Printelune merchant agreement

Published terms

Printelune merchant data-processing agreement Version 2026-11-05 — adopted by Starmen House

Operator: Starmen House, Indiranagar, Bengaluru 560038, Karnataka, India. Support: help@appsorcerer.com.

The merchant controls the purposes of personalization and provides lawful instructions, buyer notices and permissions. Starmen House processes the merchant's option configuration, artwork uploads and technical installation data only to operate Printelune, support it, secure it and comply with applicable law. It does not sell this data, use it for advertising or train models with it.

Artwork may contain information supplied by a shopper. Uploads are restricted to PNG and JPEG, decoded and re-encoded, encrypted at rest and available only through authenticated merchant access. The merchant must not request identity documents, payment details or other sensitive personal data. Printelune does not store the text answers that Shopify receives as order line properties. Shopify's own retention and access controls govern those order properties.

Artwork expires 30 days after upload, including artwork associated with orders. The merchant must download needed artwork before expiry and apply its own lawful retention controls afterward. A shopper can remove an upload using its private removal receipt; the merchant can also remove it. Expired or removed artwork may remain inside encrypted backups until their seven-day rotation. Restore reapplies expiry and the separate erasure journal before access. Operational audit records contain pseudonymous actor identifiers and are kept seven days. Encrypted recovery copies are kept no more than seven days. Configuration and installation records are removed on verified uninstall or shop erasure.

The hosting subprocessor is OVH SAS, France. Shopify provides the commerce platform and receives line-item personalization and app configuration. Access is restricted to authorized operators and authenticated merchant accounts. Starmen House uses encryption, least-privilege access, bounded requests, backup and recovery checks, and incident-response procedures. It will notify an affected merchant without undue delay after confirming a personal-data breach, and reasonably assist with access, correction, deletion and regulator inquiries.

The merchant may pause new processing, remove assignments, export configuration or request deletion. Pausing the hosted app does not automatically erase Shopify order properties. Removing a checkout validation rule also removes its enforcement; the merchant must review its own checkout settings. Printelune does not guarantee artwork content authenticity at checkout: the server verifies stored receipts when preparing the cart, while the offline checkout rule verifies only receipt format.

The parties must comply with applicable data-protection obligations, including lawful international-transfer arrangements where required. No party's statutory rights or liabilities are waived by this document. Changes to subprocessors, processing purposes or material terms require notice and a revised acceptance before new processing. Acceptance records the exact document hash, version, time and a pseudonymous authorized staff identifier.

Version 2026-11-05

Document SHA-256: 6f002bfc603eec8949bfd170683d0b7fccd12374bb8bd5dedbbbbb187f76b291