CrossBatchPrivacy policy
CrossBatch is a production-queue app for made-to-order shops, made by DrMaker3D LLC. It runs inside a merchant's Shopify admin and can also take in the merchant's Etsy orders, from the order file the merchant downloads from Etsy and uploads, or through a direct Etsy connection where that's available. This policy explains what CrossBatch collects, why, where it is kept, and how it is deleted. Questions go to support@drmaker3d.com.
Who this covers
- Merchants who install CrossBatch on their Shopify store.
- Their customers, whose order details CrossBatch processes on the merchant's behalf. For customer data, the merchant is the controller and CrossBatch is a processor.
- Visitors to crossbatch.drmaker3d.com, including anyone who joins the Etsy-only waitlist.
What we collect and why
| Data | Source | Why |
|---|---|---|
| Store details: shop domain, name, contact email, timezone, and the access token Shopify issues to the app | Shopify | To sign in, read orders, show dates in the store's timezone, and send the store a few account emails (a welcome and a notice before a paid plan's free trial ends) |
| Order details: order number, line items, quantities, product and variant, SKU, product image, personalization (line-item properties), and fulfillment and tracking | Shopify, Etsy | To create production jobs, job sheets and batches |
| Etsy order files the merchant uploads | The merchant | Read once to create jobs and then discarded; only the order, item and customer details above are kept, not street addresses or prices |
| Etsy sale emails the merchant forwards to their CrossBatch address | The merchant (originally from Etsy) | Read once to create jobs and then discarded; we keep the order, item and customer name and city above, plus a 30-day log of what each email did. The buyer email address in these emails is not stored. |
| Customer details on those orders: name, email, and shipping city and region | Shopify, Etsy (name and city only; Etsy does not share buyer email) | To label jobs and, if the merchant turns it on, email order status updates and proof links |
| Etsy connection, only where connected: Etsy shop ID and name, and OAuth tokens | Etsy | To import Etsy orders and, if enabled, post tracking to Etsy |
| Merchant settings: machines, materials, product rules, batches, notes, email templates, and storefront options | The merchant | To run the app |
| Proofs: images or PDFs the merchant uploads, and the customer's approval or requested changes | The merchant and their customer | To get a design approved before production |
| Email delivery status (delivered, bounced, complained) | Resend | To stop emailing addresses that bounce |
| Admin page speed: how long each CrossBatch page took to load and respond, and which page it was | Shopify App Bridge, in the merchant's browser | To find and fix slow pages; no customer data is included |
| Waitlist email and where the seller sells | The visitor | To send one email when CrossBatch works without Shopify |
CrossBatch does not collect payment card data. It does not sell personal data, use it for advertising, or share it with data brokers. The website sets no analytics or advertising cookies.
Where it is stored
Data is stored in a PostgreSQL database hosted by Railway in the United States. Etsy tokens are encrypted with AES-256-GCM before they are stored. All traffic uses HTTPS. We use these service providers, each only for the purpose listed:
- Railway: application hosting and the database.
- Resend: sending the emails a merchant turns on, and receiving the Etsy sale emails a merchant forwards.
- Cloudflare: DNS for crossbatch.drmaker3d.com.
- Shopify and Etsy: the platforms the data comes from.
How long we keep it
- Raw webhook payloads are cleared as soon as they are processed, and the processed records are deleted after 30 days.
- Jobs, proofs and settings are kept while the app is installed, so the merchant can see production history.
- When a merchant uninstalls CrossBatch, Shopify asks us to delete the shop's data about 48 hours later, and we delete all of it: jobs, proofs, settings, logs and tokens.
- When a customer asks a merchant to erase their data, Shopify tells us and we remove their name, email, address and personalization from the matching jobs, and delete any proofs for those orders.
- Admin page-speed measurements are deleted after 35 days.
- Disconnecting Etsy deletes the Etsy tokens straight away.
- Waitlist emails are kept until we send the one announcement, or until you ask us to remove yours.
Your choices and rights
Merchants can see and change their data in the app, and can ask us for a copy or for deletion at any time. Customers should contact the shop they bought from; the shop's request reaches us through Shopify, and we act on it. Anyone can email support@drmaker3d.com to ask what we hold about them, to correct it, or to have it deleted. Depending on where you live, laws such as the GDPR or the CCPA may give you further rights, and we will honor them.
Changes
If this policy changes in a way that matters, we will update the date above and tell installed merchants in the app.
Contact
DrMaker3D LLC · 12 West Ledge, Burlington, CT 06013 · support@drmaker3d.com