Privacy Policy
How we collect, use, share, and protect information across coricor.com and the Coricor apps.
Effective date: May 21, 2026 · Last updated: July 20, 2026
This Privacy Policy explains how Martin Graphics Enterprises (“Coricor,” “we,” “us,” or “our”) handles information in connection with the Coricor website at coricor.com and our software products, including the Gang Sheet Studio gang-sheet application for Shopify (the “Services”). By installing, accessing, or using the Services you agree to the practices described here.
1. Who we are
The Services are operated by Martin Graphics Enterprises, located in Illinois, United States. For privacy questions or to exercise your rights, contact us at support@coricor.com.
2. The two roles we play
Our Shopify app processes two different kinds of people’s data, and our role differs for each:
- Merchants (Shopify store owners who install the app): we act as a data controller for the account and billing information needed to provide the app to you.
- Shoppers (your customers who use the gang-sheet builder on your storefront): we act as a data processor on the merchant’s behalf. We process shopper-provided files and order details only to deliver the service the merchant has configured.
3. Information we collect
From merchants
- Your Shopify store domain, store name, and the contact email associated with your store.
- An OAuth access token issued by Shopify that authorizes the app to read and write the product and order data you grant at install.
- App configuration you enter (pricing, sheet dimensions, branding, button labels, and similar settings).
- Billing status and usage totals reported by Shopify’s billing API.
From shoppers (on a merchant’s storefront)
- Artwork and files uploaded to build or submit a gang sheet (PNG, JPG, SVG, PDF), along with any text you add to a design.
- Design layout data (image placement, sizes, quantities) needed to render your print-ready output.
- Order-related information passed from Shopify when an order is placed, which may include your name, email address, and the order’s line items. We use the email address on an order to send transactional messages about that order (see Section 4).
If you connect a Canva account (optional)
- When you choose to connect Canva to import a design, we store the OAuth access token Canva issues so the connection persists across sessions. The token’s scope is read-only (listing your designs and exporting the design you select); it does not let us edit anything in your Canva account. You can disconnect at any time in the builder, which deletes the stored token and asks Canva to revoke it.
Automatically
- Basic technical and usage data (such as IP address, browser type, pages or actions, and timestamps) and error diagnostics, used to operate, secure, and improve the Services.
- Strictly necessary cookies / local storage used to keep your session and remember in-app preferences. We do not use the Services to serve third-party advertising.
4. How we use information
- To provide, operate, and maintain the Services — including building, measuring, pricing, rendering, and delivering gang-sheet files.
- To authenticate requests, mint product variants, and add items to the cart through Shopify.
- To calculate and process app usage charges through Shopify’s billing system.
- To perform optional AI image processing that you or your shoppers request (for example, background removal or upscaling of an uploaded image).
- To send service-related communications (for example, billing-cap notifications and edit-request alerts to merchants, and order-related transactional emails to shoppers — such as post-purchase edit invitations and notices that an edit request was approved or denied — sent to the email address on the order).
- To monitor performance, debug errors, prevent abuse, and improve the Services.
- To comply with legal obligations and enforce our Terms of Service.
5. How we share information — subprocessors
We do not sell personal information. We share data only with service providers (“subprocessors”) that help us run the Services, each under contractual confidentiality and data-protection obligations, and only to the extent needed to perform their function:
| Subprocessor | Purpose |
|---|---|
| Shopify | Commerce platform, authentication, billing, and order data |
| Cloudflare R2 | Storage of uploaded artwork and rendered output files |
| Render | Application/backend hosting |
| Vercel | Frontend (builder UI) hosting |
| Neon | Database hosting |
| Resend | Transactional email delivery |
| Sentry | Error monitoring and diagnostics |
| Better Stack | Uptime monitoring and logging |
| Replicate | Optional AI image processing (e.g., background removal, upscaling), only when that feature is used |
| Canva, Dropbox, Google | Optional cloud-import sources, only when you choose to import a file from them |
When an optional AI image feature is used, the selected image is transmitted to Replicate solely to run the requested processing model; the processed result is returned to us and stored with the design like any other uploaded artwork.
We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice where required).
6. Data retention
We keep merchant account data for as long as the app is installed and as needed to provide the Services. Uploaded artwork and rendered output are retained for a limited operational period to fulfill and reprint orders, after which files are subject to automated cleanup. Current cleanup windows (which we may adjust for operational reasons): draft designs that were never purchased are removed after about 30 days; full-resolution files uploaded through the pre-made upload flow are removed about 30 days after the order (a small preview thumbnail is kept much longer so merchants can identify past orders); builder uploads unused for about 90 days are removed; and error-diagnostic logs are removed after about 60 days. Purchased builder designs and their print-ready output are kept while the app remains installed so orders can be reprinted and, where the merchant enables it, edited. When a merchant uninstalls the app, or upon a valid deletion request, we delete or de-identify the associated data within the timeframes required by Shopify and applicable law.
7. Shopify data requests & deletion
As a Shopify app, we honor Shopify’s mandatory data-protection webhooks. When Shopify notifies us of a customer data request, a customer redaction, or a shop redaction, we respond by providing or deleting the relevant data as required. Merchants and shoppers may also contact us directly at support@coricor.com to make a request.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EU/UK (GDPR) and California (CCPA/CPRA), among others, have specific rights. To exercise any of these, email support@coricor.com; we will respond within the period required by applicable law. Shoppers should note that, because we act as a processor for the merchant, we may direct certain requests to the merchant who controls that data.
9. Data security
We use industry-standard measures to protect information, including encryption in transit, access controls, scoped credentials, and reputable hosting providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address vulnerabilities promptly.
10. International transfers
We are based in the United States and our providers may process data in the U.S. and other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.
11. Children’s privacy
The Services are intended for businesses and are not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Services after an update constitutes acceptance of the revised policy.
13. Contact us
Martin Graphics Enterprises
Illinois, United States
Email: support@coricor.com