Privacy Policy

1. Information we collect

• Account information: name, email address, account type (buyer or seller) and password when you sign up. Passwords are stored only as a one-way salted hash (bcrypt); we cannot see your password. We record when your email address was verified and when you last signed in.
• Seller information: display name, username, country of residence (for payout and tax-form instructions), uploaded designs and listing details, and, when payouts are enabled, payout and tax information.
• Order information: items purchased, amounts, shipping name and address, email, payment status and, for orders shipped to Japan, a phone number that we pass only to our print partner and the delivery carrier. Card details are entered directly with Stripe (or PayPal) — we receive only limited information such as the last four digits and card brand, never the full card number.
• Reports and messages: information you include when you flag a design or contact us (such as your name, email, the reason and details of your concern). Each report gets a private status link; reviewer notes stay internal.
• Security information: to prevent abuse we keep short-lived counters of sign-up, login, verification-email and report attempts keyed to your IP address or email address.
• Technical information: IP address, browser and device type, pages viewed, and logs generated by our hosting provider for security and troubleshooting.

2. Cookies and local storage

We use a small number of strictly necessary cookies: a secure, httpOnly session cookie that keeps you signed in to your account for up to 30 days (removed when you log out), a cookie that keeps an administrator signed in, and cookies set by Stripe on its checkout page for fraud prevention. We store your cart in your browser's localStorage so it survives page reloads; it stays on your device until you check out, clear it, or clear your browser data. Older versions of the Site kept a sign-in profile in localStorage; we only read it to help you move to a server account and it is not used to sign you in. We do not currently use advertising cookies or cross-site tracking. If we add analytics or advertising tools we will update this policy and, where required, ask for consent.

3. How we use information

• to operate the Site, your account and your listings, including verifying your email address before you can sign in, sell or check out;
• to process payments, fulfil and ship orders, and handle refunds and customer support;
• to calculate Seller earnings, the 15% platform fee and payouts;
• to review intellectual property reports, prevent fraud and abuse, and keep the Site secure;
• to send transactional emails (email verification, receipts, shipping updates, report status updates, account notices) and, with your permission, occasional marketing you can opt out of; and
• to comply with legal obligations and enforce our Terms.

4. How we share information

We share information only with service providers who help us run the Site, under contracts that limit their use of it: Stripe and PayPal (payment processing), Printful (printing and shipping — receives your name, shipping address and order details), Resend (sends our transactional emails — receives your email address, name and the content of the email), ImprovMX (receives and forwards email you send to our support@, legal@, sellers@ and privacy@ addresses — processes your email address and message), Vercel (hosting and file storage), and Neon (database). When sales-tax calculation is enabled, Stripe Tax uses your billing and shipping address and order amounts to calculate and record sales tax, and Stripe may use that information for tax compliance and reporting. We may also share information: with a rights holder or the affected Seller as part of a copyright or trademark complaint (a DMCA counter-notice is forwarded to the complainant); when required by law or to protect rights and safety; and with a successor in a merger or acquisition. Buyers' shipping addresses are not shared with Sellers. Information a Seller chooses to publish — display name, profile username, designs, titles and descriptions — is public on the Site; Seller email addresses are not shown publicly.

5. Data retention

We keep account information while your account is active; you can ask us to delete your account at any time. Sign-in sessions expire after 30 days, email verification links expire after 24 hours and are single-use, and abuse-prevention counters are overwritten within hours. If we suspend an account for a Terms violation we keep a record of the suspension and its reason. If a seller profile is deactivated or deleted, its public profile page and designs are removed from the Site (deleted designs are also removed from our print partner's product catalog), while related order and payment records are kept as described below. Order and payment records are kept for at least seven years for tax, accounting and chargeback purposes. Intellectual property reports and moderation records are kept as long as needed to administer our repeat-infringer policy and defend legal claims. Server logs are kept for a limited period by our hosting provider. When information is no longer needed we delete or anonymize it.

6. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing.

• California (CCPA/CPRA): you have the right to know what personal information we collect and how we use and disclose it, to delete and correct it, and to not be discriminated against for exercising your rights. We do not sell or "share" personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics. You may use an authorized agent.
• EEA/UK (GDPR): our legal bases are performance of a contract (orders, accounts), legitimate interests (security, fraud prevention, IP enforcement), legal obligation (tax records) and consent (optional marketing). You may withdraw consent at any time and lodge a complaint with your local data protection authority. Our providers may process data in the United States under appropriate safeguards such as standard contractual clauses.
• Japan (Act on the Protection of Personal Information, APPI): FanSourced is based in the United States and serves customers and sellers in Japan, so the APPI applies to how we handle personal information about people in Japan. Transfers to third parties in foreign countries (APPI Article 28). When you order or sign up from Japan, your personal information (name, email, shipping address, phone number for the delivery carrier, order and payment details) is provided to and stored by recipients outside Japan, mainly in the United States: Stripe and PayPal (payments), Printful (printing and shipping; the order may also be processed at the Printful facility that makes it — for orders to Japan usually Japan or the United States — and by the carrier), Resend (email), ImprovMX (email forwarding), Vercel (hosting and file storage) and Neon (database). The United States has no single comprehensive federal privacy law equivalent to the APPI; protection comes from sector-specific federal laws, Federal Trade Commission enforcement and state laws such as California's CCPA/CPRA. Information about foreign privacy systems is published by Japan's Personal Information Protection Commission (ppc.go.jp). These recipients process data under contracts and published policies that require security safeguards and limit use to providing their service. By placing an order or creating an account from Japan after reading this notice, you consent to these transfers; they are necessary to make and deliver your order, so we can't fulfil an order without them. You may ask us at privacy@fansourced.net to disclose, correct, stop using or delete your personal information, or for more information about the recipients' safeguards.

  （日本のお客様へ・個人情報保護法第28条に基づく外国にある第三者への提供について）当店は米国の事業者です。ご注文・ご登録の際にご提供いただく個人情報（氏名、メールアドレス、お届け先住所、配送業者用の電話番号、注文・決済情報）は、主に米国の事業者（決済：Stripe・PayPal、製造・配送：Printful（製造を担当する工場の所在国（日本向けは通常日本または米国）および配送業者を含む）、メール送信：Resend、メール転送：ImprovMX、ホスティング：Vercel、データベース：Neon）に提供・保管されます。米国には日本の個人情報保護法に相当する包括的な連邦法はなく、分野別の連邦法、連邦取引委員会（FTC）による執行、カリフォルニア州のCCPA/CPRA等の州法により保護されています（外国の制度については個人情報保護委員会のウェブサイトをご参照ください）。提供先は、契約および公表されたポリシーに基づき安全管理措置を講じ、サービス提供の目的にのみ利用します。本記載をご確認のうえご注文・ご登録いただくことで、これらの提供に同意いただいたものとします。開示・訂正・利用停止・削除等のご請求は privacy@fansourced.net までご連絡ください。

To exercise any right, email privacy@fansourced.net from the address on your account. We will verify your request and respond within the time required by law (generally 30–45 days).

7. Children

The Site is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, contact us and we will delete it.

8. Security

We use HTTPS, payment processors that are PCI-DSS compliant, and access controls on our systems. Passwords are hashed with bcrypt, session and verification tokens are stored only as hashes, and repeated login attempts are rate-limited. No system is completely secure, so please use a strong, unique password.

9. Changes and contact

We will update the "Last updated" date when this policy changes and notify you of material changes where required. Privacy questions and requests: privacy@fansourced.net.

FanSourced is an online-only business. We do not have a public office or mailing address for customers and we do not offer phone support. Please contact us, and send any notice, by email:

• General questions and orders: support@fansourced.net
• Legal notices, DMCA/IP notices and arbitration notices: legal@fansourced.net
• Privacy requests: privacy@fansourced.net
• Sellers and payouts: sellers@fansourced.net