Privacy Policy

Who we are and what this policy covers

Good Game Apparel is the trading name used by GG Apparel Ltd for the services described on this site. This policy applies to personal data processed through our public storefront, creator and customer account flows, support channels, checkout and fulfilment workflows, creator tooling, and the public Shopify app we distribute to merchants.

Where we process merchant-customer information on behalf of a Shopify merchant, that merchant may also be a controller of that data for its own store relationship. In those cases we act both for our own service operations and, where relevant, as a service provider supporting the merchant's store operations.

The personal data we collect

Depending on how you use our services, we may collect and process the following:

• identity and contact details, such as your name, email address, billing or delivery address, telephone number, and support contact details;
• account and profile data, such as login credentials, creator tag, subscription tier, profile image, social handles, payout details you provide, and linked Discord account details;
• order, checkout, and fulfilment data, such as cart contents, product selections, customization text, order history, delivery information, and limited payment or Stripe customer metadata needed to process transactions;
• merchant and Shopify app data, such as shop domain, installation and authentication details, catalog publication settings, product publishing records, merchant-managed fulfilment data, and customer or order details received through Shopify APIs and webhooks;
• communication data, such as support chat messages, support email content, account enquiry details, and related conversation history;
• creator-tool and content data, such as uploaded artwork, product imagery, design prompts, generated assets, and files you submit when using creator features;
• device, browser, attribution, and usage data, such as IP address, browser type, log data, session identifiers, local-storage values, cookie-derived identifiers, TikTok attribution values such as ttclid or _ttp, Google advertising identifiers such as gclid, gbraid, or wbraid, OpenAI Ads attribution values such as oppref or __oppref, and anti-abuse signals including Cloudflare Turnstile responses;
• compliance and audit data, such as webhook records, deletion-request references, and security logs needed to investigate misuse, fraud, or legal claims.

How we use personal data

We use personal data to:

• operate the storefront, account areas, creator dashboard, support channels, and merchant app services;
• create and manage accounts, authenticate users, link Discord access, and maintain user preferences or creator profiles;
• process orders, take payment through third-party providers, arrange fulfilment, provide order updates, and resolve delivery or product issues;
• publish or manage merchant products in Shopify, sync owned-order data, and push fulfilment information back to merchant stores where our public app is used;
• send service and transactional communications, including account, checkout, support, and order-related emails;
• host and process uploaded media, render product previews, and support creator tooling such as image-generation or artwork workflows;
• monitor service performance, attribute traffic or conversions, improve products and user experience, and maintain internal reporting;
• detect, prevent, and investigate fraud, abuse, security incidents, or unlawful use; and
• comply with legal obligations, tax or accounting rules, and valid data-rights requests.

Our lawful bases

Where UK GDPR or similar laws apply, we generally rely on one or more of the following lawful bases:

• contract, where we need the data to create accounts, process orders, provide support, or operate merchant services you requested;
• legitimate interests, where we need the data to run, secure, improve, and administer our business and services in a proportionate way;
• legal obligation, where we must keep records, handle tax or accounting duties, respond to lawful requests, or support required Shopify compliance workflows; and
• consent where applicable law requires it for specific optional marketing, advertising, or similar processing activities.

Who we share data with

We share personal data only where needed to provide services, operate the app, or comply with law. Recipients may include:

• Shopify, for app installation, merchant authentication, product publishing, order synchronization, merchant-managed fulfilment workflows, and mandatory compliance webhooks;
• Stripe, for payment processing, checkout, and related customer or transaction metadata. We do not store full payment-card details ourselves;
• SendGrid, to send account, signup, welcome, support, or order-related transactional emails;
• Cloudinary, to store and deliver uploaded artwork, product media, and generated images;
• Discord, when you use Discord-based sign-in, linking, or support and community interactions;
• TikTok, where TikTok pixel or attribution tooling is enabled for campaign measurement and checkout attribution;
• Google advertising and analytics services, where Google tag, Google Tag Manager, Google Ads, or related conversion tooling is enabled for campaign measurement, attribution, and reporting;
• OpenAI advertising and measurement services, where the OpenAI Ads pixel is enabled after consent for campaign measurement and conversion attribution. Event details may include viewed or selected products, checkout, order, registration, or subscription activity and privacy-preserving SHA-256 hashes of an email or internal identifier when available, rather than the raw values;
• Cloudflare Turnstile, to help protect forms and signup flows from bots or abuse;
• OpenAI and related creator-tool providers, where prompts, uploads, or generated outputs are processed to provide creator tooling features; and
• professional advisers, hosting or infrastructure providers, regulators, courts, law enforcement, or transaction counterparties where disclosure is necessary and lawful.

We do not sell personal data as a standalone data-brokerage activity.

International transfers

Some of our providers or service infrastructure may be located outside the UK or European Economic Area. When personal data is transferred internationally, we aim to use lawful safeguards appropriate to the transfer, such as contractual protections, provider terms, or other recognized transfer mechanisms.

How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide services, maintain records, resolve disputes, enforce agreements, and meet legal, tax, accounting, or compliance obligations.

• account and profile records are normally kept while the account remains active;
• order, transaction, support, and merchant operational records may be kept for longer periods where needed for fulfilment history, audit, accounting, or dispute handling;
• media, generated assets, and product-operation records may remain available while they are required to support active listings, creator workflows, or merchant services; and
• minimal compliance or audit records may be retained after deletion or uninstall events where needed to demonstrate legal compliance, security, or business recordkeeping.

Your rights and Shopify data requests

Subject to applicable law, you may have the right to request access to, correction of, deletion of, restriction of, objection to, or portability of your personal data. You may also be entitled to complain to the UK Information Commissioner's Office or another relevant supervisory authority.

If you are a customer of a merchant using our Shopify app, that merchant may be the first point of contact for store-specific data requests. We also support Shopify's required compliance flows, including the standard customers/data_request, customers/redact, and shop/redact webhook processes used for app-store data-rights handling.

To make a privacy or deletion request, email [email protected].

Security and changes to this policy

We use reasonable technical and organizational measures to protect personal data, but no online service can guarantee absolute security. You should also keep your credentials secure and contact us promptly if you believe your account has been compromised.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the last-updated date.