Legal

Account data: your name, email address, password hash or Google account link, phone number if you add one, language and timezone preferences, and company details you enter (company name, tax ID).

Order and fulfillment data: the orders you create or import — products, quantities, recipient names and shipping addresses, tracking numbers, and order notes. Recipient details belong to your customers; you are responsible for having the right to share them with us for fulfillment.

Financial records: your prepaid balance, transactions (top-ups, charges, refunds) and invoices. Card details are handled by our payment processors and never stored on our servers.

Technical data: server logs with IP addresses and request identifiers, kept for security, debugging and abuse prevention.

To run the service: producing and shipping your orders, moving money on your balance, sending the notifications you enable, and answering support tickets.

To keep the platform safe: authentication, rate limiting, audit logging of sensitive actions, and fraud and abuse detection.

We do not sell your data, and we do not use your data to train AI models.

If you connect an AI client (Claude, ChatGPT or another MCP-compatible app) or create an API key, that connection acts with your account's own permissions — it can never see more than your account can. Write actions require your explicit confirmation in the conversation.

What an AI client does with data it reads through your connection is governed by that provider's own privacy policy. You can revoke a connection or API key at any time from your profile; OAuth access tokens expire after 60 minutes and refresh tokens rotate on every use.

Every credential we store — password, API key, OAuth token — is stored hashed, never in plain text.

We use a small set of processors to run the service: Vercel (hosting), Neon (database), Resend (transactional email), our shipping carriers and label providers (to produce and deliver parcels — they receive recipient names and addresses), and our payment processors. Each receives only what its job requires.

Order and financial records are kept for as long as your account exists and as required for tax and accounting law. Server logs are kept for a limited operational window. When you delete your account, personal data is removed or anonymised except where the law requires us to keep it.

You can access and correct your account data in your profile, export your orders from the dashboard, disconnect AI clients and revoke API keys, and request account deletion by contacting support. If you are in a jurisdiction with statutory data rights (such as the GDPR), you can exercise them through the same contact.

When this policy changes materially we will note it on the changelog and update the effective date above.

OpCreative provides print-on-demand fulfillment: you place or import orders, we produce and ship them. Your account, its API keys and any AI clients you connect are yours to manage; everything done through them is done on your behalf.

Keep your credentials — password, API keys, connected AI clients — confidential. An API key carries your account's full authority; treat it like a password, and rotate or revoke it from your profile if it may have leaked.

You must provide accurate information, have the right to use the designs and artwork you upload, and have your customers' permission to share their shipping details with us for fulfillment.

Orders are charged against your prepaid balance at the prices shown at the time of assignment. Idempotency keys protect you from duplicate charges on retried requests.

Production begins once an order is assigned; cancellation and refund options narrow as an order moves through production and shipping. Refunds and balance adjustments are recorded as transactions you can review at any time.

•No unlawful, infringing or deceptive products or artwork.

•No attempts to breach, overload or probe the platform's security; respect the published API rate limits.

•No reselling of platform access itself or sharing one account across unrelated businesses.

We may suspend accounts that break these rules; where practical we will warn first.

The public API and the MCP server are provided for integrating your own systems and AI clients. They act with your account's permissions and are subject to these same terms. We may adjust rate limits and evolve the API; breaking changes are announced with a deprecation window, as described in the API reference.

The service is provided as-is. To the fullest extent the law allows, our liability for any claim is limited to the amount you paid us for the affected orders. We are not liable for delays or failures caused by carriers, payment providers or events beyond our reasonable control.

You can stop using the service and request account deletion at any time; your remaining balance is settled per the payment terms above. We may update these terms — material changes are noted on the changelog with an updated effective date, and continued use after a change means acceptance.