Privacy Policy

1. Who we are

Sigmira ("Sigmira", "we", "us", "our") is the controller responsible for the personal data described in this notice, except where we act as a processor on behalf of our merchant customers (see Sections 2 and 8).

• Controller: Quincy van der Ree, trading as Sigmira, a sole proprietorship (eenmanszaak) established in the Netherlands
• Chamber of Commerce (KvK): 82195757
• VAT (BTW): NL003652487B20
• Registered address: Verdiweg 671, 3816 KW Amersfoort, The Netherlands
• Privacy / contact email: hello@sigmira.com

Data Protection Officer (DPO). We have assessed our processing against Article 37 GDPR and concluded that we are not required to appoint a statutory Data Protection Officer. Our core activities do not consist of large-scale systematic monitoring or large-scale processing of special-category data. We have therefore not appointed a DPO. For all privacy matters, please use the contact point above: hello@sigmira.com.

2. Scope of this notice

This notice explains how we handle personal data of:

• Website visitors: people who visit our website and marketing pages (including our demo store);
• Prospective customers: people and businesses who contact us, request information, or start a trial;
• Active customers / merchants: the online merchants (businesses and individuals) who subscribe to and use the Sigmira platform. This includes merchants on Shopify (through the Sigmira app in their Shopify admin) and on WooCommerce (through the Sigmira plugin), and the merchant dashboard at app.sigmira.com.

Our dual role: controller and processor

Sigmira operates a SaaS "product customizer" platform that online merchants embed in their Shopify or WooCommerce stores. Their shoppers can then personalise products, by adding text in the merchant’s chosen fonts and uploading images or photos, and the merchant receives a print-ready file for each order.

• We are the controller for: (a) merchant and customer account data (registration, login, billing administration, support), and (b) website-visitor data. This notice governs that processing.
• We are a processor for the design content that a merchant’s own shoppers submit through the embedded customizer. This includes uploaded images and photos, entered text and monograms, the generated design and print files, and the order contact details the merchant’s store passes to us. For that content, the merchant is the controller, and Sigmira processes it only on the merchant’s instructions (see Section 8).

Our processor relationship with each merchant is governed by our Data Processing Agreement (DPA), summarised in Section 8. If you used a customizer on a merchant’s store and want to exercise your data rights over your design content, please contact that merchant: they are the controller of that content. For processing in our processor role, the DPA governs if it conflicts with this notice.

One exception: designs and any orders placed on our own demo store (demo.sigmira.com) are processed by Sigmira as controller, because the demo store is ours. Uploaded images and print files follow the retention in Section 7. The demo store’s own order records (name, email) are deleted on request.

3. Categories of personal data we collect

As a controller, we collect and process the following categories of personal data:

• Account data: your name, business or company name, and email address.
  • WooCommerce merchants: we receive these when you sign up through the checkout handled by Paddle.
  • Shopify merchants: we receive the shop’s name, domain and contact email from Shopify when you install the Sigmira app.
• Authentication data: you do not set a Sigmira password.
  • WooCommerce merchants sign in from their store’s admin, which hands them a short-lived signed session (see Section 15 for the session cookies). When you sign in this way, we record your IP address and a hashed fingerprint of your browser as a security audit record.
  • Shopify merchants use Sigmira inside the Shopify admin, which proves who you are to us with Shopify’s own session tokens.
  • Our own staff sign in with passwords, which are stored hashed.
• Billing and subscription data: your subscription plan and status, licence key, trial, cancellation and renewal dates, and billing references (such as transaction or charge identifiers and any purchased order credits). We do not collect or store payment card details.
  • WooCommerce merchants: card details, VAT numbers, postal address and phone number are collected and processed by Paddle.
  • Shopify merchants: you pay through your Shopify bill, and payment details stay with Shopify (see Sections 5 and 9).
• Store connection data: the URL of the store you connect, the platform it runs on, connection keys or access tokens that secure the link between your store and Sigmira, and connection-status signals (a periodic "heartbeat"). Records of domain changes and account transfers are kept as audit records.
• Settings and configuration: your editor and export settings and other configuration you save in the dashboard.
• Integration data:
  • Dropbox: if you connect it, we store your Dropbox account identifier, account name or email, and encrypted access tokens.
  • Outbound webhooks: if you configure them, we store the endpoint URL, the selected events, an encrypted signing secret, and delivery logs. The logs contain the payload we sent, which can include order customer details.
• Communications and support data: the content of emails, support requests, and other correspondence you send us, and our replies. The in-app support form can include an optional screenshot you choose to attach. The form’s content is emailed to our support mailbox rather than stored in the platform database.
• Product-usage data: monthly order and export counts used for plan limits. Also in-app help signals: which help panels and articles you open, search terms that returned no results (which we store to improve our help articles), and thumbs-up/down feedback. These search terms are deleted after 12 months.
• Technical and usage data: IP address, device and browser information, and server log data (such as access times, pages requested, and error logs), generated when you use our website or platform. Error logs are kept in our own AWS logging (see Section 7). Visits to app.sigmira.com create a short-lived session record (IP address and browser details) that secures the page.
• Launch-notification list: the email address you left on our pre-launch "coming soon" page, used only to tell you that Sigmira has launched.
• Website statistics: we measure how our website and demo store are used with Matomo, self-hosted on our own server.
  • It runs without cookies: nothing is stored on your device.
  • Your IP address is shortened before it is saved, so it cannot identify you, and a "Do Not Track" signal from your browser is respected.
  • We record the page visited, the referring site or campaign link, coarse details such as country, browser and device type, and clicks on our own calls to action (for example opening the demo store or starting a trial).
  • The raw measurement records are deleted after 180 days. This data never leaves our server and is never shared with an advertising network or any other third party.
• Cookie data: see Section 15. We currently use only strictly necessary cookies.

We do not intentionally collect special-category data (Article 9 GDPR) from merchants or website visitors as part of providing the service.

4. Purposes of processing and lawful bases

We process personal data only where we have a lawful basis under Article 6 GDPR.

Legitimate-interests balancing. Where we rely on legitimate interests (security, fraud prevention, product improvement, contacting prospects), we have weighed our interests against your rights and freedoms. We concluded that the processing is necessary, proportionate, limited to what is needed, and not overridden by your interests. It involves no sensitive data and produces no legal or similarly significant effects on you. You may object at any time; see Section 10.

5. Recipients, third parties and sub-processors

We share personal data only with the providers and parties below. Where they act as processors, they do so under a data processing agreement. Where they act as independent controllers, they are responsible for their own processing. A combined list with a change log is published at sigmira.com/sub-processors. The sub-processors we use for shopper design data are listed in Section 8.

Third-party content loaded by your browser. Some pages make your browser fetch files directly from other providers, which then see your IP address and browser details:

• Google Fonts: the merchant dashboard loads web fonts from Google Fonts. This applies to merchants only.
• Cloudflare cdnjs: the merchant dashboard and the order screen of the Sigmira plugin in WordPress load the Fabric.js canvas library from there. This applies to merchants only.
• YouTube: if you play the demo video on our homepage, it loads from YouTube (youtube-nocookie.com) at that moment. Google receives your IP address and may set its own cookies.
• Paddle: on the checkout page and the in-app page for buying order credits, Paddle’s checkout script loads from Paddle’s servers, and Paddle’s own cookie and privacy policies apply.

The customer editor that shoppers use loads nothing from Google. All its fonts are served from our own servers in the EU (AWS Frankfurt), and its canvas library comes from our own CDN. Our marketing website and demo store also host their own fonts.

About Paddle (Merchant of Record for WooCommerce merchants). When a WooCommerce merchant buys a subscription, they contract with Paddle (Paddle.com Market Ltd and/or its affiliates) as the reseller (Merchant of Record). Paddle collects and processes payment and billing data as an independent controller and issues the invoice. Sigmira receives only limited subscription and billing-administration data and does not store payment card details. Paddle’s own privacy policy governs its processing: https://www.paddle.com/legal/privacy.

About Shopify Billing (Shopify merchants). Shopify merchants approve Sigmira’s charges in their Shopify admin and pay them on their Shopify bill. Shopify handles the payment details. Sigmira receives the plan, the charge identifiers and the charge status. Shopify’s own privacy policy governs its processing: https://www.shopify.com/legal/privacy.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We may disclose data where required by law, court order, or to protect our legal rights.

6. International transfers

Your data is hosted and stored in the European Union, at AWS in Frankfurt (eu-central-1). However, parts of the service and some of the providers we use (see Section 5) operate outside the EEA:

• AWS: CloudFront edge locations in North America and Israel may terminate connections and cache public assets for visitors near them. Firewall (WAF) logs, which include the requester’s IP address, are kept for 7 days in the us-east-1 (N. Virginia) region.
• Paddle operates from the United Kingdom.
• Shopify operates from Canada and processes data in the United States.
• Dropbox, Calendly, and the providers that merchant-side pages load files from (Google Fonts, Cloudflare cdnjs) operate from the United States.

Where personal data is transferred outside the EEA, we rely on a valid transfer mechanism under Chapter V GDPR. This is either an adequacy decision of the European Commission (such as the decisions for the United Kingdom and Canada, or the EU-US Data Privacy Framework for certified US providers), or the European Commission’s Standard Contractual Clauses (SCCs) with any supplementary measures that are required. You can request more information and a copy of the relevant safeguards by emailing hello@sigmira.com.

7. How long we keep your data (retention)

Merchant data (we are controller)

• Account, licence and store data: Shopify merchants. When you uninstall the Sigmira app, Shopify asks us 48 hours later to erase your shop’s data. We erase it within 30 days of that request. If you reinstall before then, we keep your data.
• Account, licence and store data: WooCommerce merchants. We keep your Account data and configuration, including your stores’ order designs and files, for 180 days after your subscription ends so you can reactivate, and then delete it. We email you 30 days and 10 days before deletion. The plugin’s own data in your WordPress site is not affected. You can ask us to delete your account data earlier at any time.
• Financial records. We keep our bookkeeping records for 7 years, the period Dutch tax law requires businesses to keep financial records (fiscale bewaarplicht). These are subscription and charge identifiers, amounts and dates, Paddle payout statements and Shopify payout records. Paddle issues and keeps the invoices for WooCommerce merchants; Shopify bills Shopify merchants. When we delete your account, we keep only what accounting law requires in these records, and no design content or other personal data.
• Application logs are kept for 30 days, edge firewall (WAF) logs for 7 days, and the infrastructure audit trail for 12 months. We may keep logs longer when we need them to investigate a specific security incident or suspected fraud.
• Sign-in records, including your IP address, are deleted after 90 days. Product-usage signals are kept for the life of the account, except help searches that returned no results, which are deleted after 12 months.
• Website statistics. The raw measurement records (shortened IP, page, referrer) are deleted automatically after 180 days. After that we keep only aggregated reports (visitor counts per page, country, campaign).
• Launch-notification list: deleted shortly after the launch announcement, unless you opted in to further updates at that point.
• Marketing and consent records are kept until you withdraw consent or object, plus a short period to evidence the withdrawal.

Shopper design content (we are processor; the merchant decides)

We process this on the merchant’s behalf under the DPA. The merchant can instruct us to delete it earlier.

• Unfinished designs. A design that was never ordered or saved is deleted automatically 60 days after it was last used. Automatic deletion of these designs starts in December 2026. Photos uploaded to an unfinished design are deleted 60 days after upload.
  • On WooCommerce stores, the Sigmira plugin also keeps a temporary copy of a design in the store’s own database, which it clears automatically, and deletes cart preview images on the store’s server after 30 days.
• Saved designs. Designs a shopper saves to "My Designs" are kept until the shopper or the merchant deletes them.
• Designs on orders. The order record is kept for as long as the merchant uses Sigmira. It holds the customer’s name and email, the personalised text and design, and a rendered preview.
  • Print files generated for an order are deleted from our storage 90 days after they are created. The merchant can generate them again with "Regenerate" for as long as the order’s design and its photos are still kept. For a design with photos, that is up to 365 days after the photos were uploaded.
  • Original photos uploaded for an ordered design are deleted 365 days after upload.
  • On WooCommerce stores, the Sigmira plugin also stores each order’s design in the merchant’s own WordPress database, where it is kept permanently unless the merchant deletes it. That copy is under the merchant’s control.
• When a shopper asks for deletion. A shopper asks the merchant, and the merchant asks us.
  • Shopify stores: this arrives as Shopify’s customers/redact request. We erase that customer’s designs, order records and files within 30 days, and in practice on receipt.
  • WooCommerce stores: the merchant sends the instruction to hello@sigmira.com, and we erase the data within 30 days.
• When a store leaves Sigmira. All shopper design content of that store is erased with the store’s data: within 30 days of Shopify’s shop/redact request for Shopify stores, and as set out above for WooCommerce stores.
• Deleted files. A deleted file can stay in our versioned file storage for up to 30 more days before it is removed for good.

Backups

Our database is backed up automatically every day, and each automated backup is kept for 7 days. Before updates we also take a manual snapshot, which is deleted after 30 days. Both are encrypted and stay in the same EU region (Frankfurt). Data we delete can therefore remain in a backup or snapshot for up to 30 more days, until it rolls off. If we ever had to restore a backup, we would apply any deletions made since that backup before using the data.

8. Processing on behalf of merchants (summary of our DPA)

For shopper data in designs (names, email addresses, uploaded photos, personalised text, and the design and print files), the merchant is the controller and Sigmira is the processor. The binding terms are in our Data Processing Agreement, which forms part of our Terms of Service. In summary:

• Instructions. We process this data only on the merchant’s documented instructions: to provide the customizer, store designs, render print files and deliver them to the merchant. We tell the merchant if we believe an instruction breaks data-protection law.
• Confidentiality. Only people who need access to provide the service can see the data, and they are bound to confidentiality.
• Security. We protect the data with appropriate technical and organisational measures:
  • encryption in transit (TLS 1.2+, including to the database) and at rest (database, file storage, backups and secrets);
  • EU hosting at AWS Frankfurt, on a private database with no public endpoint;
  • access control: least privilege, per-merchant separation of stored data, HMAC-signed calls between the store and our platform, and two-factor authentication for staff access to merchant accounts, which is logged;
  • a web application firewall and a 12-month infrastructure audit trail.
• Sub-processors. We use the sub-processors below and tell merchants at least 30 days before adding or replacing one, so they can object.

Paddle is not a sub-processor: it handles only the merchant’s own billing data, never shopper designs. Google Fonts is not involved in shopper data at all: the customer editor loads its fonts from our own servers in the EU.

• Helping the merchant. We help the merchant answer shoppers’ data-protection requests and meet its obligations on security, breach notification and impact assessments. If a shopper contacts us directly, we pass the request to the merchant.
• Breach notification. We notify the merchant of a personal data breach affecting this data without undue delay, and in any event within 48 hours of becoming aware of it.
• Deletion at the end of the contract. When the merchant stops using Sigmira, we delete or return this data as the DPA and Section 7 describe, unless the law requires us to keep it.
• Audits. We make available the information needed to show we comply, and allow audits on reasonable notice.

9. Shopify stores

This section applies when a merchant uses Sigmira through the Sigmira app for Shopify.

What the app may access. The app asks Shopify only for the permissions it needs:

The app does not request access to Shopify’s customer list (read_customers).

What order data we keep. When an order includes a personalised product, we store:

• the order and line-item identifiers, the order date and status;
• the product and variant, and the personalisation properties on that line;
• the customer’s first and last name and email address, where Shopify includes them in the order. We use them only so the merchant can match print files to orders.

We do not store the customer’s postal address, phone number or payment details.

Shop and billing data. We keep the shop’s domain and identifier, its name and contact email, the app’s access token for the shop, and the status of the plan and any order credits purchased through Shopify Billing.

Shopify’s privacy requests (GDPR webhooks). The app subscribes to Shopify’s three mandatory privacy webhooks:

10. Your data-subject rights

Under the GDPR you have the right to:

• access (Art. 15);
• rectification (Art. 16);
• erasure (Art. 17);
• restriction (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests, and to direct marketing, at any time (Art. 21); and
• withdraw consent at any time where processing is based on consent (Art. 7(3)).

How to exercise your rights. Email hello@sigmira.com. We may need to verify your identity. We will respond within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you if we do (Art. 12). Exercising these rights is free unless a request is manifestly unfounded or excessive.

If your request concerns design content you submitted through a merchant’s store, please contact that merchant, who is the controller of that content. We will support the merchant in responding (see Sections 8 and 9).

11. Right to lodge a complaint

If you believe we have not handled your personal data lawfully, you may lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (AP):

• Website (English): https://www.autoriteitpersoonsgegevens.nl/en
• Submit a complaint: https://www.autoriteitpersoonsgegevens.nl/en/submitting-a-tip-off-or-a-complaint-to-the-ap

We would appreciate the chance to address your concerns first; please contact us at hello@sigmira.com.

12. Automated decision-making and profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Security and fraud-prevention measures may flag activity for review, but any consequential decision involves human assessment.

13. Security measures

We take appropriate technical and organisational measures, including:

• encryption in transit (TLS 1.2+ everywhere, including to the database) and at rest (database, file storage and secrets);
• a private database with no public endpoint;
• per-tenant separation of stored data;
• access controls (least privilege, authentication, restricted admin access);
• two-factor authentication available to staff and required for access to merchant accounts, which is logged;
• signed server-to-server calls between your store and the platform;
• a web application firewall and a 12-month audit trail of infrastructure activity;
• platform secrets kept in a managed vault; and
• EU hosting (AWS, Frankfurt).

We hold no security certification (such as ISO 27001 or SOC 2) at this time and do not claim one. No system is completely secure, but we work to protect your data and to respond promptly to incidents. Where the law requires it, this includes notifying the AP and affected individuals.

14. Children

The Sigmira platform is a business tool and is not directed at children. We do not knowingly collect personal data from children under 16. Each merchant is responsible, under the DPA and applicable law, for the lawful basis and any required parental consent for its own shoppers, including minors.

15. Cookies

We use cookies and similar technologies on our website and platform. Today we use only strictly necessary cookies. Our marketing website sets no cookies for ordinary visitors, apart from the checkout page (Paddle) described below.

Similar technologies: while a shopper designs a product, the editor keeps the design session key and a rendered preview of the design in the browser’s own sessionStorage. On Shopify stores, the Sigmira app also keeps the cart display settings and the design preview there. This stays on the device and is cleared when the tab closes.

Under the Dutch Telecommunicatiewet (art. 11.7a) and the ePrivacy rules, strictly necessary cookies do not require prior consent, and our cookieless website statistics store nothing on your device at all, so no consent banner is needed. If we introduce analytics or marketing cookies (or any other non-essential cookies) in future, we will ask for your consent through a cookie banner before they are set, and update this notice. You can withdraw consent at any time.

16. Changes to this notice

We may update this notice to reflect changes in our processing, technology, or legal requirements. The "Last updated" date shows the latest version. For material changes, we will take reasonable steps to notify you (e.g. by email or a website notice).

17. Contact

Sigmira (Quincy van der Ree, eenmanszaak), Verdiweg 671, 3816 KW Amersfoort, The Netherlands

Email: hello@sigmira.com. KvK 82195757. VAT NL003652487B20.