Privacy Policy

Who we are

allthe is a print-on-demand platform operated by allthe ltd ("allthe", "we", "us"), registered in England and Wales. This policy explains how we collect and use your personal data across everything we offer: our website at allthe.com, your customer account and dashboard, storefronts hosted on our platform, our mobile app, and the apps and integrations we provide for Shopify, Etsy, WooCommerce and TikTok Shop. For the personal data of our own customers, allthe ltd is the data controller. Where you sell through your own connected store or an allthe-hosted storefront and we handle information about your buyers, you are normally the controller and we act as your processor — see "Your store's customers" below. If you have any questions, contact us at legal@allthe.com.

Information we collect

Information you give us

Account and profile details — your name, email address, password, and, where relevant, your business name, phone number and billing details.
Orders and delivery — the billing and delivery addresses, recipient details, and product choices needed to produce and deliver your order, including any personalisation (such as a name or message) you add to a product.
Content you upload — artwork, designs, logos, photographs and text you upload to customise products or to generate designs, including photos you provide for AI photo personalisation.

Payments — when you pay, your card or payment details are collected and processed directly by our payment providers (Stripe and PayPal). We do not store full card numbers; we receive a secure token and limited details such as the card type and last four digits. When you buy from a storefront hosted on our platform, your payment is processed by Stripe for the merchant of record named in the shop's footer.

Store connections — if you connect a Shopify, Etsy, WooCommerce or TikTok Shop store, we collect the access tokens and the product, listing, order and fulfilment data needed to sync those channels. Access tokens are encrypted at rest and are used only to operate the integration you authorised.
Communications — messages, support tickets and correspondence you send us.

Information we collect automatically

Usage and device data — your IP address, browser and device type, app and device identifiers, the pages and features you use, and similar technical information.

Diagnostics — error and performance logs via our error-monitoring provider (Sentry), which help us keep the platform reliable. This includes session replay for a small sample of browsing sessions, used solely to diagnose and fix technical issues.

Cookies and similar technologies — we use strictly necessary cookies, preference cookies, and (only with your consent) analytics and advertising cookies; see our Cookie Policy for the full list and how the consent banner works.

Push tokens — if you use our mobile app and enable notifications, a device push token so we can send you order and account updates.

How we use your data and our lawful bases

We use your personal data to:

Provide the platform, create and manage your account, and keep you signed in (to perform our contract with you).
Take payment, produce, pack and deliver your orders, and keep you updated on their progress (to perform our contract with you).
Operate our design tools, including AI-assisted design generation and photo personalisation, when you choose to use them (to perform our contract with you).
Keep the platform and its users safe — including screening uploaded content for prohibited or illegal material, and preventing fraud and abuse (our legitimate interests, and to comply with legal obligations).
Provide customer support and respond to your enquiries (to perform our contract with you and our legitimate interests).

Improve and develop our products and services, including troubleshooting and product analytics (our legitimate interests, and your consent where we use optional analytics cookies).

Send you service messages about your account and orders (to perform our contract), and marketing where you have agreed to receive it (consent, which you can withdraw at any time).

Measure and improve our advertising — understanding which of our adverts led to a visit, a sign-up or an order, and showing our adverts to relevant audiences on other platforms (your consent, given through the advertising category in our cookie banner, which you can withdraw at any time).

Comply with our legal and regulatory obligations, including tax, accounting and consumer-protection law (legal obligation).

Design tools and AI features

When you use our design-generation or photo-personalisation features, the prompts and images you submit are processed by us and by the specialist technology providers that power those features, solely to create the design you have asked for. We do not use your uploaded photos or generated designs to train publicly available AI models, and we do not share them for that purpose. You are responsible for ensuring you have the right to use any image or content you submit.

Keeping content and the platform safe

To protect our users and meet our legal obligations, content uploaded to the platform may be screened automatically, and in some cases reviewed by our team, to detect and prevent prohibited or illegal material. We may remove content, and suspend or close accounts, where our terms or the law require it.

We never sell your personal data. We share it only with the parties needed to run the platform and fulfil your orders, and only to the extent necessary:

Payment providers — Stripe and PayPal, to process payments and refunds securely.
Production, fulfilment and logistics partners — the partners who help us print, produce, pack and ship your products on our behalf receive the details needed to make and deliver your order, such as the product specification, any personalisation and the delivery address.
Delivery carriers — couriers and postal services, to deliver your order and provide tracking.
Connected sales channels — where you authorise a Shopify, Etsy, WooCommerce or TikTok Shop connection, data is exchanged with that channel to sync your products and orders. Your use of those channels is also governed by their own terms and privacy policies.

Storefront orders — the footer of every storefront hosted on our platform names the merchant of record for that shop. On most storefronts that is the seller: your payment goes to them, and we process your information on their behalf to host the shop, produce and deliver your order, and pass your support messages to them. On shops marked "Sold by allthe", allthe is the merchant of record and processes your information as controller to take payment, fulfil the order and provide support.

Technology providers — the providers that operate the platform on our behalf, under contracts that require them to protect your data. They include Vercel (application hosting), Supabase (database hosting), Cloudflare (file storage, content delivery and network security), Sanity (content management), Resend (transactional email delivery), Beehiiv (marketing newsletter delivery, where you have opted in), Sentry (error and performance monitoring, including sampled session replay), Upstash (rate limiting), Cloudmersive (file safety scanning and document conversion), CookieFirst (cookie-consent management), Google Analytics (consent-based site analytics), Pendo (product analytics within the signed-in dashboard) and GoCardless (bank-mandate payments for account top-ups).

Advertising and measurement platforms — if you accept advertising cookies, Meta (Facebook and Instagram), Google Ads, Microsoft Advertising (Bing and Copilot) and Reddit receive measurement data about visits and orders that followed one of our adverts, so that we can tell which adverts work and show our adverts to relevant audiences. We do not send them your name, email address or any other personal detail, in plain or hashed form. These providers are based in the United States; see "Where your data is processed" below for the safeguards that apply.

Professional advisers and authorities — our advisers, and regulators, law-enforcement or other authorities where we are required or permitted by law to share information.
Business transfers — if allthe is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction.

Your store's customers

When you connect your own store — Shopify, Etsy, WooCommerce or TikTok Shop — the orders we receive include information about your buyers: their name, email address, delivery address, and any personalisation they entered, such as a name or number to be printed. On those orders you are the data controller and we are your processor. We use that information only to produce and deliver what you sold, and to support you in doing so. We do not market to your buyers, and we do not use their information for anything else.

If one of your buyers wants to see or erase their data, they should contact you as the controller, and we will act on any request you pass to us. We also honour erasure requests a sales channel sends us directly. When Shopify sends us a customer redaction request, or 48 hours after you uninstall our app, we erase the buyer's name, email address and delivery address, the personalisation they entered, and any print artwork rendered from it. We keep the order and its financial record, without the buyer's identity, for as long as tax and accounting law requires.

Storefronts hosted on our platform work the same way where you are the merchant of record (the default): you are the controller for your buyers' personal data and we process it on your behalf to run the shop, take payment through your connected Stripe account, produce and deliver orders, and route buyer support messages to you. Where your storefront runs on our at-cost model, allthe is the merchant of record and the controller for buyer data on those orders — see "Storefront orders" above.

Where your data is processed

Your data is primarily stored and processed on servers in the UK and EU. Some of our providers, including the advertising and measurement platforms described above, process data in the United States. Where data leaves the UK and EEA we rely on appropriate safeguards — UK and EU adequacy decisions, the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, the UK International Data Transfer Agreement, or Standard Contractual Clauses.

How long we keep your data

We keep your personal data for as long as your account is active and as long as we need it to provide the platform and fulfil your orders. We keep order, payment and tax records for as long as required to meet our legal and accounting obligations (typically at least six years). When data is no longer needed, we delete or anonymise it.

How we protect your data

We use encryption in transit, access controls, and reputable cloud infrastructure to protect your data against unauthorised access, loss or misuse. No system is completely secure, but we take appropriate technical and organisational measures to keep your data safe.

Your rights

Under UK GDPR and, where it applies, EU GDPR, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to certain processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these rights, contact us at legal@allthe.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) or your local data-protection authority, though we'd appreciate the chance to resolve any concern first.

Children

The platform is intended for adults and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Our mobile app

Our mobile app provides access to your allthe account on your device. With your permission, it may use your device camera or photo library so you can upload artwork and photos, and send you push notifications about your account and orders. You can control these permissions in your device settings. The app handles your personal data in line with this policy, and your use of it is also subject to the relevant app-store terms (such as Google Play).

Cookies

We use strictly necessary cookies, preference cookies, and — only with your consent — analytics and advertising cookies, managed through the consent banner on our site. For the full list and details, see our Cookie Policy.

Changes to this policy

We may update this policy from time to time. When we make material changes we will update the date below and, where appropriate, let you know. Your continued use of the platform after an update means you accept the revised policy.

Contact us

For any privacy question or to exercise your rights, contact us at legal@allthe.com or through our contact form.