Privacy policy

Who handles your data

DropFly Inc. (a Delaware corporation), trading as MerchFly is the controller of the personal information collected through merchfly.app. Write to us at hello@merchfly.app about anything on this page. Postal address on request.

This policy covers this website and the orders placed on it. It is short because the site does little with your data: it takes an order, gets it made, and gets it to you.

What we collect, and why

The job itself

Company name, contact name, email address, the products, colours, sizes, decoration and quantities, any note you add, and a needed-by date if you give one. This is the order; without it there is nothing to make.

Your delivery address

Name, company, street, city, state or province, postal code and country, plus a phone number if you give one. It is used to quote shipping accurately and to get the parcel to you. The carrier may need the phone number for delivery.

Your artwork

The logo or image you upload. It is stored so the print file can be fetched by our fulfilment partner when the goods are decorated.

Payment details

Handled entirely by Stripe. Your card number never reaches our servers. We receive a record that the payment succeeded, the amount, and the email on the receipt.

Basic request data

Our host processes ordinary web-server data such as IP address and request time to serve pages and to rate-limit abuse of the order form. We do not build profiles from it.

We use all of this for one purpose: to quote, take, produce, ship and support your order, and to keep the records a business is required to keep. We do not send marketing email unless you ask us to.

Who else touches it

Three companies process data on our behalf. There is no fourth.

Cloudflare — hosting and storage

The site runs on Cloudflare Workers and job records are stored in Cloudflare Workers KV. Cloudflare holds the data at rest and serves every request.

Stripe — payment

Receives your name, email, card details and billing information directly from you at checkout. We never receive the card number. Stripe is the payment processor and handles the money end to end.

Printful — decoration and shipping

Receives your delivery address and your artwork so the goods can be decorated and shipped, and passes the address to the carrier.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If the business is ever sold or merged, order records would transfer with it, and this policy would follow them.

What we never do

• We do not sell or share your personal information for advertising, and we never have.
• There are no advertising trackers, no analytics cookies and no third-party cookies on this site. Nothing follows you off it.
• We set no cookies beyond what the site needs to work. The job you are building lives in your own browser’s local storage until you submit it — before that, it has not reached us at all.
• We do not rent, trade or publish your contact details, and we do not add you to a mailing list for buying something.

How long we keep things

• Your uploaded artwork: 90 days, then it is deleted automatically. It exists only long enough to produce your order.
• Job and order records: kept while your order is live and afterwards as our transaction and tax records, for as long as accounting and tax law requires.
• Payment records: held by Stripe under its own retention rules.

Ask us to delete a job record and we will, subject to the records we are legally required to keep.

Your rights

Email hello@merchfly.app and we will action any of these. There is no charge and no form to fill in.

• Access — ask what we hold about you and we will send it.
• Correction — tell us something is wrong and we will fix it.
• Deletion — ask us to erase what we hold, except records we must keep by law.

If you live in California, the CCPA and CPRA give you rights to know, delete, correct and to opt out of sale or sharing of personal information, and not to be discriminated against for exercising them. We do not sell or share personal information, so there is nothing to opt out of, but the other rights apply and the email address above is how you use them.

If you are in the UK or the EU, the UK GDPR and GDPR give you rights of access, rectification, erasure, restriction, portability and objection. Our lawful basis is performance of your contract for the order, and our legitimate interest in keeping the site secure and our records straight. You may complain to your local supervisory authority, though we would rather you came to us first.

Children

This site sells branded merchandise to businesses and organisations. It is not directed at children under 16 and we do not knowingly collect their personal information. If you believe a child has given us data, email us and we will delete it.

Security

Every page and form on this site is served over TLS. API keys and other secrets live as server-side secrets on the host and are never exposed to the browser or written to logs. Card data never touches our servers — the payment happens on Stripe’s own checkout.

Access to job records is limited to the people who need it to run an order. We make no claim to hold a security certification, because we do not hold one. No system is perfect; if something goes wrong that affects you, we will tell you.

International transfers

We are based in the United States, and our host, payment processor and fulfilment partner all process data in the United States and other countries. If you order from outside the US, your information is transferred there in order to fulfil your order. Where a transfer needs a legal mechanism, our processors rely on their own — including the Standard Contractual Clauses, published in the privacy policies linked above.

Changes to this policy

If what we do with data changes, this page changes with it, and the date at the top moves. We will not quietly start doing something this page says we do not do.

Contact

Any privacy question, request or complaint: hello@merchfly.app. Postal address on request.