Privacy Policy

Data we process

We process account identifiers, verified email, role/status, authentication verification and session data, observed IP address and user agent, billing/customer mappings, product and subscription records, credit ledger and purchase-lot records, policy acceptance, safe export metadata, hashed abuse signals, admin audit records, logs, and correspondence you send us. Stripe handles payment-card details; PrintGrid Pro does not store complete card details.

If you choose Google sign-in, we receive Google's provider identifier, verified email, and basic profile name for authentication, security, and explicit account linking. PrintGrid Pro does not request access to Gmail, Drive, Calendar, Contacts, or offline Google APIs, and does not sell Google identity data. A profile image is not used in the current interface.

Source and output processing

Source files stay local until you explicitly begin an authorized export. Only the active source is uploaded to a private temporary directory. Cached thumbnails are used for preview; the original source is used for export. Source and output bytes are temporary and source content is not stored permanently in PostgreSQL. Removing a local browser file and server cleanup are separate processes.

Purposes and legal bases

We use data to create and secure accounts, provide requested exports, perform contracts, reconcile payments and entitlements, calculate tax, prevent abuse, support customers, maintain records, comply with law, and establish or defend legal claims. Depending on context, processing is based on contract performance, legal obligation, legitimate interests such as security and fraud prevention, consent where required, or another lawful basis available under mandatory law.

Processors and international transfers

Railway hosts the application and PostgreSQL; Stripe provides hosted payments, billing, tax, refunds and webhooks; Resend delivers OTP email; Zoho Mail handles support, privacy, and legal correspondence; Ghost provides private tutorial authoring; Google Search Console provides aggregate search reporting; and Google Analytics 4 may process optional usage measurement only after affirmative analytics consent. Providers may process data across borders under their contractual and legal transfer mechanisms. PrintGrid Pro is operated from the United States.

Transactional email and mailbox-related data is retained according to the applicable provider configuration, service plan, contractual terms, and legal or security requirements. Processor contractual-compliance records are maintained privately and are not represented as executed or retrieved unless confirmed through the authenticated provider account.

Optional desktop usage analytics

Desktop usage analytics is off by default. You can enable Share usage analytics in the desktop application's Settings to help us understand installation activity and feature use. This sends a random installation identifier, app version, platform, event and session identifiers, timestamps, and a limited set of feature choices and operation outcomes. Examples include file type and page-count range, layout mode, paper category, scaling, duplex selection, PDF export outcomes, print-job submission and opening a purchase flow. Documents, artwork, file names, paths, printer names and document content are not included.

These events go to PrintGrid Pro's own backend, not Google Analytics. When sent with a valid desktop sign-in session, activity can be linked to that account and viewed by authorized administrators alongside account and subscription records. Anonymous usage does not identify an account. Purchases and subscriptions are verified separately with Stripe and do not depend on optional usage consent. A submitted print job does not confirm that physical sheets were printed.

The app can queue up to 500 events locally for up to 14 days while offline. Received usage events are retained for 90 days; inactive installation records for 365 days. Turning the setting off clears unsent activity immediately and requests deletion of that installation's server usage history when online. A minimal revocation marker, containing the random installation identifier, a hashed deletion credential and timestamps, is kept for up to 365 days to reject late uploads. This does not delete separately required account, licensing or financial records. Desktop analytics does not upload source documents or track other applications.

Retention

• Uploaded source: immediate cleanup after ready/failure/cancellation; hard maximum 1 hour.
• Ready PDF: maximum 24 hours.
• Failed-job files: immediate terminal cleanup.
• Session: until expiry, revocation, or logout; OTP: only its short security lifecycle.
• Ordinary Railway raw application logs: 30 days under the currently verified Pro workspace entitlement; the actual provider-plan period applies if the workspace plan or provider terms change.
• Selected server-authoritative security and abuse records stored separately by PrintGrid Pro: 12 months, subject to legal holds, active investigations, or mandatory requirements.
• Export metadata: 24 months, excluding temporary source/output bytes.
• Support and privacy-request records: 3 years after closure or completion.
• Financial, tax, policy-acceptance and admin financial audit records: 10 years.
• Account profile: account lifetime through verified deletion, subject to exceptions.

A legal hold, active investigation, dispute, accounting rule, tax rule, fraud-prevention need, or mandatory law may require longer retention of the relevant record.

Security, rights, and deletion

We use access controls, same-origin session protections, encrypted transport, strict request validation, webhook signatures, private temporary paths, bounded processing, redacted logs, and transaction-safe financial records. No system can promise absolute security.

You may disconnect Google in Connected Accounts after recent authentication. Completing a verified account-deletion request removes unnecessary provider linkage and identity data; this does not claim deletion of data controlled independently by Google.

Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or complain to a competent regulator. We must verify identity before disclosure or deletion. Request deletion in authenticated Account settings or from the verified account email to privacy@printgridpro.com. We acknowledge within 2 business days and normally complete a verified request within 30 calendar days. Financial, tax, policy, refund, security, dispute and other mandatory records may be retained and separated or de-identified as appropriate.

Children, updates, and contact

PrintGrid Pro is for people aged 18 or older. Material policy updates receive a new version and effective date. Contact privacy@printgridpro.com or use the mailing and legal notices address on our Contact page.