Gang Sheets terms for shops

1. Who these terms are between

1.1 These terms are between Layout Foundry (“we”, “us”) and the business that installs Layout Foundry Gang Sheets on its Shopify store (“you”). Layout Foundry is a trading name. The person who provides the app, and the address for notices, are given in the final section of our privacy notice.

1.2 By installing or using the app you accept these terms on behalf of your business. You confirm that you are acting for a business and not as a consumer.

1.3 Shopify's own terms continue to govern your use of Shopify. These terms cover the app only.

2. What the app does

2.1 The app adds a gang sheet builder to your store. Your customers add their designs, and the designs are arranged on your film width in an efficient layout in the customer's own browser. The customer approves a preview, and we store the approved print file so that you can download it from the order.

2.2 Layouts come from a heuristic packing method. We do not promise that a layout uses the least possible film.

2.3 The app shows warnings, for example for low resolution. Warnings are guidance only. You remain responsible for checking every print file before you print it.

3. Price

3.1 The app is free. While it is free, each store has a fair-use allowance of up to 2,000 metres of builder sheets each calendar month. We may lower this limit for a period to keep the service within its running costs. The current limit is always shown in the app.

3.2 We will not charge you anything without first giving you at least 30 days' notice and asking you to approve the charge through Shopify's billing system. You may uninstall the app instead.

4. Your responsibilities

4.1 You are responsible for:

• the products, prices and quantities you set in your store;
• checking each print file before printing, including its size, resolution and content;
• your contracts with your customers, including refunds and delivery;
• the lawfulness of the designs you accept and print, including rights in any third-party images, trade marks or characters;
• responding to requests from your customers about their personal data, with our help as set out in section 12.

4.2 You must not use the app to store or process material that is unlawful, or that infringes another person's rights.

5. Files and how long we keep them

5.1 Print files, cut line files and preview images are stored for 14 days from the time your customer approves the sheet, then deleted automatically. Download links stop working at the same time.

5.2 You are responsible for downloading and keeping any file you need after 14 days. We do not keep copies after deletion and cannot restore deleted files.

5.3 If you switch on “Let shoppers keep sheets to reorder” in the app's settings, a customer can tick a box to keep a sheet so they can order it again. We then keep a copy of that sheet's print files and preview for 180 days from its last order (or 14 days from when it was kept, if it is never ordered), and delete it after that. The customer can delete a kept sheet at any time. A kept sheet is also deleted when you delete the sheet in the Print queue, when Shopify sends customers/redact for that customer or order, when you uninstall the app, or at the next daily clean-up after you switch the setting off. We keep at most 200 kept sheets for each store. This option is off unless you switch it on.

6. Personal data

6.1 You are the controller, and we are your processor, for personal data in the files your customers upload and in the order references the app keeps. The data processing agreement in section 12 forms part of these terms.

7. Takedown requests

7.1 If someone tells us that a stored file infringes their rights or is unlawful, we may delete the file. We will tell you when we do so, unless the law prevents it.

7.2 You can delete any sheet's files yourself at any time with “Delete files now” in the app's Print queue.

8. Availability and changes

8.1 We aim to keep the app available but do not promise that it will be uninterrupted or free of errors. We may pause new sheets during maintenance or if running costs pass our limits.

8.2 We may change the app or these terms. For a change that reduces what the app does for you, we will give at least 30 days' notice in the app or by email.

9. Liability

9.1 Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.

9.2 Subject to clause 9.1, we are not liable for:

• loss of profit, revenue, business, goodwill or anticipated savings;
• the cost of film, ink, garments, labour or reprints;
• loss or corruption of data, including files deleted in line with section 5;
• any indirect or consequential loss.

9.3 Subject to clause 9.1, our total liability to you arising out of or in connection with these terms and the app, in contract, tort (including negligence) or otherwise, is limited to the greater of: (a) the fees you paid us for the app in the 12 months before the event giving rise to the claim; and (b) £100.

9.4 The app is provided free of charge. The limits in this section reflect that price and the fact that you check every file before printing.

10. Ending these terms

10.1 You may stop using the app at any time by uninstalling it. When you uninstall, we delete your access token at once. Shopify asks us to delete the rest of your store's data 48 hours later, and we do so.

10.2 We may stop offering the app with 30 days' notice, or at once if you break these terms in a serious way.

11. General

11.1 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

11.2 If any part of these terms is found unenforceable, the rest remains in force.

11.3 Questions about these terms, and notices under them, can be sent to the correspondence address in the final section of our privacy notice.

12. Data processing agreement

This agreement forms part of these terms. In it, you are “the Controller” and Layout Foundry, as identified in clause 1.1, is “the Processor”. It is written to meet Article 28(3) of the UK GDPR.

12.1 Scope and details of the processing

The Processor processes personal data only to provide Layout Foundry Gang Sheets to the Controller under these terms.

• Subject matter: storage of the gang sheet print files and preview images that the Controller's customers approve in the builder, and their link to the Controller's orders.
• Duration: until the files are deleted, 14 days after upload, or earlier on the Controller's instruction. Where the Controller switches on kept sheets and a customer chooses to keep a sheet for reordering, its copy is kept until 180 days after the last order of that sheet, or earlier when the customer or the Controller deletes it (clause 5.3).
• Nature and purpose: storing files, linking them to orders, giving the Controller download links, answering Shopify's privacy requests and limiting uploads to keep the service available; where the Controller switches it on, keeping the sheets customers choose to keep so they can order them again.
• Personal data: images the customer uploads, which may show people or contain names; the Shopify customer id when the customer is signed in; the Shopify order id and order number; and a keyed code made from the shop and the visitor's IP address, used to count uploads. The IP address itself is not stored, and each count is deleted within about a day. For a kept sheet (clause 5.3): the Shopify customer id of a signed-in customer, or a coded copy (a SHA-256 hash) of the private reorder link given to a customer who is not signed in, and the ids of the orders that included the sheet.
• Data subjects: the Controller's customers, and any person shown in an uploaded image.
• Special category data: not intended. An uploaded image could reveal special category data; the Processor does not analyse image content.

Designs are arranged in the customer's browser. The Processor receives only the final print file and a preview image, after the customer approves the sheet. The Processor does not receive customer names, email addresses, postal addresses or payment details.

12.2 Processor obligations

The Processor will:

1. process personal data only on the Controller's documented instructions, which are these terms, this agreement and the Controller's use of the app's settings and actions, including for any transfer outside the UK, unless the law requires otherwise (in which case it will tell the Controller first, unless the law prohibits that). It will tell the Controller at once if it believes an instruction breaks data protection law;
2. ensure that anyone authorised to process the data is bound by confidentiality;
3. take the security measures in clause 12.4;
4. use sub-processors only as set out in clause 12.3;
5. help the Controller, as far as possible, to answer requests from data subjects. When Shopify sends a customers/data_request, the app lists the sheets and orders that relate to that customer on its Gang sheets page, with download links for the files it still holds; the list is cleared after 30 days. When Shopify sends a customers/redact, the app deletes that customer's files and the files for the orders Shopify lists. The Controller can also delete any sheet's files from the Print queue;
6. help the Controller meet its duties on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing;
7. delete all personal data at the end of the service. Files are deleted 14 days after upload, except a sheet a customer chose to keep for reordering, which is deleted 180 days after its last order, and at once when the app is uninstalled (clause 5.3). All remaining data for a store is deleted when Shopify sends shop/redact, 48 hours after the app is uninstalled. Weekly database backups hold records, never files, and each backup is deleted about 14 days after it is made, so a deleted record can remain in a backup for up to 15 more days. The Controller can download any file it wants to keep before it is deleted;
8. make available the information needed to show compliance with this agreement, and allow for and contribute to reasonable audits, on 30 days' notice and at the Controller's cost.

12.3 Sub-processors

The Controller gives general authorisation for these sub-processors:

• Cloudflare, Inc.: hosting (Workers), database (D1) and file storage (R2). Cloudflare runs a global network; Cloudflare, Inc. is based in the United States.
• Shopify: the Controller's own platform, which carries the order data and privacy requests, under the Controller's agreement with Shopify.

The Processor will give at least 30 days' notice of a new sub-processor. The Controller may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Controller may stop using the app. The Processor will impose data protection terms on each sub-processor that give at least the protection required by this agreement.

12.4 Security measures

• Cloudflare encrypts the stored files and database records at rest with AES-256. Traffic between the customer's browser, Shopify, the app and the storage uses TLS (HTTPS).
• Shopify access tokens are also encrypted by the app before they are stored (AES-GCM).
• Files are stored in a private bucket. Downloads use links signed with a secret key, limited to one file and valid only until the file's deletion date.
• Uploads use presigned links that are valid for 10 minutes and fix the file type and size.
• Every request from Shopify is checked for a valid signature (app proxy, webhooks and admin session tokens).
• Only the account owner can sign in to the hosting account.
• Files and the database rows linked to them are deleted automatically after 14 days, or 180 days after the last order for a sheet the customer chose to keep for reordering (clause 5.3).

12.5 Personal data breaches

The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own duties.

12.6 International transfers

The Processor will transfer personal data outside the UK only with appropriate safeguards under Chapter V of the UK GDPR. Transfers to Cloudflare, Inc. rely on the UK Extension to the EU-US Data Privacy Framework, with which Cloudflare complies, and otherwise on the EU standard contractual clauses as amended by the UK Addendum, both as set out in Cloudflare's data processing addendum.

12.7 General

If this agreement conflicts with the rest of these terms on data protection, this agreement prevails. This agreement is governed by the law of England and Wales.