Drop 07: Doodle Riot ✶ Full-length prints ✶ Sleeve hits ✶ Flat full-colour DTG ✶ Tees, hoodies and crews ✶

SLYFF

Privacy Policy

Last updated:

This policy explains how we handle information when you browse SLYFF, create an account, upload artwork or place an order at slyff.com.

Who we are and our Privacy Officer

SLYFF, operated at slyff.com, is based in Ontario, Canada. In this policy, “we” and “Slyff” mean the store operator. We ship to Canada and the United States. Our Privacy Officer handles privacy questions and requests at privacy@slyff.com. For order help, email support@slyff.com.

What we collect

  • Account information: your name, email, sign-in details, saved addresses, Riot Club rewards and coupon activity. If you choose Google sign-in, we receive your name, email and profile photo from Google.
  • Orders and shipping: items, sizes, order history, delivery name and address, contact details and delivery updates.
  • Artwork: files you upload, saved designs and the information needed to place and print them. We store artwork to print your order and show it back to you in your account.
  • Payment information: Stripe handles card details. We receive payment status, transaction references and limited payment information needed for support and refunds. We never see or store your full card number.
  • Communications: messages you send us, support photos, privacy requests and your consent or unsubscribe choices.
  • Device and usage information: technical logs such as IP address, browser and device details for operation and security; aggregated site and performance measurements; and, with the separate consent described below, product events, masked session recordings and advertising measurements.

How and why we use information

We use information to run accounts, save designs, take payment, print and deliver orders, provide updates and support, handle refunds, and administer Riot Club rewards and coupons. We also use it to protect the service against fraud and abuse, maintain records required by law and resolve disputes. Aggregated measurements help us understand site reliability. Optional analytics helps us improve the shopping experience; optional marketing measurement helps us understand which ads lead to visits or purchases. We do not use your private uploads as public promotional artwork without separate permission.

Cookies and similar technology

Cookies, browser storage and similar tools keep sessions working and remember choices. The table describes service purposes, including tools that do not set cookies. Optional tools run only when enabled and you have given the relevant consent.

Services and consent requirements
ServicePurposeNeeds consent?
Slyff / SupabaseAccount sessions, security, cart and saved consent choices.No — necessary for the service.
StripeSecure payment processing and fraud prevention.No — necessary for payment.
Google sign-inOptional account authentication when you choose Google.Yes — you choose to connect Google; no analytics or marketing permission is implied.
Vercel Web Analytics + Speed InsightsCookieless, aggregated traffic and performance measurements.No — cookieless aggregate measurement.
PostHogProduct analytics and session recordings, with form inputs masked.Yes — analytics consent.
Meta Pixel + Conversions APIMeasure ad results using browser and server events.Yes — marketing consent.

Blocking necessary browser storage may prevent sign-in or checkout. Marketing email consent is a separate choice from these browser settings.

Who we share with and why

We share information needed to provide the service with these providers:

  • Supabase: account and data hosting, including saved order and artwork information.
  • Vercel: site hosting, delivery, technical operation, Web Analytics and Speed Insights.
  • Stripe: payments, fraud checks and refunds.
  • We Must / Gelato network: artwork, product specifications and delivery information needed to print and ship your made-to-order items, including delivery carriers.
  • ZeptoMail (Zoho): transactional emails such as account and order messages.
  • Google: authentication if you choose Google sign-in.
  • PostHog: product analytics and masked session recordings only with analytics consent.
  • Meta: Pixel and Conversions API ad measurement only with marketing consent.

We may also disclose information when required by law, to respond to lawful requests, or to protect people and the service. Access within our business is limited to people who need it for their work.

Cross-border storage and transfers

Our providers may store or process data in the United States and elsewhere outside your province or Canada. This includes information shared for hosting, payments, printing, delivery, email and optional measurement. Other countries may have different privacy rules, and their authorities may lawfully access data. We use contractual and organizational safeguards for provider transfers and assess transfers where required by applicable law, including Quebec law. Contact the Privacy Officer to ask about these arrangements.

How long we keep information

We keep order, payment and tax records for seven years for tax and accounting purposes, or longer if a legal obligation or unresolved dispute requires it. Accounts and uploaded artwork are kept until deleted; you can request deletion through the Privacy Officer. Copies needed for an existing order, legal records or a dispute may be retained for that purpose. Backup copies may remain until their normal replacement cycle. Analytics and advertising records follow each provider’s configured retention period; contact us for the periods that apply to your request. We delete or de-identify information when it is no longer needed.

Security

We use access controls, encrypted connections and provider security features to protect information, and limit access to account, order and artwork records. No online service or storage method can promise complete security. Keep your sign-in details private and contact us promptly if you suspect unauthorized account access.

Your privacy rights and complaints

Depending on the law that applies, you may request access to your personal information, correction of inaccurate information, withdrawal of consent, deletion, and a portable copy of eligible information. Quebec’s Law 25 also provides rights, subject to its conditions, to receive computerized information you supplied in a structured, commonly used format, request an end to dissemination or de-indexing in qualifying circumstances, and receive information about and seek human review of decisions based exclusively on automated processing.

Send requests to privacy@slyff.com. We may need to verify your identity using only what is reasonably necessary. We will respond within applicable legal deadlines and explain any lawful restriction, including records we must keep.

You may raise a concern with our Privacy Officer or complain to the Office of the Privacy Commissioner of Canada or, where applicable, the Commission d’accès à l’information du Québec. You do not have to give up a legal right to shop with us.

Marketing emails

We send marketing emails only with consent in accordance with Canada’s anti-spam rules (CASL). Every marketing email includes an unsubscribe option. You can also email support@slyff.com to withdraw consent. Unsubscribing does not stop necessary account, security or order messages.

Children

Our service is not directed at children under 16. We do not knowingly collect their personal information. If you believe a child under 16 has provided information, contact the Privacy Officer so we can investigate and remove it as appropriate.

Changes to this policy

We will publish changes here and update the date above. For significant changes, we will give additional notice where required. If a new purpose requires consent, we will ask before using information for that purpose.

Contact

Privacy Officer, SLYFF, Ontario, Canada: privacy@slyff.com. For orders and general questions: support@slyff.com. See also our Terms.