Privacy Policy

Effective date: July 23, 2026

This Privacy Policy explains how Andrew Robert Soderberg, a Washington sole proprietor doing business as Woodpunch's Graphics ("Woodpunch's Graphics," "we," "us," or "our"), collects, uses, discloses, and retains personal information when you visit woodpunchsgraphics.com, buy or download our digital products (including software plug-ins when offered), use an account, submit personalization content, request support or withdrawal, post a review, or otherwise interact with us (collectively, the "Services").

1. Who controls your information

Woodpunch's Graphics is the controller of the personal information described in this Policy unless another service is identified as acting independently.

Contact:

• Email: contact@woodpunchsgraphics.com
• Geographic business address: 123 Pete Beck Rd, Quilcene, WA 98376-8563, United States
• Preferred mailing address: P.O. Box 143, Quilcene, WA 98376, United States

Representative appointment information appears in Section 15.

2. Information we collect

The information depends on how you use the Services.

Information you provide

• Identity and contact information: name, email address, billing address, country or region, telephone number if you choose or are required to provide it, account details, and gaming, server, channel, or social-media names.
• Order and transaction information: products and options selected, order number, discounts, payment status, billing and tax information, fraud-review status, refund and withdrawal information, and transaction communications. Payment providers receive payment-card or account details; we generally receive confirmation and limited payment metadata rather than full card numbers.
• Personalization content: wording, colors, product selections, logos, images, files, and other content you submit so that we can create your graphics.
• Generated and delivered content: finished graphics, previews, editable files when purchased, download links, delivery status, and technical generation records.
• Software purchase and support information: purchased software and version, license or entitlement status, delivery and activation status when applicable, and operating-system, hardware-architecture, host-application, error, crash, or diagnostic information that you choose to provide for support.
• Account and preference information: account settings, language, country, cookie choices, marketing consent, and communication preferences.
• Support and community information: emails, contact-form submissions, Shopify Inbox chats, Discord user identifiers and messages when you contact us there, attachments, order details linked to a support request, and our responses.
• Reviews and public content: rating, review text, display name, images or video you choose to include, and review-verification information.
• Withdrawal requests: name, email, optional order number, selected items or contract, optional message, language, timestamps, request status, and evidence needed to administer the request.

Please do not submit sensitive personal information that is unnecessary for your order or request. If submitted content contains another person's personal information, you must have authority to provide it.

Information collected automatically

We and our service providers may collect:

• IP address, approximate location derived from IP, device and browser information, operating system, language, referral source, pages and products viewed, searches, cart and checkout activity, purchases, clicks, email opens and clicks, cookie or device identifiers, and diagnostic or security events;
• information needed to prevent fraud, abuse, unauthorized downloads, and account compromise; and
• interaction data used for analytics, attribution, store improvement, marketing segmentation, and advertising where permitted.

We use cookies, pixels, local storage, and similar technologies. See Section 8.

Information from other sources

We may receive information from Shopify and its services, payment providers, advertising or referral partners, app providers, review platforms, fraud-prevention providers, and people who buy a product for you or contact us about a shared project.

3. Why we use personal information

We use personal information to:

• process payments, review fraud risk, accept or decline orders, calculate tax, and keep transaction records;
• create personalized graphics, process uploaded content, render files, provide instant downloads, send delivery emails, manage download limits, and restore eligible prior downloads;
• deliver purchased software, administer any disclosed license entitlement or activation process, provide necessary or promised updates, and troubleshoot installation, compatibility, activation, security, and support issues;
• operate accounts, the storefront, checkout, search, recommendations, product options, forms, post-purchase pages, and customer support;
• correct errors, troubleshoot delivery, resend files, handle refunds, chargebacks, complaints, and statutory withdrawal requests;
• send service and transaction communications;
• send marketing when you have subscribed or when otherwise permitted by applicable law, measure engagement, create customer segments, and personalize marketing;
• collect, verify, publish, and moderate reviews;
• analyze and improve products, content, storefront performance, support, and customer experience;
• detect, investigate, and prevent fraud, security incidents, prohibited conduct, infringement, and abuse;
• comply with tax, accounting, consumer-protection, privacy, sanctions, and other legal obligations; and
• establish, exercise, or defend legal claims and enforce our terms.

Contact, order, payment-confirmation, and requested personalization information marked as required is necessary to enter into and perform the purchase contract. Without it, we may be unable to accept, create, or deliver the order. Marketing signup, non-essential cookies, optional review media, and optional support details are voluntary.

4. Legal bases for users in the EEA, UK, and similar jurisdictions

Where a legal basis is required, the principal mapping is:

Purpose	Legal basis
Take requested pre-contract steps; accept payment; create, deliver, correct, or restore a product; administer an account; provide requested support; handle a cancellation, refund, or contractual request	Contract
Keep required tax and accounting records; administer statutory withdrawal and consumer remedies; respond to privacy rights and lawful requests; comply with sanctions or other legal duties	Legal obligation
Secure the Services; prevent and investigate fraud, abuse, infringement, and incidents; maintain accurate operational records; improve products and support; perform limited business analytics; enforce or defend legal rights; respond to non-marketing communications	Legitimate interests, balanced against your rights
Send marketing where consent is required; load non-essential cookies or tracking where consent is required; publish optional review media where applicable; perform another activity for which we specifically request permission	Consent, which you may withdraw prospectively

We do not rely on legitimate interests to override a consent requirement imposed by electronic-marketing or cookie law.

5. Automated tools and profiling

We use automated systems to render products, detect fraud, restore and deliver downloads, tag customers by purchased product interests, create marketing segments, and trigger marketing messages for subscribers based on events such as browsing, cart activity, checkout activity, purchases, or segment membership.

Automated fraud signals may place a transaction on hold, but Woodpunch's Graphics does not make a final cancellation decision solely through automated processing. Payment providers may independently decline transactions under their own fraud systems. Contact us to request review or provide additional information.

6. How we disclose information

We disclose only information reasonably needed for the relevant purpose. Providers may act as our processors, as independent controllers under their own notices, or both depending on the service.

Recipient or category	Purpose and information involved
Shopify and Shopify services, including Payments, customer accounts, Messaging, Forms, Inbox, Flow, Search & Discovery, Shop, Agentic Storefronts, Knowledge Base, Translate & Adapt, Bundles, and Checkout Blocks	Hosting and operating the store, checkout and payments, accounts, communications, forms, search and recommendations, fraud prevention, analytics, marketing automation, support, post-purchase pages, language, and sales channels. Shopify may process identity, contact, transaction, device, usage, consent, and communication data.
Shopify Network Intelligence	When enabled, Shopify combines protected data across its network to provide enhanced fraud protection, personalization, store performance, and advertising features. For Enhanced Services, Shopify may act as an independent controller. See the Shopify Consumer Privacy Policy and Shopify Privacy Portal to learn about and exercise rights directly with Shopify.
Payment providers shown at checkout	Payment authorization, fraud prevention, refunds, disputes, and legal compliance.
Graphics Maker (our private fulfillment system), Microsoft Azure, and Twilio SendGrid	Order verification, render queues, cloud storage and databases, generation of personalized graphics, secure download delivery, customer review and question collection, verified-purchase matching, moderation, public review display, review invitations, reward administration, operational logs, and transactional email.
Leap Auto Tags, Shopify Flow, and Shopify Messaging	Purchase-interest tags, customer segments, marketing eligibility, and automated subscriber communications.
Revoq - EU Withdrawal Button	Receipt, confirmation, recordkeeping, and administration of statutory withdrawal requests. Revoq acts as a processor on our instructions for this function.
Google & YouTube, Google Forms, and Google advertising services	Product-channel functions, conversion and advertising measurement, advertising where enabled, video content, an optional suggestion form, and related device, usage, referral, form, and transaction events. Embedded Google content is click-to-load where described below. Google may act as an independent controller for some services.
ShareThis	Optional social-sharing buttons and a cumulative share count. First-party sharing controls remain available without ShareThis. We do not request the ShareThis script unless the visitor affirmatively confirms that they are at least 16, accepts optional Marketing in Shopify's Cookie preferences, has not opted out of sale or data sharing, and chooses to show the count. We also block it for Global Privacy Control, refusal or withdrawal, unknown regions, and UK visitors. If enabled, ShareThis can receive device, browser, IP, page-view, interaction, cookie, advertising, profiling, and audience-segment data under its own privacy notice and states that it may license pseudonymous data for targeted advertising and other purposes. ShareThis may act as an independent controller for its own processing.
Discord, YouTube, and Vimeo	Community support or external content that you choose to use, and embedded content where displayed. Article embeds are click-to-load and YouTube uses its privacy-enhanced domain. These providers receive device and usage data only after you activate their content or visit them, plus information you submit directly to them.
OpenAI and controlled administrative tools	Limited, human-directed business administration, technical support, policy, or store operations. We minimize customer data and do not intentionally provide customer data unless needed for the task.
Technical and catalog tools such as Hextom, Shopify CLI Connector, our private Shopify administration app, and SimGym	Product, theme, catalog, testing, and controlled store administration. Access is limited by granted permissions and operational need.
Professional advisers, authorities, and transaction parties	Legal, accounting, insurance, security, tax, regulatory, lawful-request, dispute, financing, sale, reorganization, or succession purposes.

We may disclose information when you direct us to, to protect a person or the Services, or when required by law. We do not disclose sensitive personal information to infer characteristics about you.

7. Sale, sharing, and targeted advertising

We do not sell customer names, contact details, payment details, personalization uploads, or order files for money. Some disclosures of browsing, device, advertising, or pseudonymous identifier data to Shopify Network Intelligence, Google, ShareThis, or advertising partners may be considered a "sale," "sharing," or targeted advertising under certain U.S. state laws even when no money changes hands.

Where applicable, you may opt out through our Your Privacy Choices page. We process supported Global Privacy Control signals through Shopify as an opt-out for the browser and device that sends the signal. Our ShareThis loader also checks the signal and Shopify's relevant permissions before making a ShareThis request. A later refusal, withdrawal, or age-confirmation removal cancels pending activation and reloads the page if needed to stop already-loaded ShareThis code. Cookie choices do not necessarily remove information a third party lawfully received before your withdrawal, and you may need to use that party's controls as well.

We do not knowingly sell or share for targeted advertising the personal information of anyone under 16.

8. Cookies and similar technologies

We use:

• necessary technologies for storefront operation, security, checkout, accounts, consent choices, fraud prevention, and delivery;
• functional technologies for preferences and enhanced features;
• analytics technologies to understand use and performance; and
• advertising technologies for attribution, audience measurement, and advertising.

Where law requires consent, consent is the intended basis for non-essential technologies. You can use the cookie banner or preferences link where available, the Your Privacy Choices page, browser controls, and provider-specific opt-outs. Blocking necessary technologies may prevent parts of the Services from working.

Third-party scripts and embeds can transmit your IP address and device or page information when they load. Current storefront integrations can include Shopify pixels, Google & YouTube, consent-gated ShareThis, deferred YouTube or Vimeo players, a click-to-load Google Forms suggestion form, and a Font Awesome asset kit. Published article embeds for YouTube and Discord are click-to-load, the active external product video is deferred until activation, and the contact-page Discord widget is disabled.

ShareThis: Privacy-preserving first-party Facebook, X, email, Reddit, WhatsApp, and copy-link controls are available without loading ShareThis. To display ShareThis's cumulative count and buttons, a visitor must accept optional Marketing in Shopify's Cookie preferences, not have opted out of sale or data sharing, confirm being at least 16, and choose to show the count. ShareThis remains blocked for Global Privacy Control, refusal or withdrawal, unknown regions, and UK visitors. Withdrawal after activation removes the loader and reloads the page if necessary to stop ShareThis code.

ShareThis applies its own privacy notice and controls to information it already received. You can review them at ShareThis Privacy and ShareThis Data Privacy Rights.

9. Marketing communications

We send promotional email only to recipients recorded as eligible under our settings and applicable law. Marketing may reflect products purchased, browsing, cart or checkout activity, and customer segments. You may unsubscribe through any marketing email or contact us. Unsubscribing does not stop necessary order, account, security, withdrawal, or support communications.

Review invitations may be sent after an order. Where an invitation is marketing under applicable law, we send it only when permitted and honor applicable opt-outs.

Right to object to direct marketing: You may object at any time to our use of your personal information for direct marketing, including related profiling. After you object, we will stop using it for those purposes.

10. Public reviews and external services

Reviews, ratings, chosen display names, and media submitted for public posting can be viewed and copied by others. Do not include information you do not want public.

Links and embedded services are operated by third parties. Their privacy practices apply to information they collect independently. Shopping through ChatGPT, Microsoft Copilot, Shop, or another agentic storefront may also involve that provider's own collection before you reach or buy from us.

11. Retention

We keep information only as long as reasonably needed for the purposes described above, considering the nature of the data, legal duties, security, disputes, and available deletion controls. Current examples include:

• personalization inputs and generated outputs stored in Graphics Maker fulfillment storage are generally deleted or expire after 30 days, and download links are normally limited to three downloads during that period. This lifecycle does not necessarily delete copies retained in Shopify order records or by another provider under its documented retention schedule;
• Revoq withdrawal records are configured for automatic deletion after 24 months, although we may retain related transaction, correspondence, or legal evidence separately;
• primary order, payment, refund, tax, consent, and accounting records are kept for the period required by applicable tax, accounting, consumer-protection, audit, dispute, and enforcement obligations. We review and delete or anonymize records when those purposes no longer require identifiable information and provider controls permit it;
• software purchase, entitlement, activation, deactivation, and version records, if collected, are kept while reasonably needed to deliver and administer the license, provide updates and support, prevent unauthorized use, document the transaction, resolve disputes, and meet legal obligations;
• marketing subscription records are kept while subscribed; opt-out or suppression information may be kept to honor the choice;
• reviews may remain while published or while needed to document authenticity, subject to applicable rights and legal exceptions;
• support, Discord, Inbox, and fraud records are kept while needed to provide support, maintain security, resolve disputes, improve operations, or meet legal obligations; and
• system logs and backups expire or are overwritten on operational schedules unless preserved for an incident or legal need.

Deleting information from active systems may not immediately remove it from encrypted backups, but backup copies are isolated and expire under applicable schedules. Third-party providers apply their own retention where they act independently.

12. Security

We use administrative, technical, and organizational safeguards appropriate to the information and our operations, including access controls, encrypted transport, secret management, restricted cloud resources, logging, and service-provider controls. No system is perfectly secure. Do not send unnecessary sensitive information through ordinary email, chat, or Discord.

13. Your privacy rights

Depending on where you live, you may have rights to:

• access or know about personal information and disclosures;
• correct inaccurate information;
• delete information;
• receive portable information;
• restrict or object to processing;
• withdraw consent prospectively;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• appeal a denied request;
• use an authorized agent; and
• complain to a privacy regulator.

You may submit a request at contact@woodpunchsgraphics.com or through an applicable store privacy control. We may verify identity and authority, limit a request as permitted by law, and retain information needed for legal obligations, security, fraud prevention, transaction records, or legal claims. We will not discriminate against you for exercising a right.

EEA and UK users may complain to the supervisory authority where they live or work, or where an alleged infringement occurred. California and other eligible U.S. residents may use the Your Privacy Choices page or Global Privacy Control for applicable opt-outs.

14. Children

The Services are general-audience services. They may appeal to teens because they include graphics for gaming, streaming, and online communities, but they are not intended for children to submit personal information, create accounts, place orders, upload personalization content, post reviews, or contact support independently. If a person is under the age of legal majority where they live, a parent or legal guardian should review the Services and place or expressly authorize the order and related communications.

We do not knowingly collect personal information directly from a child under 13 without verifiable parental consent or another permission recognized by applicable law. Where consent is the legal basis for an online service offered directly to a child, the child must be old enough to provide their own consent under the law that applies to them; otherwise, consent or authorization must come from a person with parental responsibility and may need to be verified.

ShareThis is not requested unless a visitor affirmatively confirms being at least 16 and the other privacy conditions described above are satisfied. This self-confirmation is a risk-reduction control rather than independent age verification, so we keep ShareThis disabled for anyone actually known to be under 16 and for UK visitors. We do not knowingly authorize sale or sharing for targeted advertising of personal information from anyone under 16. Google Gemini support processing is limited to Discord support channels that Discord designates as age-restricted. For that triage, we provide the support conversation, limited linked-order information, action-usage limits, and relevant public product data. We do not provide customer names, email addresses, payment data, billing or shipping addresses, unrelated customer records, or internal business records. Messages from email, the storefront, and non-age-restricted Discord channels are routed to human support without Gemini.

If we learn that we collected personal information from a child contrary to applicable requirements, we will take reasonable steps to delete it or obtain the required authorization. A parent or guardian may contact us.

15. International transfers and representatives

We are based in the United States. Information may be processed in the United States, Canada, the European Economic Area, the United Kingdom, and other countries where our providers operate. Where a restricted international transfer occurs, we use the transfer safeguards applicable to the provider and service, which may include an adequacy decision, the EU Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, or another lawful mechanism. You may request information about, or a copy of, an applicable transfer safeguard by emailing contact@woodpunchsgraphics.com. We may redact confidential commercial information.

We are in the process of appointing an EEA representative and a separate UK representative. Until their contact details are published here, contact the U.S. controller directly using Section 17. This statement does not replace an appointment required by law.

16. Changes

We may update this Policy to reflect changed practices or legal requirements. We will post the revised version, change the date above, and provide any additional notice or request any renewed consent required by law. Material changes apply prospectively unless law permits otherwise.

17. Contact and complaints

Email: contact@woodpunchsgraphics.com
Geographic business address: 123 Pete Beck Rd, Quilcene, WA 98376-8563, United States
Preferred mailing address: P.O. Box 143, Quilcene, WA 98376, United States

Please write "Privacy Request" in the subject line when practical. If we cannot resolve a complaint, you may contact the regulator available where you live.