Privacy policy

The Comfort Zone operates The Comfort Zone, where you design custom apparel in your browser and we have it printed to order. In this policy, “we”, “us” and “our” mean The Comfort Zone. We are the controller of the personal information described here, which means we decide why and how it is used.

This policy covers our website, the design studio, and the service that stores your artwork and passes it to our print partner. It does not cover other companies’ websites we link to, or a print partner’s or payment provider’s own use of your information for their own purposes — those are governed by their policies, and we link to the main ones below.

You can reach us about anything on this page at ilyaastoefy@proton.me.

When you place an order. Your name, delivery address, email address, phone number, the items and sizes you chose, and the design attached to each item. Checkout runs on Shopify, so what you type there is collected by Shopify on our behalf.

When you create an account. Your email address and, if you add them, your name and saved addresses. An account is optional — you can order as a guest.

When you sign up to our newsletter. Your email address, and the fact that you asked to be added.

When you contact us. Whatever you put in the message — your name, email, order number, and any photos you send us to support a claim. If store chat is switched on, the messages you send through it.

When you publish a design. The name you give the design and, optionally, a display name to be credited by. See clause 10.

The design studio runs in your browser. While you are designing, your work-in-progress stays on your own device and is not sent to us — see clause 5.

Three things change that:

• Adding to cart. Your design is flattened into high-resolution print files — one image per printed area — and uploaded to our storage. The web address of each file is attached to the cart line so the order can be fulfilled.
• Saving the design behind a cart line. So that clicking an item in your cart reopens the design you made rather than an empty garment, we also save the editable version — the individual layers, including a copy of any image you added — to our storage when you add to cart. It is reachable only through a long, unguessable reference held on that cart line: it is not listed anywhere, not searchable, and not published. If saving it fails, the cart line simply links to the plain product page instead.
• Generating a realistic preview. To show your design on a photograph of the actual garment, we send the print files to Printful’s mockup service and store the images it returns.

Anything you put into a design becomes part of that upload: photos you add, a logo, a name or number on the back of a shirt, a team roster. If a design contains personal information about you or anyone else, that information is in the print file and in the saved design. Please only include details you are entitled to use, and see clause 9 for who can reach the stored file.

We do not scan, index or analyse the content of your artwork, and we do not use it to build a profile of you. A person does look at designs submitted for publication, because those are going onto a public shop front.

On the website. Shopify records the usual technical detail as you browse: your IP address, browser and device type, the pages you view, what you put in your cart, and the site or advert you arrived from. This is what makes a cart persist and lets us see which products people look at.

On our design service. The service that stores artwork and handles publishing keeps ordinary server logs — request paths, timing, status codes, error messages, and identifiers such as an order number or a design reference. When you submit a design for publication, the service also notes the IP address it came from so that a single visitor cannot flood the queue. That note is held in memory only, for about a minute, and is never written to a file or database.

From other services your browser calls. The studio loads its typefaces from Google Fonts and its drawing library from the jsDelivr network. Those requests come from your browser, so your IP address and browser details reach those providers. We do not send them anything else about you.

The studio keeps a few things in your browser rather than in tracking cookies — in local storage, and, for your saved draft, your browser’s larger IndexedDB store. None of them is used for advertising:

• Your saved draft. Your design in progress, so you can close the tab and pick it up later. It is held in your browser’s IndexedDB store on your device — which has room for the images you upload — and this copy never leaves your device. It is separate from the copy we save when you add to cart, which is covered in clause 4.
• A preview cache. The addresses of preview images already produced for a design, kept for up to 24 hours and for the 24 most recent designs, so the same design is not rendered twice.
• A creator reference. A random identifier generated in your browser the first time you publish, so designs you publish can be grouped together and credited consistently. It is not derived from anything about you and is not linked to your name, email or order.
• A catalogue cache. The product list and print measurements, kept for six hours so the studio opens quickly.

The studio and the store also remember a few small preferences the same way: recently viewed products, your cart count, whether you last used the grid or list view, and whether you have dismissed the studio’s one-time tip about switching print panels.

You can clear all of this at any time through your browser’s settings for this site. Clearing it will lose any unsaved draft.

We use it to:

• take payment, and produce, pack and deliver what you ordered;
• send you order confirmations, dispatch notices and tracking;
• answer your questions and handle replacements, refunds and other claims;
• keep the accounting, tax and consumer-law records we are required to keep;
• run and secure the site — spotting errors, preventing fraud, and stopping abuse of our upload and publishing endpoints;
• moderate designs submitted for publication, and show published designs with their credit;
• understand in aggregate which products and pages people use, so we can improve them;
• send you marketing email, if and only if you asked for it.

We do not use your information to make automated decisions about you, and we do not sell it.

If you are in the United Kingdom or the European Economic Area, the law requires us to name a basis for each use:

• Performance of a contract — taking and fulfilling your order, including sending your details to our print partner, and dealing with returns and replacements.
• Legal obligation — keeping tax, accounting and consumer-protection records.
• Legitimate interests — keeping the service secure and working, preventing fraud and abuse, moderating public content, and understanding aggregate usage. We have considered your interests alongside ours and use the least intrusive means we reasonably can.
• Consent — marketing email, publishing a design to the public catalogue, and any non-essential cookies. You can withdraw consent at any time; withdrawing it does not affect anything done beforehand.

We keep this list short on purpose. Each of these is either necessary to fulfil an order or necessary to run the studio.

• Shopify — the platform the store and checkout run on. Holds your order, account and browsing data, and provides store chat where enabled. Shopify’s privacy policy.
• Printful — prints, packs and posts your order. Receives the recipient’s name, delivery address, phone number and email address, the garment and size, and the web addresses of your print files. Also generates the realistic garment previews. Printful’s privacy policy.
• Cloudflare — stores your print files, previews and published design records in its R2 object storage. Cloudflare’s privacy policy.
• Render — hosts the service that receives uploads, produces previews and handles publishing. Processes requests in transit and holds short-lived server logs. Render’s privacy policy.
• Google — serves the studio’s typefaces through Google Fonts. Receives your IP address and browser details when your browser requests a font. Google’s privacy policy.
• jsDelivr — the open-source content network the studio’s drawing library is served from. Receives your IP address and browser details when your browser requests the file.
• Payment providers — card and wallet payments are handled through Shopify’s checkout by the provider you choose. They receive your payment details directly; we receive only a confirmation and the last few digits of the card.

We also disclose information where we are legally required to — to a tax authority, a regulator, or in response to a valid legal request — and to professional advisers where necessary. If the business is ever sold or reorganised, order records may transfer with it; we would tell you first.

This is worth being blunt about, because it is a deliberate design choice rather than an oversight.

Your print files are stored in object storage that serves them over a public web address. The address contains a long fingerprint calculated from the file itself, so it cannot be guessed or browsed, and we never publish it. But there is no password on the file: anyone who has the exact address can open it.

It works this way because our print partner has to be able to fetch your artwork to print it, without holding an account with us. The alternative — signed, expiring links — would break a reprint months later.

What that means for you in practice: treat a design the way you would treat a photo uploaded to a link-sharing service. Please do not put anything in a design that would cause you harm if a stranger who somehow obtained the link could see it — identity documents, financial details, medical information, or anything similar.

If you want a specific file removed, email ilyaastoefy@proton.me with your order number and we will delete it, subject to clause 14.

Publishing is optional and off by default. There is a checkbox on the review screen before you add to cart; nothing is published unless you tick it.

If you do tick it, we store: the name you gave the design, the display name you chose to be credited by (if any), the garment and colour settings, the print files and preview images, the editable layers so others can make their own version, and — if you started from someone else’s design — a record of which design yours came from.

Your submission stays private until a person reviews it. If it is approved, it becomes a product on the public store, and your display name is shown as the credit. If it is rejected, it stays out of public view.

The creator reference stored with a published design is the random identifier from your browser described in clause 5. We do not attach your email address or your order to a published design, so a visitor cannot work back from a design to your identity.

To withdraw a published design, email ilyaastoefy@proton.me. We will unlist it. Orders already placed for it will still be printed and delivered.

Card and wallet payments are processed inside Shopify’s checkout by the payment provider you choose. Your full card number never reaches us and we never store it. What we receive is the outcome of the payment, the amount, and enough detail to identify the transaction for refunds and accounting — typically the card type and its last few digits.

We only send marketing email to people who asked for it. Every message has an unsubscribe link, and unsubscribing takes effect straight away. You can also email ilyaastoefy@proton.me and ask to be removed.

Unsubscribing from marketing does not stop transactional messages about an order you have placed — confirmations, dispatch notices, and anything we have to tell you about a delivery.

The companies listed in clause 8 operate internationally, so your information may be processed outside the country you live in, including in the United States.

Where information is transferred out of the United Kingdom or the European Economic Area, we rely on the safeguards the law provides — an adequacy decision covering the destination, or the UK International Data Transfer Agreement or the EU Standard Contractual Clauses in our agreements with that provider, together with any additional measures the transfer requires.

You can ask us for more detail on the safeguards that apply to a particular provider by writing to ilyaastoefy@proton.me.

• Order records — for as long as we run the store, and in any event for the period tax and accounting law in the jurisdiction in which we are established requires. That is commonly six or seven years from the end of the relevant financial year.
• Saved designs (the editable version behind a cart line, clause 4) — kept while the design may still be needed to reprint or amend an order. Ask us and we will delete a specific saved design; the reference on the cart line then stops working and the cart item links to the plain product page.
• Print files — indefinitely, so that a reprint or a warranty claim can be honoured against the exact file that was printed. Ask us and we will delete a specific file.
• Preview and mockup images — kept while they are in use; those attached to a published design are kept while it is listed.
• Published designs — until you ask us to remove one, or we remove it under our terms of service.
• Rejected submissions — kept as a moderation record, then deleted.
• Support messages — up to three years after the matter is closed, so we can deal with a repeat claim.
• Newsletter subscriptions — until you unsubscribe, plus a minimal record that you did so, so we do not add you back by mistake.
• Server logs — short-lived, in line with our hosting provider’s retention.
• Anything stored in your browser — on your device until you clear it. The preview cache expires on its own after 24 hours.

Depending on where you live, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct anything inaccurate;
• delete information we no longer have a reason to keep;
• restrict or object to a particular use, including any use we base on our legitimate interests;
• transfer information you gave us to another provider in a portable format;
• withdraw consent you previously gave, such as for marketing or for publishing a design.

Email ilyaastoefy@proton.me and we will reply within one month. We may need to check who you are before acting — usually by confirming an order number and the email address it was placed with. Exercising any of these rights is free, and we will not treat you differently for it.

Two honest limits. Where the law requires us to keep a record — a tax invoice, for instance — we cannot delete it on request. And if you ask us to remove a published design that another customer has already ordered, we will unlist it immediately but must keep the print file long enough to produce, deliver and support that order.

Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect and why, to request a copy of it, to have it corrected or deleted, and to be free from discrimination for asking.

The categories we collect are set out in clauses 2 to 5: identifiers, customer records, commercial information, internet activity, geolocation inferred from an IP address, and the content of the designs you create. Where each category comes from, why we use it and who we disclose it to are covered in clauses 3, 6 and 8.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly collect the personal information of anyone under 16, and we do not offer financial incentives for data.

To make a request, email ilyaastoefy@proton.me. An authorised agent may act for you if they provide written permission signed by you.

The store is not aimed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, email ilyaastoefy@proton.me and we will delete it.

The measures we actually have in place:

• Everything travels over encrypted connections, and payment pages are handled entirely by the payment provider.
• Order notifications from the store are cryptographically signed and verified before we act on them, so a forged order cannot enter the print queue.
• The moderation tools are behind a secret token and are switched off entirely when that token is not configured, rather than falling open.
• Uploads are size-capped and accepted only as images; our image proxy will only fetch from an approved list of hosts.
• Print files are named from a fingerprint of their own contents, so the same file uploaded twice is stored once and addresses are not guessable.
• Access to the systems holding order and design data is limited to the people who need it.

No service can promise perfect security. If a breach ever affects your personal information and the law requires it, we will tell you and the relevant regulator within the time limits that apply.

The store uses the cookies Shopify needs to work: keeping your cart, keeping you signed in, remembering your language and currency, and protecting the checkout against fraud. These are essential — the store cannot function without them.

Shopify also sets cookies that count visits and give us aggregate reporting about how the store is used.

As set up today, we do not run our own advertising or social-media tracking pixels on the store. If that changes we will update this page and, where consent is required, ask for it first.

The design studio uses local storage rather than cookies for its own purposes — see clause 5. You can block or clear cookies in your browser, but blocking the essential ones will break the cart and checkout.

We do not make decisions about you by automated means alone, and we do not profile you for advertising.

Two automated steps exist and neither decides anything about you: the studio warns you when an uploaded image is too low-resolution to print well, and the publishing endpoint limits how many designs one visitor can submit in a minute. Designs are approved or rejected by a person, not by software.

When we change this policy we will post the new version on this page and update the dates at the top. If a change materially affects how we use information you have already given us, we will tell you directly — by email where we hold your address — before it takes effect.

The version on this page is always the one that applies.

Write to us at ilyaastoefy@proton.me, or by post to:

The Comfort Zone
South Africa, Lansdowne, Cape Town, Western Cape, South Africa

Please tell us first if something is wrong — it is usually the fastest way to get it fixed.

You also have the right to complain to a data protection regulator. In the United Kingdom that is the Information Commissioner’s Office (ico.org.uk). In the European Economic Area it is the supervisory authority in the country where you live or work. Elsewhere, it is the authority with jurisdiction over the jurisdiction in which we are established.