Privacy Policy

Who we are and what this covers

Andrew Robert Soderberg, a Washington sole proprietor trading as Woodpunch's Graphics, is responsible for the processing described here. Woodpunch Platform operates fulfillment, downloads, support, reviews and software licensing. This notice covers those functions on platform.woodpunchsgraphics.com, the continuing graphicsmaker-web.azurewebsites.net address, our Shopify integrations and our Woodpunch's Graphics Support Discord application.

Our storefront, checkout, payment, marketing and advertising practices are also described in the store Privacy Policy. This notice describes platform and bot processing specifically; it does not mean storefront advertising or other provider processing is absent.

Privacy contact: contact@woodpunchsgraphics.com. Geographic business address: 123 Pete Beck Rd, Quilcene, WA 98376-8563, United States. Preferred mailing address: P.O. Box 143, Quilcene, WA 98376, United States.

Information we process

• Orders and delivery: contact details, customer and order identifiers, products and options, payment and fulfillment status, relevant country information, personalization text and files, generated graphics, download permissions and delivery activity. Payment providers handle payment credentials; the platform does not need your full card number.
• Support: messages, subjects, sender or account identity, conversation history, linked order details, replies, ticket status and automated or staff actions. Sources include storefront chat, Shopify customer accounts, support email and designated Discord support channels.
• Discord: user and display names; user, server, channel, message and interaction identifiers; ticket messages and edits; role selections; giveaway entries, winners and claims; and command activity needed for the features you use. Our ticket integration handles designated support channels, rather than all conversations across Discord.
• Reviews and questions: ratings, text, chosen display name, country and language where provided, media, purchase verification, helpful votes, merchant replies, moderation history and any disclosed reward. Published content and public profile information can be viewed and copied by others.
• Software, when offered: purchase entitlements, seats and assignee labels, device names, operating platform, hashed device fingerprints, application version, activation and last-use times, authorization requests, license and download grants, revocations and licensing audit events. A hashed identifier can still identify a person or device when linked to other records.
• Accounts and technical records: platform sign-in and security information, browser or device information, IP addresses processed with requests, timestamps, request identifiers and errors needed to secure and operate the service.

We receive information from you, Shopify, Discord, email providers, authorized staff and people acting on your behalf. Information necessary to verify ownership, deliver an order or authorize a license may be required for that feature; optional reviews, media and unrelated support details are voluntary.

Send only what is needed. Do not send passwords, authentication codes, payment-card details, government identification or unnecessary sensitive information in ordinary chat. Our automated email synchronizer imports normalized support-message text and metadata, not raw attachments; attachments can remain in the provider mailbox. Discord automation records an attachment indication rather than downloading attachment contents.

Purposes and legal bases

We use information to create and deliver products, restore eligible downloads, administer licenses, resolve support requests, operate requested Discord features, verify and publish reviews, send service messages, improve reliability, prevent fraud and unauthorized access, and meet legal obligations or handle claims.

Where a legal basis is required, we rely on contract or requested pre-contract steps for purchases, delivery, licensing and related support; legal obligations for required records and rights requests; and legitimate interests, balanced against your rights, for proportionate security, troubleshooting, service improvement, community administration and other inquiries. We use consent where required, including for optional marketing or nonessential tracking. Reading this notice is not blanket consent to unrelated processing.

AI and automated actions

Google's Gemini API helps process Discord, storefront, customer-account and email support. Inputs can include your message and subject, relevant recent conversation, limited verified order and personalization context, prior action results, and relevant product or support knowledge. Personal information you put in a message can reach Google; we do not promise that all names or email addresses are removed from message text.

AI can compose replies and propose or perform permitted actions, including order searches, delivery resends and ticket closure. Ownership and permission checks limit those actions. Eligible order-change proposals require confirmation through the signed-in customer account. AI can make mistakes. Ask for staff review or contact contact@woodpunchsgraphics.com for human assistance. Requesting a person does not erase earlier processing or guarantee that the initial message bypasses automation.

Gemini also summarizes published product reviews. Summaries are separate from original reviews and may be incomplete or inaccurate. We do not train our own AI models on Discord messages. Support requests disable optional interaction storage, but that is not a promise of zero provider retention: Google's applicable service terms describe its processing and safety logging.

These support tools do not decide eligibility for credit, employment or similar significant opportunities. Contact us for human review if an automated action affects your order or access.

Recipients and disclosures

• Microsoft Azure: hosting, databases, files, queues, security and diagnostics; Azure Communication Services delivers transactional and support email.
• Shopify: store and customer-account integration, order verification, fulfillment, relevant preferences and product information.
• Discord: community interactions, ticket channels, roles, giveaways and bot responses. Ticket content is available to people with channel access, including authorized staff and administrators; private channels are not end-to-end encrypted conversations.
• Google: Gmail receives and stores email and synchronizes designated support threads; Gemini processes the AI inputs described above.
• Authorized personnel and professional providers: necessary administration, support, security, legal and accounting assistance, limited by role and operational need.

We may disclose information as required by law, to protect people or the service, establish or defend rights, carry out a lawful business transfer with appropriate safeguards, or follow your directions. Reviews, giveaway announcements and other public posts are visible to their audience.

We do not sell Discord API data or use it for advertising, and do not sell private support conversations or license records for money. Storefront disclosures that may count as sale, sharing or targeted advertising under local law are addressed in the store Privacy Policy and its privacy-choice controls. Providers' own notices apply when they process data independently.

Cookies and browser storage

The platform uses necessary cookies for sign-in, security and short-lived page state. Storefront support uses browser storage to remember a conversation and browser identifier; session storage can retain an unsent or retrying message and whether chat is open. Review controls can store a browser identifier to limit duplicate helpful votes. These identifiers do not establish order ownership.

Clearing storage can remove local preferences and access to a guest conversation, but does not delete server records. Clear local data appropriately on shared devices. Blocking necessary storage can prevent a requested feature from working. Shopify manages storefront cookie and advertising choices separately.

Retention and deletion

We retain information while needed for its purpose, subject to applicable deletion rights. Current routine schedules include:

• Generated order files are generally scheduled for removal from fulfillment storage after 365 days. A download link can expire earlier or have use limits; link expiry is not file deletion.
• Archived support tickets normally remain for 365 days. Open tickets remain while needed to resolve the request. Closing or archiving a ticket does not immediately delete it.
• Completed support delivery records normally remain for 30 days, failed operational records for up to 180 days, and support deletion tombstones for 365 days. Some failed Discord transport messages expire after seven days. Outstanding work can remain until resolved.
• Application diagnostics normally remain for 30 days for web, Discord and email services and 90 days for workflows. Related security records, backups and incident evidence can follow separate schedules.
• Order, entitlement, tax, consent and dispute records remain while necessary for ongoing obligations, licensing, choices, applicable recordkeeping or legal claims. Reviews may remain while published or needed to verify authenticity; giveaway records remain while needed to administer and document the promotion.

Routine schedules do not override an earlier deletion required by law or Discord's terms. Removing active records does not instantly erase provider mailboxes, isolated backups, others' copies or independently controlled records. Retained copies are restricted and removed or allowed to expire when their lawful purpose ends. Limited suppression and deletion evidence may remain to honor a request and prevent unwanted recreation.

Your rights and choices

Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, an appeal of a denied request, and relevant advertising opt-outs. Authorized agents may act where permitted. Withdrawal does not invalidate earlier lawful processing. We will not unlawfully discriminate against you for exercising a right.

Email contact@woodpunchsgraphics.com with the relevant service and account email or Discord user ID. Do not send a password or token. We may need proportionate verification of identity or authority and will explain applicable limitations, extensions or refusals. We delete Discord data when required by Discord's terms, including an applicable user request, except information the law requires us to retain.

Removing the bot, leaving a server, clearing cookies or deleting an account elsewhere does not automatically remove every record we hold. Contact us for a platform-wide request. You may complain to the regulator available where you live, including your EEA data protection authority or the UK Information Commissioner's Office.

Children and restricted features

Our graphics storefront serves a general audience and may appeal to teens. A parent or guardian should place or authorize a minor's purchase and related communications. We do not offer accounts or support for children under 13 to use independently and do not knowingly collect their information contrary to applicable law.

Discord's minimum-age rules apply. Our Discord AI support ticket channels are designated age-restricted; AI-assisted support is intended for adults aged 18 or older. Do not bypass an age restriction. A parent or guardian can contact us on a minor's behalf. Contact us if you believe a child's information was collected improperly so we can investigate and take the required steps.

Security and international processing

We use access controls, encrypted transport and storage, restricted cloud access, secret management and monitoring. No service is perfectly secure. We are based in the United States; providers may process information there and in other countries where they operate.

Where law restricts a transfer, the applicable arrangements must provide the required protection, such as an applicable adequacy decision or contractual safeguards. Contact us for information about arrangements applicable to your data and a copy of relevant safeguards, subject to protection of confidential information.