Privacy Policy

1. Our approach to privacy

PiperStitch LLC, a Florida limited liability company (“PiperStitch LLC,” “we,” “us,” or “our”) provides BrandWright: the website at brandwright.co, the shop administration (“Admin”), the online storefronts BrandWright hosts for shops, the expert console, and related services (together, “BrandWright”). We built BrandWright to collect what is needed to run your shop and little else:

• Your shop’s content and your customers’ information belong to you. We use them only to run your shop for you.
• We do not sell personal information, and we do not share it for advertising.
• There are no advertising trackers, ad networks, or social-media pixels in BrandWright — not in Admin and not on storefronts.
• We do not use your content or your customers’ information to train artificial-intelligence models.
• Card numbers are entered on Stripe’s pages; we never receive or store them.
• Nobody from BrandWright works in your Admin unless you switch expert access on, or our support staff need to for a stated, logged reason.

By using BrandWright you acknowledge this Privacy Policy and our Terms of Service.

2. Who this policy covers

Shops — the businesses that use BrandWright, and their owners and team members. For information about shops, PiperStitch LLC decides how it is used and is responsible for it.

Shoppers — people who visit and buy from a storefront hosted on BrandWright. A storefront belongs to the shop that runs it; the shop is the business responsible for its shoppers’ information and must publish its own privacy policy. We process shoppers’ information on the shop’s behalf and on its instructions, as its service provider (Section 4). Shoppers with a privacy question or request should contact the shop first; we will help the shop respond.

3. Information we collect from shops

Account and sign-in

BrandWright signs you in with one-time codes and links sent to your email; you may also choose to set a password, which we store only as a salted one-way hash. We keep your name and email address, your role in each shop, the one-time codes and links we send (stored only as one-way hashes and expiring within minutes), sign-in sessions, when you signed in, and failed password attempts (kept for a day, to stop password guessing).

Your shop

The business details you give us (shop name, contact email and phone, ship-from address, what you make, sales tax permits), your plan, and your settings. The content you add: products, photos, fonts, motifs and design files, website pages, logos and brand assets, emails, social posts, and documents. The records your shop creates: orders, customers, shipments, expenses, tax filings, and the actions your team takes in Admin.

Billing and payments

For your BrandWright plan, shipping balance, and expert time, Stripe gives us your customer and subscription identifiers and a record of each payment (amount, date, status) — never your full card number. For your shop’s own Stripe account (connected through Stripe Connect), we receive the account identifier and its status (for example, whether it can accept charges and receive payouts).

Connections

When you connect a service — your own domain, email domain, social accounts, QuickBooks, or your own payment, shipping, or email keys — we keep what is needed to keep the connection working, such as account identifiers and DNS records. Keys and tokens are encrypted before they are stored. Access tokens or keys you give us for importing from another platform are used for that import only and are not stored.

Etsy

If a shop connects its own Etsy shop, Etsy sends us, through the Etsy API and with the shop’s permission: the Etsy shop’s name and identifiers; its active listings (titles, descriptions, photos, prices, variations and personalization questions) when the shop chooses to import them; and its paid orders — order number, items, the buyer’s name and shipping address, the personalization and note the buyer entered, and payment and shipping status. We use this only so the shop can make, track and ship those orders and copy its own listings into its catalog, and we send tracking details back to Etsy when the shop ships. We never email or text Etsy buyers, never add them to the shop’s customer or mailing lists, and never sell or share Etsy data. When a shop disconnects Etsy, its Etsy tokens are deleted at once; orders and products already brought in stay with the shop’s other records (Section 15). The term “Etsy” is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

Technical information

Our servers and hosting providers receive your IP address, browser type, the pages and requests made, and their times. These appear in routine logs kept for a limited period for security, abuse prevention, and troubleshooting. Admin pages remember a few preferences in your browser (Section 9).

Support and expert help

What you send us when you ask for help, the expert requests you make (topic, details, times, phone number if you want a call), and the record of expert sessions: when they ran, the time billed, notes the expert left for you, and what was changed in your Admin.

Connecting your own domain. To connect your domain we look up its public DNS records (who manages them, where the website and email point today) and keep the records we ask you to add. If you give us an API key from your domain company to add them for you, we use it for that one request and never store it.

4. Information about shoppers on BrandWright storefronts

To let a shop sell online, a storefront handles, on the shop’s behalf:

1. order details — name, email, phone, shipping address, items, personalization (such as monogram letters, names, fonts, and thread colors), gift messages, and notes;
2. customer accounts, if the shop offers them — email address, saved addresses, and order history (shoppers sign in with emailed codes, not passwords);
3. email marketing consent, and opens, clicks, bounces, and unsubscribes for emails the shop sends — including, if the shop turns them on, up to two reminder emails about a checkout the shopper started but didn’t finish (never sent to shoppers who opted out of email);
4. reviews and messages shoppers send the shop; and
5. which campaign link or website brought a shopper to the shop, so the shop can see which of its own efforts lead to sales; and
6. anonymous visit counts for the shop’s Analytics page — the page viewed, the site or campaign that sent the visitor, and the type of device. No cookie is used and no IP address or identifier is stored: visits are counted with an anonymous code that changes every day and can’t be traced back to a person. Browsers that send Do Not Track or Global Privacy Control aren’t counted.

Payments are made on Stripe’s secure pages and go to the shop’s own Stripe account; card numbers never reach BrandWright or the shop. We use shoppers’ information only to provide BrandWright to the shop, to keep the Service secure, and as required by law. We do not use it to market to shoppers ourselves, we do not combine it across shops, and we do not sell it. Shops can export their customers and can anonymize a customer’s personal details at the customer’s request.

5. Visitors, demo users, subscribers and business contacts

Visitors to brandwright.co. To understand how people find and use BrandWright, we record what happens on brandwright.co, the BrandWright Guide and guidebook, and our demo store and demo Admin: the pages you view, how long you stay and how far you scroll, the buttons and links you click, the names of forms you send (never what you type), and the site or campaign that brought you — tied to a random visitor id in a first-party cookie (Section 9). If you later give us your email (to try the demo, join the newsletter or sign up), that history is linked to it. If you write to us, we keep your message and contact details to reply.

Demo users. When you enter your email to try the demo store or a demo copy of the Admin, we keep that email address, when you visited, and how you found us. We use it to send you your demo link and may follow up about BrandWright; every such email has an unsubscribe link. Demo copies of the Admin are deleted after 24 hours.

Newsletter subscribers. If you sign up for BrandWright news, we keep your email address and when and how you confirmed (we ask you to confirm by email first). You can unsubscribe from any newsletter with one click.

Business contacts. To find businesses BrandWright may help, we may keep business contact details that are publicly available — for example a business’s name, website, public email address, location and what it makes — and notes on our conversations. We use them only to contact the business about BrandWright, honor every opt-out right away, and never sell them. To be removed, use the unsubscribe link in any email from us or write to contact@brandwright.co.

6. Information we do not collect

PiperStitch LLC does not:

1. receive or store full payment-card numbers;
2. use advertising identifiers, third-party tracking cookies, or social-media pixels;
3. sell or rent personal information, or use it for targeted advertising;
4. track shoppers across different shops or across other websites; or
5. keep the passwords, tokens, or keys you give us for one-time imports.

7. How we use information

We use information to:

1. sign you in and keep your shop secure;
2. run your shop: host your storefront, take orders, show personalization previews, produce production sheets and machine files, buy shipping labels, and send your emails and social posts;
3. administer your trial, plan, platform fees, shipping balance, and expert time, and process payments and refunds;
4. send you service messages such as sign-in codes, order and billing notices, and security alerts;
5. provide support and BrandWright Expert help you ask for;
6. prepare the tax worksheets, nexus alerts, accounting files, and reports you open;
7. protect BrandWright, shops, and shoppers from fraud, abuse, and security threats, including email sending limits and pausing harmful sending;
8. keep business, accounting, and tax records and comply with the law; and
9. keep BrandWright working and improve its reliability, without selling or advertising with your information.

8. AI features

When you use an AI feature — writing product copy or captions, reading a receipt, cleaning up or removing the background of a photo, or understanding your old site during an import — the text or image involved is sent to our AI provider to produce the result you asked for. Text features use Anthropic’s Claude through its commercial service, which does not use this content to train its models. Image features use fal.ai’s image service (running Bria’s commercially licensed models), with Stability AI’s image service as a backup. We do not use your content, or your customers’ information, to train AI models.

9. Cookies and browser storage

BrandWright uses only cookies and browser storage needed to work:

• ps_session — keeps you signed in on brandwright.co (signing up, your shops, the expert and platform consoles).
• bw_admin — keeps you signed in to your shop’s Admin.
• bw_customer — keeps a shopper signed in to their account on a storefront.
• bw_utm — remembers, for up to 30 days, which campaign link brought a shopper to a storefront, so the shop’s own reports can credit it. It is set only by the shop’s storefront and is not shared with anyone.
• bw_src — remembers, for up to 30 days, which campaign link, referral code or website brought you to brandwright.co, so BrandWright can tell which of its own campaigns work. It is not shared with anyone.
• bw_setup_step, bw_social_connect and bw_signup_plan — short-lived helpers that return you to the right setup step or social-account screen, or remember the plan you picked before signing up.
• bw_demo and bw_demo_pass — open your private demo copy of the Admin, and let you move between the demo store and brandwright.co without entering your email again.
• bw_vid and bw_sid — a random visitor id (kept up to 13 months) and a visit id (ends after 30 minutes without activity), set by BrandWright on brandwright.coand its subdomains to understand how BrandWright’s own site, demos and Admin are used. They are first-party, never shared, and never set on a shop’s storefront for its shoppers.
• Browser storage — a storefront keeps the shopper’s cart and recent personalization choices in their browser; Admin remembers things like whether you have seen a page’s tour or pinned the menu.

BrandWright’s own analytics are first-party: they run on our servers, are never shared or sold, and are used only to improve BrandWright and understand what helps people decide. We keep the type of device and country, not your IP address. Inside a shop’s Admin we record which pages and features the shop’s team uses (not the shop’s or its shoppers’ data) to improve the product. Raw records are deleted after about 13 months. Browsers that send Do Not Track or Global Privacy Control are not tracked at all.

None is used for advertising or tracking across sites. Stripe’s checkout pages set their own cookies under Stripe’s privacy policy.

10. Email we send

We send shops service email — sign-in codes, billing and plan notices, expert-booking confirmations, and important account messages — which cannot be turned off while you have a shop. We may occasionally send product news; you can opt out at any time by replying or writing to contact@brandwright.co.

On each shop’s behalf, BrandWright sends shoppers order and shipping emails and the marketing emails the shop creates. Marketing emails go only to shoppers who agreed to receive them and always include an unsubscribe link. Email is delivered through our email delivery provider, which receives each recipient’s address and the message in order to deliver it.

11. Text message alerts

If you choose alerts by text, we keep your mobile number, when you confirmed it and agreed to texts, which alerts you chose, and a record of the texts we sent and whether they were delivered. We use them only to send the alerts you asked for and to honor STOP and HELP replies. Texts are delivered through our text message provider, which receives your number and the message in order to deliver it.

We do not sell, rent or share mobile numbers or text-messaging consent with anyone for their marketing. Reply STOP to any text to stop them, or remove your number in My account.

12. Service providers and sharing

We share information only with providers that help us run BrandWright (our “subprocessors”), and only what each needs:

• Stripe — payments, Stripe Connect, subscriptions, and Stripe Tax;
• Shippo, and the carriers you ship with — addresses and package details for labels and tracking;
• Resend — email delivery: recipients and message content;
• Sent — text message delivery: the mobile number and the text, for alerts you choose to get by text;
• Post For Me — social publishing: the posts you publish and the accounts you connect;
• Anthropic, fal.ai and Stability AI — content you submit to AI features (Section 8);
• Intuit — the journal entries you send, if you connect QuickBooks;
• Railway — hosting, database and file storage for BrandWright (in the United States), including the web addresses you connect;
• Cloudflare — DNS for our domains;
• Google and Microsoft — our own company email, for messages you send us; and
• professional advisers, such as accountants and lawyers, under confidentiality.

We will update this list before adding a provider that receives shop or shopper information.

These providers may use the information only to provide their services to us. We may also disclose information when required by law; to protect the rights, property, or safety of PiperStitch LLC, shops, shoppers, or others; to investigate fraud or abuse; or as part of a merger, acquisition, financing, reorganization, or sale of assets, in which case the recipient must respect this policy. A shop’s information and its shoppers’ information is never made available to other shops.

13. BrandWright Experts and support access

BrandWright Experts can open your Admin only while you have switched expert access on, for the period and level you chose, and you can switch it off at any time. While working they may see what that level allows — including orders and customer details — and they are bound to use it only to help you and to keep it confidential. Every session and every change is recorded and shown to you. Our support staff may access a shop’s Admin to resolve problems you report, investigate security issues, or comply with law; each session requires a stated reason and is recorded in an audit log.

14. Government and legal requests

We may disclose information in our possession when legally required by a valid subpoena, court order, or similar process. Where the law allows, we will tell the affected shop first so it can respond. Requests concerning a shop’s shoppers should normally be made to that shop.

15. Data retention

• Shop content and records are kept while the shop is open. After a shop closes they are kept for thirty (30) days so it can be reopened or exported, then deleted, except as below.
• Payment, platform-fee, tax, and audit records are kept as long as the law requires (generally seven years).
• One-time sign-in codes and links expire within minutes; sessions expire or end when you sign out.
• Server logs are kept for a limited period set by our hosting providers.
• Backups are kept for a limited period and then overwritten.
• A shop can delete products, content, and customers at any time and can anonymize a customer’s personal details on request.

16. Data security

We use reasonable technical and organizational measures to protect information, including:

1. encryption in transit (HTTPS) for all of BrandWright, including storefronts and your own domain;
2. encryption of stored keys and tokens;
3. one-way hashing of sign-in codes, links and passwords, and a lockout after repeated wrong passwords;
4. separation of every shop’s data from every other shop’s, checked on every database request;
5. role-based permissions for shop teams, time-limited expert access, and logged support access; and
6. database backups.

No system is perfectly secure. If we learn of a security incident affecting your information, we will notify you as required by law.

17. Your privacy rights and choices

Shops can view, correct, export, and delete their information in Admin, or ask us at contact@brandwright.co. Depending on where you live (for example, California and other U.S. states with privacy laws, or the European Economic Area and United Kingdom), you may have the right to know what we hold about you, to receive a copy, to have it corrected or deleted, to object to or limit certain processing, and not to be discriminated against for using these rights. We do not sell or “share” personal information for cross-context behavioral advertising.

Shoppers should send requests to the shop they bought from, which controls their information; we support shops in responding. If you are a shopper and cannot reach the shop, write to contact@brandwright.co and we will pass your request on. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law allows.

18. Children’s privacy

BrandWright is for businesses and is not directed to children. Shop accounts require users aged eighteen (18) or older. We do not knowingly collect personal information from children under thirteen (13); if you believe a child has given us information, contact us and we will delete it.

19. International users

BrandWright is operated in the United States, and information is processed and stored in the United States, where data protection laws may differ from those where you live. By using BrandWright, you understand that your information will be processed in the United States.

20. Do Not Track and Global Privacy Control

Because BrandWright does not track people across websites or use advertising cookies, there is no cross-site tracking to turn off. We treat a Global Privacy Control signal as a request to opt out of any sale or sharing of personal information, which we do not do in any case.

21. Changes to this policy

We may update this Privacy Policy as BrandWright or the law changes. The current version, with its date, is always at brandwright.co/privacy. For material changes we will give reasonable notice by email or in Admin before they take effect.

22. Contacting PiperStitch LLC

Questions or requests about privacy: contact@brandwright.co. By mail: PiperStitch LLC, 1680 Fruitville Road, Sarasota, Florida 34236.

23. Governing law

This Privacy Policy is governed by the laws of the State of Florida, consistent with the Terms of Service, except where the law of your place of residence requires otherwise.