Privacy policy

Last updated 9 October 2026. If anything is unclear, email hello@printersfriend.com.

Printer's Friend (we, us, our) runs a software platform for apparel print shops. This policy explains what data we hold about you, why, who processes it on our behalf, and how long we keep it. It applies to anyone visiting printersfriend.com or using the platform.

Who is the data controller

Printer's Friend, Australia. For data subject requests, email hello@printersfriend.com. For shop operators using the platform with their own customers, the shop is the controller of its customer data and Printer's Friend is the processor under the data processing addendum.

What we collect

If you visit the marketing site

• With your consent in the cookie banner: page views, browser type, country (from IP) and referrer, through a self-hosted Umami instance on our own server. Aggregated, no cookies, no third party. Stored for 24 months. Without consent, nothing is recorded.
• If you accept marketing cookies: the campaign source that brought you here, held in a first-party cookie for 30 days.

If you request a demo, download the pricing pack or fill in a form

• Your name, email, phone, shop name, country, decoration methods, and the message you send us.
• We use this to reply to you and, if you become a customer, to set up your account.

If you use the platform

• Account data: name, email, password hash, role, last sign in, and the version of the terms you accepted.
• Business data: customers, quotes, orders, artwork, invoices, stock, comms history. This belongs to you. We process it on your behalf.
• Operational logs: request logs and error reports, kept for 60 days so we can diagnose problems.

Why we collect it

• To run the service. You cannot have an account without the data that makes accounts work.
• To communicate with you. Service updates, billing emails, security notifications. Marketing emails only with your consent.
• To fix problems. Error reports and request logs tell us what broke.
• To meet legal obligations. Tax records, fraud prevention, lawful access requests.

Who processes it on our behalf

We use the smallest set of subprocessors we can run the platform on. This is the current list; the DPA explains how we notify changes.

Subprocessor	Where	What for	When
Hetzner Online GmbH	Helsinki, Finland	Application hosting, database and backup storage.	Always.
Amazon Web Services (Simple Email Service)	us-east-1, United States	Transactional email delivery from the platform mailer.	Always, unless the shop connects its own email provider.
Stripe	United States and Ireland	Subscription billing for Printer's Friend, and customer payments when the shop connects Stripe.	Always for subscription billing; customer payments only when the shop connects Stripe.
Twilio	United States	SMS delivery.	Only when the shop connects its own Twilio account.
Anthropic	United States	Answers for the Demi assistant. Workspace data is passed as context for the query and is not used for training.	Only when the assistant is enabled.
Umami (self-hosted)	Helsinki, Finland, on our own server	Aggregated page view analytics for the marketing site. No third party receives the data.	Only on the marketing site, and only after you accept analytics in the cookie banner.

We never sell your data and never share it with advertisers. A shop may connect its own providers (its own email service, Twilio, Stripe or accounting ledger); those are the shop's own processors under the shop's own agreements.

Where it is stored

The platform, its database and its backups run at Hetzner Online GmbH in Helsinki, Finland. Transactional email leaves through Amazon SES in the United States (us-east-1). Australian customers should note that this means their data is held outside Australia; EU and UK customers should note that the hosting is inside the EU and that email, payments, SMS and the assistant involve transfers to the United States under the safeguards described below.

How long we keep it

• Marketing site analytics: 24 months, and only with consent.
• Demo requests and enquiries that do not become customers: 12 months.
• Active account data: for as long as the account is active.
• After a cancellation: the workspace stays open and read-only for 30 days so you can export or restart, then every record is permanently deleted. You can ask us to delete sooner. A failed payment never deletes anything: a lapsed subscription drops the workspace to the free tier with every record intact.
• Backups: taken nightly, encrypted, stored in the same Hetzner data centre in Helsinki, Finland, and kept as daily copies for 16 days, then weekly, monthly and yearly copies. A deleted workspace drops out of the backups as they age through that schedule.
• Tax records: 7 years as required by law.

Your rights

Under the Australian Privacy Act, the GDPR, the UK GDPR and the CCPA, you have the right to access, correct, port, restrict and delete your data. Email hello@printersfriend.com and we respond within 30 days, usually much sooner. If you are a customer of a shop that uses Printer's Friend, the portal has a privacy page where you can download your own data and request deletion; the request goes to the shop and to us.

International transfers

Where data crosses borders (hosting in Finland for customers elsewhere, and US-based subprocessors such as Amazon SES, Stripe, Twilio and Anthropic), we rely on Standard Contractual Clauses, the UK addendum, and equivalent safeguards under the Australian Privacy Principles.

Security

TLS in transit. Encrypted disks at rest. Encrypted nightly backups. We do not store payment card data; Stripe handles that. Detail is in our security overview.

Children

Printer's Friend is a business platform. We do not knowingly collect data from anyone under 16. If you believe we have, email us and we will delete it.

Changes

We will email account holders 30 days before any material change. The current version is always at this URL. Material changes affecting customer data will also surface as an in-product banner.

Complaints

Email hello@printersfriend.com first. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), the UK ICO (ico.org.uk), or your local data protection authority.