Privacy Policy

Who we are

SPNStudio is an invitation-only portal for shop management, design assignment and delivery, and order coordination. It is operated by Enis Turkmen, based in Istanbul, Türkiye, referred to as “we” in this policy.

For privacy questions or requests, contact sellerpartnernetwork@spnstudio.com.

This policy covers the SPNStudio portal. Google, Etsy, and other services you use separately have their own privacy policies. A shop that supplies customer information remains responsible for its own customer notices and for having authority to share that information for fulfillment.

Information we use

• Account and profile information: your email address, name, phone number, invitation details, role, and shops you declare or are authorized to access.
• Authentication information: password hashes, sign-in sessions, two-step verification records, recovery-code hashes, and remembered-browser records. If you use Google sign-in, we use your Google account identifier and email information to authenticate and link your invited account.
• Shop and design information: shop identifiers, access grants, assigned designs, listing text, mockups, delivery status, and relevant file and folder identifiers.
• Order information: order references, customer contact and delivery details, product specifications, production notes, and tracking information entered by authorized users.
• Operational information: security and application logs, activity history, timestamps, and request information needed to investigate errors or unauthorized use.

Why we use it

We use this information to provide the portal, authenticate users, manage access, maintain business records, assign and deliver designs, coordinate fulfillment, send service messages, and provide support. We also use relevant information to prevent misuse, investigate incidents, and meet applicable legal obligations.

Where applicable data-protection law requires a legal basis, we rely on performance of our agreements for requested services, legitimate interests in secure and reliable business operations, compliance with legal obligations, or consent where required. You choose whether to authorize optional Google access and can withdraw that access.

Google Drive connection

Connecting Google Drive is optional and separate from signing in. You may connect a different Google account from your portal email. The account you select determines where your assigned designs are delivered.

For delivery, SPNStudio requests the drive.file permission. This permits access to files the app creates or that you specifically make available to it. It does not grant general access to all files in your Drive.

After authorization, the portal finds or creates a Portal deliveries folder and uploads assigned design packages into folders named for their SKUs. We store the destination folder identifier and an encrypted refresh token so deliveries can continue without asking you to sign in to Google for every upload. Access tokens are used to make authorized Google API requests.

The operator's separate design-import integration reads source assets authorized by the operator. Connecting your Drive for delivery does not make your personal Drive a source for that importer.

Limits on Google data use

We use Google user data to provide and support the disclosed portal features. We do not sell it, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models. Human access is limited to uses permitted by Google's policy, such as support with your agreement, security investigations, or legal obligations.

SPNStudio's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

Who can access information

Authorized portal users can access information according to their roles and responsibilities. Administrative and fulfillment roles may need account, customer, and order information to support users and coordinate production and shipping.

We use AWS for hosting and asset storage, Supabase for the database, Resend for service email, and Google for optional Google sign-in and Drive delivery. These providers process the information needed for their respective functions. Relevant order information may also be provided to production and shipping partners to fulfill an order.

We may disclose information where required by law or necessary to protect users, investigate abuse, or defend legal rights. We do not sell personal information.

Our operator and service providers may process information in different countries. Where applicable law requires safeguards for an international transfer, we use the safeguards required for that transfer. Contact us for information about the arrangements relevant to your data.

Retention and deletion

We retain information for as long as needed to provide the service, maintain relevant business records, resolve disputes, protect security, or meet legal obligations. The appropriate period depends on the type of record, the ongoing business relationship, and applicable requirements.

You can disconnect Drive in Account settings → Manage Google Drive. Disconnecting deletes the portal's saved connection credentials and pauses deliveries that need that connection. It does not delete files already delivered to your Drive or revoke the project's permissions in your Google account. You can separately remove access through Google account connections.

Suspension or deactivation of a portal account does not automatically erase account, order, or audit records. Contact us to request deletion. We will assess the request, remove information that is no longer needed, and explain any records that must be retained. Deletion from active systems may not immediately remove copies in backups, which remain protected until they expire or are removed.

Security and cookies

The portal uses HTTPS, access controls, password hashing, and encryption for stored Drive refresh tokens. These measures reduce risk but cannot guarantee that every security incident will be prevented.

We use cookies for sign-in sessions and security. If you choose to remember a browser for two-step verification, a browser credential is also stored for that purpose. The sign-in page also remembers which sign-in method your browser used last, so that it can mark that method; this cookie holds only the name of the method. Blocking required cookies can prevent sign-in from working. The portal does not use advertising cookies.

Your choices and rights

You can update available profile information in Account settings and disconnect Google Drive there. Contact sellerpartnernetwork@spnstudio.com to request access, correction, deletion, or an explanation of the information we hold about you. We may need to verify your identity before acting on a request.

Depending on the law that applies to you, you may also have rights to restrict or object to processing, receive portable information, withdraw consent, or complain to a competent data-protection authority. Withdrawing consent does not affect the lawfulness of processing before withdrawal. We will handle requests within the period required by applicable law.

Policy updates

We will change the date above when this policy is updated and communicate material changes through an appropriate service channel.

See also our Terms of Service.