Privacy Policy

PODMach is operated by ZAW Labs LLC, an Oklahoma company. This policy covers the website at podmach.com, the application at app.podmach.com, PODMach University, and every related feature we offer (together, the “Service”).

By using the Service you agree to the collection and use of information described here. It forms part of our Terms of Service. If you do not agree, please do not use the Service.

2.1 Information you provide directly

• Account information: your email address and password when you sign up. Passwords are stored as salted bcrypt hashes; we never see or store your plaintext password.
• Profile information: optional fields you choose to add (display name, phone, address) when configuring the Service.
• Designs and product assets: images, PSD files, mockups and other creative assets you upload to manage your print-on-demand catalog.
• Listing and product data: titles, descriptions, tags, pricing, variants and other details you enter or generate to publish products to your sales channels.
• Support communications: when you contact us by email, through the contact page or in the app, we keep a record of the conversation to provide ongoing support.

2.2 Information from integrations you authorize

When you connect a third-party platform (Printify, Printful, Etsy, Shopify, WooCommerce and similar), we receive and store the following on your behalf:

• OAuth access and refresh tokens needed to act as you on the platform’s API. These are encrypted at rest with AES-256-GCM before being written to our database.
• Platform account identifiers (shop IDs, user IDs) so the Service can scope data to the correct connected account.
• Order data synced from the platform, including your customer’s email and shipping address when you choose to sync orders.

We never see or store the password you use with the third-party platform. OAuth lets us act on your behalf without ever holding your credentials.

2.3 Information we collect automatically

• Usage data: the pages you visit, features you use and actions you take. We use this to operate and improve the Service.
• Device and browser data: IP address, browser type, operating system and similar technical context included with every web request.
• AI usage data: the prompts you submit to MACH AI and the results returned, stored to log credit consumption and detect abuse.
• Error and performance data: when the Service fails or behaves unexpectedly, we capture a stack trace and the URL where it happened so we can diagnose and fix it.

2.4 Information from our payment processor

Payment is handled by Stripe. We do not store your card number, CVV or full bank account details. We store the Stripe customer and subscription IDs so we can reconcile your plan and limits with your billing record, plus the card brand and last four digits for display in the billing settings.

We use the information above to:

• provide and operate the Service: authenticate you, render your dashboard, sync products and orders with your sales channels;
• process payments and grant access to paid features;
• send transactional email such as signup confirmation, password reset, billing receipts and account-deletion confirmations;
• detect and prevent abuse: rate-limit failed logins, block credential stuffing, throttle AI usage that would exhaust provider quotas;
• improve the Service through analytics (see Section 5 for when that runs);
• respond to your support requests and meet our legal obligations;
• where you have opted in, send occasional product-update or feature-announcement emails. Every one has an unsubscribe link.

We do not sell your personal information. We share it only with the providers needed to operate the Service:

• Supabase (Inc.) / AWS

  Purpose: Database, authentication, file storage

  Data shared: All account and content data

• Vercel

  Purpose: Hosting for podmach.com (this website)

  Data shared: Request and response in flight, including your IP address and browser details; no persistent storage of your account data

• Railway

  Purpose: Hosting for the application at app.podmach.com

  Data shared: Request and response in flight; no persistent storage

• Stripe (Inc.)

  Purpose: Subscription billing and payment processing

  Data shared: Email, billing address, card details (entered directly into Stripe's form, never stored by us)

• Loops (Loops Email Inc.)

  Purpose: Transactional and account email

  Data shared: Email address, name, email content

• Amazon SES (AWS)

  Purpose: Email infrastructure under Loops

  Data shared: Email address and message content

• Printify, Printful

  Purpose: Print-on-demand fulfilment of your published designs

  Data shared: Design files, product configurations, your OAuth token

• Etsy, Shopify, WooCommerce

  Purpose: Sales-channel sync for your listings and orders

  Data shared: Listing data, product images, your OAuth token

• OpenAI

  Purpose: AI-generated titles, descriptions and image analysis

  Data shared: Prompts and design images you submit

• Anthropic

  Purpose: AI-generated content for select tools

  Data shared: Prompts you submit

• Replicate

  Purpose: AI image generation and processing

  Data shared: Prompts and reference images you submit

• Sentry

  Purpose: Error and exception tracking

  Data shared: Stack traces, request URLs, your user ID (no message bodies)

• PostHog

  Purpose: Product analytics. On podmach.com it is on by default for visitors in the United States until they turn it off, and only with analytics consent everywhere else

  Data shared: Page views and product events (for example “listing published”); once you sign in, your account ID, email address and plan tier so we can understand how accounts use the Service. The same anonymous visitor ID is used on podmach.com and app.podmach.com so a signup can be linked to the visit that led to it

• Plausible

  Purpose: Aggregate website traffic counts

  Data shared: Page URL, referrer, browser and country, derived from a truncated IP address that is discarded. No cookies, no cross-site tracking, no persistent identifier; it runs without consent because it stores nothing on your device

• Meta (Facebook) Pixel and Conversions API

  Purpose: Measuring whether our advertising on Meta platforms leads to trial signups on podmach.com

  Data shared: In your browser on podmach.com (on by default for visitors in the United States until they turn it off; only after analytics consent everywhere else): page views and signup-form events. From our server, only while that setting is on and you submit the signup form: a SHA-256 hash of your email address, the Meta browser identifiers (_fbp/_fbc), your IP address and browser user agent, so a blocked browser Pixel is still counted. From our server when a trial starts: a SHA-256 hash of your email address and your subscription reference, used only to match the signup to an ad click. We never send your name, password, store data or designs to Meta

• Upstash / Cloudflare

  Purpose: Rate-limiting counter store

  Data shared: IP address (transient, for the rate-limit window only)

• BetterStack

  Purpose: Uptime monitoring

  Data shared: Health-check responses (no user data)

We require each of these providers to maintain at least the data-protection standards we apply ourselves.

We will also disclose your information if compelled by law (a subpoena, court order or similar) and will tell you about the request unless we are legally prohibited from doing so.

We use a small number of cookies and similar storage mechanisms:

• Essential cookies keep you signed in, remember your plan and protect against cross-site request forgery. These are always on; the Service does not work without them.
• Analytics cookies (PostHog) on podmach.com are on by default for visitors in the United States, who can turn them off at any time from the cookie banner or the “Cookie settings” link in the footer. For visitors everywhere else they load only after you accept analytics in the cookie banner. We work out which applies from the country of your IP address, which we do not store. Before you sign in they record an anonymous visitor ID, the pages you visited and the features you used. After you sign in, that activity is linked to your account (user ID, email address and plan tier) so we can see how accounts use the Service and fix what gets in the way. The PostHog cookie is set for podmach.com and its subdomains so the visit that led to a signup can be connected to the account.
• Cookieless traffic counts (Plausible) run on podmach.com and app.podmach.com without consent because they set no cookie and keep no identifier: only aggregate page counts, referrers, browsers and countries.
• Marketing cookies (Meta Pixel) are set only on podmach.com, follow the same setting as analytics cookies (on by default in the United States until you turn them off, opt-in everywhere else), and are used only to measure whether our advertising on Meta platforms led to a trial signup. While that setting is on, submitting the signup form also sends Meta the same signup event from our server so it is counted when your browser blocks the Pixel. When a trial starts we also send Meta a one-way hash of your email address from our server for the same purpose (see Section 4). Turning analytics off stops the Pixel and the signup-form server event; the trial-start signal is sent only for accounts that actually start a trial.

You can change your choice at any time on this website, or in the app under Settings → Preferences → Privacy. Your choice is stored in this browser and, once you are signed in, on your account so you are not asked again on another device.

Open cookie settings

MACH AI drafts listing copy, generates mockups and analyzes design images. When you use these features:

• your prompts and any submitted images are sent to the AI provider listed in Section 4 to process the request;
• the provider’s response is returned to you and stored in your account for your own use;
• we do not train AI models on your prompts or designs, and our agreements with our AI providers require the same of them;
• AI output is not guaranteed to be accurate, original or fit for any purpose. You are responsible for reviewing it before use.

• Active accounts: we keep your data as long as your account exists.
• Deleted accounts: when you delete your account we mark it as pending deletion for 30 days, during which you can contact support to restore it. After 30 days all account data is permanently removed, including profiles, designs, listings and integration tokens. Some operational records (for example invoice history required for accounting) may be kept for the period the law requires.
• Backups: database backups roll off on a 7-day cycle, so deleted data may persist in a backup for up to 7 days before it is fully purged.
• Server logs: rotated daily and discarded after 14 days.

We protect your data with industry-standard practices:

• every connection uses TLS (HTTPS) encryption in transit;
• the database is encrypted at rest by Supabase;
• integration OAuth tokens are additionally encrypted with AES-256-GCM using a key held outside the database;
• row-level security policies restrict every database table to the rows you own;
• passwords are checked against the Have I Been Pwned breached-password database at signup and rejected if known to be compromised;
• authentication and AI endpoints are rate-limited to mitigate abuse.

No system is perfectly secure. If we ever experience a data breach, we will notify affected users by email and on the website within the time the applicable law requires.

You have the following rights over your information:

• Access and export: download a copy of your data from the Data section of the app’s settings, or email us at the address below.
• Correction: update your profile information in the app’s settings.
• Deletion: request account deletion from the Account section of the app’s settings. This starts the 30-day window described in Section 7.
• Opt out of analytics and ad measurement: use the cookie banner, the “Cookie settings” link in the footer, the button in Section 5, or Settings → Preferences → Privacy in the app.
• Withdraw consent: for any consent you have given (for example to marketing email), you can withdraw it at any time without affecting processing that already happened.
• Complain: if you are in the EU or UK, you can complain to your local data protection authority.

We respond to verified requests within 30 days and may need to confirm your identity before completing one.

PODMach is operated in the United States and our database and file storage are hosted in Supabase’s us-east-1 region. If you use the Service from outside the U.S., your data is transferred to and processed in the U.S. We rely on Standard Contractual Clauses with our processors to protect cross-border transfers.

PODMach is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. If we learn that we have, we delete it. If you believe a child has provided us with information, please contact us.

We may update this policy from time to time. When we do, we revise the “Last updated” date at the top and, for material changes, notify users by email or in the app. Continuing to use the Service after a change takes effect means you accept the revised policy.

Privacy questions, export requests, deletion requests and concerns can be sent to: