Privacy policy

Last updated: April 30, 2026 — Compliant with GDPR (EU 2016/679).

1. Data controller

OLB SPORTS OOD, a limited liability company under Bulgarian law, with registered office at 1 Todor Hadjistanchev Street, 1404 Sofia, Bulgaria. EU VAT number: BG208208044.

Data Protection Officer: dpo@printwearai.com

2. Data collected

2.1 Data provided by the Client / Tenant

• Identity: first name, last name, email, company name
• Contact details: postal address, phone number (optional)
• Billing data: payment method (processed by Stripe, never stored by us)
• Content: designs, logos, 3D models, palettes, uploaded fonts

2.2 Automatically collected data

• IP address, browser, operating system, pages visited
• Session cookies (essential) and audience measurement cookies (with consent)
• Usage logs: connections, actions performed, errors

2.3 End customer data (B2C)

When a Tenant uses our configurator on their store, we process on their behalf the data necessary for the order (delivery address, product configuration). The Tenant is then the data controller, with PrintWearAI acting as processor within the meaning of the GDPR.

3. Purposes and legal bases

Purpose	Legal basis	Retention period
Service provision	Contract performance	Subscription duration + 30 days
Billing and accounting	Legal obligation	10 years
Security (logs, audit)	Legitimate interest	12 months
Marketing (newsletter)	Consent	Until unsubscription
Audience measurement	Consent	13 months

4. Recipients and processors

Your data is only shared with strictly necessary processors:

• Stripe (payment) — Ireland/USA, PCI-DSS certified, standard contractual clauses
• OVH / Scaleway (hosting) — France/Germany
• Brevo / Postmark (transactional emails) — France/USA
• PrintWearAI vector AI (AI generation, prompt and generated image only) — USA, standard contractual clauses
• Cloudflare (CDN, anti-DDoS) — worldwide coverage

No data is sold or rented to third parties for commercial purposes.

5. Transfers outside the EU

Some processors (Stripe, PrintWearAI vector AI) are based in the United States. These transfers are governed by the Standard Contractual Clauses of the European Commission and, where applicable, the Data Privacy Framework.

6. Your rights

Under GDPR, you have the following rights:

• Right of access: obtain a copy of your data.
• Right of rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to data portability: retrieve your data in a structured format.
• Right to object and restrict processing.
• Right to withdraw consent at any time.

To exercise these rights, contact dpo@printwearai.com. You can also manage most of these rights directly from your tenant workspace (under "Privacy").

In the event of a dispute, you may contact the competent supervisory authority: the Bulgarian Commission for Personal Data Protection (КЗЛД / CPDP), cpdp.bg. European users may also contact the supervisory authority in their country of residence (for example, in France: CNIL).

7. Security

We implement technical and organizational measures to protect your data: TLS 1.3 encryption, hashed passwords (bcrypt), two-factor authentication available, access logging, daily encrypted backups, European hosting.

8. Cookies

See our detailed cookie policy.

9. Changes

This policy may be modified. Substantial changes will be notified to you by email. The date at the top of the page indicates the last revision.