Privacy Policy

1. Information we collect

We try to collect only what we need to run the Services. If you decline required information, some features will not work.

1.1 Information you give us

We do not ask for special-category data (health, race, religion, political opinions, sexual orientation). Please do not put that information in Gerber notes, tickets, or forms.

1.2 Information collected automatically

• IP address, approximate location derived from IP, browser type and version, device type, operating system, language, referring URL, pages viewed, timestamps, and diagnostic logs.
• Cookies and similar storage, as described in our Cookie Notice.
• Security and rate-limit data (for example, too many login or quote requests from an IP).

1.3 Information from third parties

• Google: if you sign in with Google.
• Stripe: payment success, failure, dispute, and refund events.
• Carriers and production suppliers: tracking numbers, production status, and shipping events needed to show order progress.
• Analytics providers: if enabled on the site (see the Cookie Notice).

2. How we use personal information

We do not use automated decision-making that produces legal or similarly significant effects without human involvement. Engineering review of orders is performed by people.

3. How we share personal information

We share personal information only as needed:

1. Manufacturing facilities and production suppliers (currently located in mainland China). They receive only what is needed to build your order, such as Gerber and related files, process parameters, quantities, and the shipping details needed to dispatch it. They do not receive your payment card data.
2. Logistics partners and carriers, for DDP delivery into the United States (name, address, phone, parcel contents as required for customs).
3. Stripe, to charge and refund.
4. Google, if you choose Google sign-in.
5. Cloud infrastructure, including object storage for production files (we use S3-compatible storage) and email delivery.
6. Professional advisors (lawyers, accountants) under confidentiality.
7. Authorities, when we believe disclosure is required by law, a valid legal demand, or to protect rights, safety, or the integrity of the Services.
8. A buyer of our business, in a merger or asset sale, under a duty to protect the information at least as well as this Policy.

We do not share your account information with affiliated companies for their own marketing, and we do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA.

We may share aggregated or de-identified statistics that cannot reasonably identify you.

4. International transfers

The contracting entity is incorporated in Hong Kong, and production takes place in mainland China. Production files, order data, and account data may therefore be transferred to and processed in Hong Kong, mainland China, and other countries where our infrastructure vendors have servers (including the United States).

Data protection laws in these locations may differ from those where you live. We use contractual and technical safeguards (TLS in transit, access control, hashed passwords, signed URLs for private files) and share only what each recipient needs.

If you would prefer that your design files not be processed in Hong Kong or mainland China, please do not upload files or place an order. Instant quoting still sends parameters to our systems.

5. Retention

When we no longer need personal information, we delete or anonymize it. Deletion from backups follows our backup retention schedule.

6. Security

We use TLS for traffic to the Services, hashed passwords, least-privilege access for staff, encrypted storage for payment-channel credentials, and private object storage with time-limited download links for production files. Stripe is PCI-DSS compliant; card data is entered on Stripe’s pages, not on ours.

No method of transmission or storage is completely secure. Protect your password and log out on shared computers.

If a breach that requires notice under applicable law occurs, we will notify you and regulators as required.

7. Your choices and rights

Depending on where you live (for example, California, or the EEA or UK to the extent the GDPR or UK GDPR applies to our processing), you may have the right to:

• access or receive a copy of the personal information we hold;
• correct inaccurate information;
• delete information, subject to records we must keep;
• restrict or object to certain processing;
• receive the information you provided to us in a portable format;
• opt out of marketing emails (unsubscribe link in each message);
• appeal a denial of a privacy request;
• not be discriminated against for exercising a privacy right.

You can correct most profile and address data in your account. For other requests, email service@ezpcba.com. We will need to verify it is you (for example, from the account email). We respond within the time required by applicable law (generally 45 days in California and one month under the GDPR) and will let you know if an extension is needed.

You may complain to your local data-protection authority if you believe we have mishandled your information.

“Do not sell or share.” We do not sell personal information. If our use of cookies or similar technologies is ever considered “sharing” under California law, you can opt out at any time through the Do Not Sell or Share My Personal Information link in the site footer.

8. Children

The Services are not directed at children. We do not knowingly collect personal information from children under 16. If you believe we have, contact us and we will delete it.

9. Third-party sites and ads

The site may link to carriers, Stripe, Google, or documentation hosted elsewhere. Their privacy policies apply to those sites. We do not currently use third-party advertising networks on the site. If that changes, the technologies involved will be listed in the Cookie Notice.

10. Additional notice for California residents (CCPA/CPRA)

In the preceding 12 months, we may have collected the categories of personal information described in Section 1: identifiers (name, email, IP, account ID); commercial information (quotes and orders); internet activity (logs and cookies); geolocation at city/state level from IP or the address you type; professional information (company, job title if you give it); and customer files you upload (which may contain personal information if you put it there).

We collect them for the purposes in Section 2, from you, from your device, and from the third parties in Section 1.3. We disclose them to the service providers and partners in Section 3. We do not sell them. We do not use sensitive personal information for purposes other than those permitted by the CPRA (for example, we use an address to ship, not to infer characteristics).

To exercise California rights, email service@ezpcba.com. You may use an authorized agent with proof of authority. We will not retaliate against you for making a request.

11. Changes

We may update this Policy by posting a new version with a new “Last updated” date. Material changes will be highlighted on the site or emailed to the account address when the law requires notice.