. If you use the contact form on qstomizer.com we process your name, email address and message to answer you. Like any website, our servers and providers process technical data such as your IP address to deliver the pages.
3. Why we use the data and on what legal basis
To provide the App (store your templates and settings, run the designer, generate print files, link designs to orders, manage your plan): performance of our contract with the merchant.
To provide support and send service emails (installation, account, billing and important changes): performance of the contract.
To send product news and tips to merchants: our legitimate interest in informing our customers about our own services. You can unsubscribe at any time using the link in each email.
To keep the App secure, prevent abuse and improve it: our legitimate interest.
To comply with legal obligations (for example, tax records or requests from authorities): legal obligation.
Shopper data: processed only on the merchant's instructions, to provide the App to the merchant.
We do not sell personal data, we do not use it for advertising, and we do not use shoppers' images, designs or prompts to train AI models.
4. Service providers we use
We share data only with the providers we need to run the App, under contracts that require them to protect it:
Amazon Web Services (USA): hosting, database, file storage, content delivery and transactional email.
Shopify (Canada/USA): the platform the App runs on, and billing.
Brevo (EU): emails to merchants.
Replicate and Stability AI (USA/UK): AI image generation and background removal. Only the prompt or the image to process is sent, and only when the AI feature is used.
Printful: only for merchants who connect it, to fulfil the orders they send.
Google Fonts and public content delivery networks (such as jsDelivr and cdnjs): they deliver fonts and code libraries to the designer and the admin, which means they receive the visitor's IP address.
Headway: shows our product updates inside the App's admin.
We may also disclose data where required by law, to respond to a valid request from an authority, or to protect our rights.
5. International transfers
Our main hosting is in the United States, and some providers are located outside the European Economic Area. When data is transferred outside the EEA, we rely on safeguards recognised by the GDPR, such as the EU-US Data Privacy Framework for certified providers or the European Commission's Standard Contractual Clauses.
6. How long we keep the data
Merchant account and configuration: while the App is installed. When you uninstall, images uploaded to your store's account are deleted immediately, and the rest of your data is deleted within 30 days after Shopify sends us the store deletion request (Shopify sends it 48 hours after uninstallation). We keep only what the law requires us to keep.
Shopper uploads: kept for up to 6 months, as explained in the Fair Use Policy.
Order print files and previews: kept for 90 days after they are generated.
Saved designs: until the shopper or merchant deletes them, the merchant uninstalls the App, or the merchant asks us to erase that shopper's data.
Support messages and contact form: for as long as needed to handle your request and any follow-up, and no longer than 3 years.
7. Requests made through Shopify
Shopify sends us privacy requests on behalf of merchants and shoppers. When a shopper asks a store to delete their data, we delete the saved designs linked to that shopper. When a shopper asks a store for a copy of their data, we provide the merchant with the data we hold about that shopper. We respond to these requests within 30 days.
8. Cookies and similar technologies
The product designer uses only technical session cookies and browser storage that are necessary for it to work. We do not use advertising or analytics cookies in the App.
qsmzfilesloaded, qsmzSavedDesigns, qsmzAi: remember the shopper's uploaded images, saved designs and AI images during the design session. They are session cookies, deleted when the browser is closed.
qsmztestcookie: checks whether the browser accepts cookies. Session cookie.
Browser storage (qsmz3dCollapsed, qsmz3dPos): remembers the position and state of the 3D preview panel.
Session cookie of the App's admin: keeps the merchant signed in.
Because these are strictly necessary, they do not require consent. You can delete or block cookies in your browser settings, but the designer may not work correctly without them.
9. Security
We use technical and organisational measures to protect personal data, such as encrypted connections (HTTPS), access controls and restricted access to our systems. No system is completely secure, but we work to protect your data and will notify you and the authorities of any personal data breach where the law requires it.
10. Your rights
Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. To exercise these rights, email us at info@bigvanstudio.com. Shoppers should contact the store where they used the designer first, as the merchant is the controller of their data. You can also file a complaint with the Spanish Data Protection Agency (AEPD) or with the authority in your country.
11. Changes to this policy
We may update this Privacy Policy to reflect changes in the App, our providers or the law. The "Last updated" date at the top shows the latest version. We will inform merchants of material changes by email or in the App.
