1. Who is responsible
Prep to Pop, [to be completed], is responsible for the personal information described here. Contact us at support@preptopop.com.
2. What we collect
- Account details — your email address, name, and the business type you choose at sign-up.
- What you tell us about your business — the description, industry and preferences you enter to generate a brand or a website.
- What you make — brands, website drafts, page content and print designs.
- Files you upload — logos and photographs you add to a design.
- Order details — what you ordered, the artwork attached to it, your delivery address, and the last four digits and card brand shown to us by Stripe.
- Messages — enquiries sent to us, and messages sent through a contact form on a site published here.
- Technical data — IP address, browser type and pages requested, kept in server logs for security and debugging.
We do not collect payment card numbers. Those go to Stripe directly and never reach our servers.
3. Why we use it
- To run your account and keep your work available to you.
- To generate the designs, copy and websites you ask for.
- To produce, ship and support your print orders.
- To take payment and keep the records tax law requires.
- To send service email — order confirmations, shipping notices, billing and security notices. These are not marketing and cannot be turned off while you have an account.
- To keep the service secure and diagnose faults.
We only send marketing email if you ask for it, and every such email carries an unsubscribe link.
4. What goes to an AI provider
When you generate a brand, website copy or a design, the business description and preferences you entered are sent to OpenAI to produce that output. Do not paste anything confidential — customer lists, personal details of other people, unpublished plans — into those fields.
Uploaded photographs and logos are stored by us and are not sent for AI image generation; this service does not generate images.
5. Who else processes it
These are the companies that handle data on our behalf, and what each one does:
- Supabase — database, file storage and authentication.
- Vercel — hosting and delivery of the app and published sites.
- Stripe — payment processing, including card data we never see. Stripe is a controller in its own right for fraud prevention.
- Resend — sending transactional email.
- OpenAI — generating brand and website content from what you enter.
- Unsplash — supplying the stock photographs offered in the editors.
We share information with them only so far as they need it to do that job. We do not sell personal information, and we do not share it for advertising.
We may disclose information where the law requires it, and to a buyer if the business is sold — in which case this policy travels with the data.
6. Messages sent to your published site
If you publish a site with a contact form, the people who fill it in are your contacts, not ours. We store those messages so we can show them to you and hold them on your behalf — you decide what to do with them, how long to keep them, and you are responsible for handling those people’s information lawfully.
If one of your visitors asks us to delete a message they sent you, we will pass the request to you.
8. How long we keep it
- Account and design work — while your account is open, and for 30 days after you close it, then deleted.
- Order records and invoices — seven years, because tax and accounting rules require it.
- Print artwork — two years after an order, so a reprint is possible without re-uploading.
- Server logs — 90 days.
9. Your rights
You can ask us for a copy of your information, to correct it, to delete it, or to stop a particular use of it. Email support@preptopop.com and we will answer within 30 days. We may need to confirm who you are first.
Deleting your account deletes your brands, drafts and published sites. Order records are kept for the period above because we are required to keep them.
Depending on where you live you may also have the right to complain to a data protection authority, and to opt out of any sale or sharing of personal information — there is nothing to opt out of here, because we do neither.
10. Where it is held
Our providers store data in the United States. If you are outside the US, using the service means your information is transferred there and handled under US law.
11. Children
This is a service for businesses and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.
12. Security
Data is encrypted in transit, access to production systems is limited to those who need it, and files are held in access-controlled storage. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authority where the law requires it.
13. Changes
If this policy changes, the effective date at the top changes with it, and we will notify you of anything material by email or in the app.
14. Contact
support@preptopop.com — Prep to Pop, [to be completed].
Also here: Terms of Service · Refunds & Returns · Privacy Policy