This tells you what we collect when you order printing from us or talk to us about a job, every company we pass it to, how long we keep it, and how to ask us to change or delete it. It covers our shop website, our Smart Campaigns site and the system our staff run the shop on.
What we collect
- Who you are: your name, your company, your email address, your phone number, and your billing and delivery addresses.
- What you ordered: quotes, orders, the artwork you send us, the proofs we send back, the name you type to approve one, invoices, and what you paid.
- How you reached us: the pages you looked at, a random identifier stored in a cookie on your own device, and — if you arrived from one of our adverts — the click identifier Google put on the link.
- Your IP address, in the access logs every website keeps.
- Mailing lists you give us. When you hire us to print and mail a campaign, we process the list you supply in order to produce that campaign, and for nothing else.
- Our own staff’s records, because the same system runs the shop: contact details, role, hours, pay and time off. Sensitive fields are restricted to the people who need them.
We never see your card number. Stripe’s payment form collects it and we are told only that the payment succeeded, the amount, and the last four digits on the receipt.
Where your information goes
We do not sell your information and we do not share it for anyone else’s advertising. These are every company we send it to, and what each one gets:
- Stripe: Takes the payment when you order on this website: your name, email address, phone number and billing address, what you bought and the amount. Stripe handles the card itself — the card number never reaches us — and works out the sales tax.
- Google Analytics: Counts visits to the shop's website. It gets the pages you look at and a random number stored in a cookie on your own device, and when an order is paid it also gets the order number, the total and the currency. It is never given your name, your email address or your postal address.
- Google Ads: Runs our adverts, and is told that a sale happened together with the click identifier Google put on the link you arrived by. We keep that identifier for 30 days — Google's own attribution window — and it identifies a click, not you.
- Clerk: Signs in our own staff and our business partners, and holds their name, work email address and login credentials. Shop customers never sign in through Clerk: your account uses a link we email you, and the session lives in our own database.
- Resend: Delivers the email we send you — order confirmations, proofs to approve, sign-in links, receipts — so it receives your email address and the whole of the message.
- Microsoft 365: Hosts the shop's own mailboxes, so it carries any email between you and a member of our sales team. Where that exchange is with a contact we already have, the sender, the recipients, the subject line and the date are copied onto your record in our system — never the body of the message.
- Vercel: Runs all three of our websites, so every page you open and every form you submit passes through its servers, including your IP address and the browser you used.
- Vercel Blob: Stores files: the artwork you upload, the proofs we make from it, anything attached to an order, and the saved record of a form you send us.
- Neon: Runs the database the shop is built on. Everything listed below that is not a file is held there, and its backups are the shop's only second copy.
- FedEx: Prices a shipment and tracks a parcel. It gets the delivery ZIP code — and the street address once you have given us one — along with the size and weight of the box and the tracking number.
- QuickBooks Online: Is our accounting ledger, run by Intuit. For an order the shop invoices directly we create the customer record and the invoice there — your name, your billing address and the invoice lines. For an order paid on this website we write nothing at all: QuickBooks Sync by Acodei copies Stripe's own record of the sale into the books.
- Anthropic: Reads two things for us: what a member of our field staff says out loud into the quoting app, which can include a customer's name, and the notes behind a draft article for our own blog. It is not given orders, files or contact records.
- Every.io: Pays our own staff, and receives their hours and pay details. Nothing about a customer goes to it.
Beyond that list we share information only where the law requires it, or to establish or defend a legal claim.
How long we keep it
| What | We keep it | Then |
|---|---|---|
| Orders, quotes, invoices, payments, and proof approvals (including the name you sign them with) | 7 years after the order closes | deleted |
| Artwork and proof files | 3 years after the order closes | deleted |
| Your customer record, if you have ordered | as long as your orders | anonymised with them |
| Contacts and prospects who never ordered | 3 years after we last heard from you | anonymised |
| Our staff's internal chat about jobs | 2 years | deleted |
| Analytics and advertising identifiers stored on your order | 90 days after your order is paid for | cleared from the order — we keep only that a sale happened |
| IP addresses in our access logs | 1 year | removed from the log entry |
| Employee records | the length of employment plus 4 years | anonymised — the record stays for payroll references, the person's details go |
| Email we copied into our CRM |
“Deleted” means the record is gone. “Anonymised” means we keep the record for counting work through the shop, with everything that points at a person taken out of it.
Backups. Our database keeps a rolling 30-day backup window, so anything we delete stays in a backup until that window rolls past it. A deletion is final everywhere within 30 days.
If you ask us to delete your data
We will, with one exception, and here it is plainly. If we have invoiced you, tax law and the contract itself require us to keep a record of that sale for 7 years. So everything identifying goes except what the invoice has to carry: the name and billing address it was invoiced under, and the invoice itself. Everything else about you — your contact record, your artwork, your proofs, your messages to us, your analytics identifiers — is deleted or anonymised on the schedule above.
Asking for your information, correcting it, or deleting it
Write to us at hello@brandboostprints.com and say which of the three you want. We will tell you what we hold, correct anything that is wrong, or delete it subject to the invoice exception above. If you would rather write on paper, the postal address is at the bottom of this page.
If you received a mailing we printed for one of our customers and want off that list, tell us and we will pass it to them — the list is theirs, not ours, so they are the ones who can remove you from it, and we will make sure they hear.
How you sign in
If you have a shop account, you sign in with a link we email you. There is no password to lose and the session lives in our own database. Our staff and our business partners sign in through Clerk instead, which is why Clerk is on the list above and why it holds nothing about you.
How we protect it
Each partner’s data sits in its own database, encrypted in transit and at rest. Access is restricted to the staff whose job needs it, and the sensitive fields are restricted further. API keys and passwords live on our servers and are never sent to a browser. The health-vertical mailing data some partners send us is treated as protected health information: it never goes into a log, an error report, an analytics event or an email.
Children
We sell printing to businesses. The site is not aimed at children under 13 and we do not knowingly collect anything from one.
Changes to this policy
If we add a company to the list above or change how long we keep something, we update this page and move the effective date at the top of it. The list is checked against our own code every time we ship, so a new one cannot be added quietly.
Contact us
Questions about this policy, or about what we hold: hello@brandboostprints.com, or by mail to TAL Printing, LLC, 17323 E Trent Ave., Spokane Valley, WA 99216.