Privacy Policy

Who we are and what this policy covers

Good Game Apparel is the trading name used by GG Apparel Ltd for the services described on this site. This policy applies to personal data processed through our public storefront, creator and customer account flows, support channels, checkout and fulfilment workflows, creator tooling, and the public Shopify app we distribute to merchants.

Where we process merchant-customer information on behalf of a Shopify merchant, that merchant may also be a controller of that data for its own store relationship. In those cases we act both for our own service operations and, where relevant, as a service provider supporting the merchant's store operations.

Good Game mobile app

The creator and agency companion app processes account names, email addresses and identifiers, artwork you choose to upload, product and earnings information, and support messages to provide your workspace. Saved login tokens are stored in the device Keychain or encrypted secure storage. Signing out removes the selected saved token.

If you purchase Good Game Pro through the App Store, Apple processes your payment. We receive and verify transaction and subscription information from Apple, including product and original transaction identifiers, purchase and expiry dates, and renewal, billing or refund status. A creator-specific identifier links the subscription to your Good Game account so we can provide benefits, restore purchases, prevent duplicate subscriptions and resolve billing issues. We do not receive your payment-card details from Apple.

If you allow notifications, Expo and Apple process a device push token to deliver account updates. You can turn notifications off in device Settings. Camera and photo access is used only when you choose artwork.

Logo generation asks for your permission before sending your prompt to OpenAI. Generated artwork is stored with Cloudinary for your account. Do not include another person’s private information without permission. The app does not request advertising tracking permission or include advertising SDKs.

If an app error occurs, you may choose to send a diagnostic report containing the error category, app version and platform. It excludes your account details, prompts, artwork and messages. Ordinary service security logs may include network information such as IP addresses.

You can initiate permanent account deletion in the app’s Account and security controls. Access is disabled immediately; the request is tracked for completion within 30 days and confirmation by email. We remove associated personal information and user content except records required for financial, legal or dispute obligations. For an agency staff account, other people’s accounts and the agency’s legitimate business records remain; a last-owner request also initiates agency closure. Deleting your Good Game account or the app does not cancel an Apple subscription. Manage or cancel renewal in Apple Subscriptions. Any remaining subscription and payout obligations are reviewed as part of deletion.

The personal data we collect

Depending on how you use our services, we may collect and process the following:

• identity and contact details, such as your name, email address, billing or delivery address, telephone number, and support contact details;
• account and profile data, such as login credentials, creator tag, subscription tier, profile image, social handles, payout details you provide, and linked Discord account details;
• order, checkout, and fulfilment data, such as cart contents, product selections, customization text, order history, delivery information, and limited payment or Stripe customer metadata needed to process transactions;
• merchant and Shopify app data, such as shop domain, installation and authentication details, catalog publication settings, product publishing records, merchant-managed fulfilment data, and customer or order details received through Shopify APIs and webhooks;
• communication data, such as support chat messages, support email content, account enquiry details, and related conversation history;
• creator-tool and content data, such as uploaded artwork, product imagery, design prompts, generated assets, and files you submit when using creator features;
• device, browser, attribution, and usage data, such as IP address, browser type, log data, session identifiers, local-storage values, cookie-derived identifiers, TikTok attribution values such as ttclid or _ttp, Google advertising identifiers such as gclid, gbraid, or wbraid, OpenAI Ads attribution values such as oppref or __oppref, and anti-abuse signals including Cloudflare Turnstile responses;
• compliance and audit data, such as webhook records, deletion-request references, and security logs needed to investigate misuse, fraud, or legal claims.

How we use personal data

We use personal data to:

• operate the storefront, account areas, creator dashboard, support channels, and merchant app services;
• create and manage accounts, authenticate users, link Discord access, and maintain user preferences or creator profiles;
• process orders, take payment through third-party providers, arrange fulfilment, provide order updates, and resolve delivery or product issues;
• publish or manage merchant products in Shopify, sync owned-order data, and push fulfilment information back to merchant stores where our public app is used;
• send service and transactional communications, including account, checkout, support, and order-related emails;
• host and process uploaded media, render product previews, and support creator tooling such as image-generation or artwork workflows;
• monitor service performance, attribute traffic or conversions, improve products and user experience, and maintain internal reporting;
• detect, prevent, and investigate fraud, abuse, security incidents, or unlawful use; and
• comply with legal obligations, tax or accounting rules, and valid data-rights requests.

Pixel and Discord support

Pixel is our Good Game Apparel community bot. It uses Discord user and server identifiers, membership and role information, and invite activity to welcome members, link creator access and organise private support channels. Discord sign-in requests your profile and, where available and verified, your email address to identify and link your account.

Website support conversations, including messages, images and relevant order context, may be copied to private Discord channels for our authorised support team. Staff replies in those channels are copied back to the original website conversation. Supported reply images are stored with Cloudinary so they remain available in your support history. Creator support messages and activity are also used to organise and follow up on support.

These records are used to provide account and customer support, manage access and avoid duplicate deliveries. Discord and our hosting providers process the information needed to operate this integration. The retention, international-transfer and data-rights provisions below apply. Contact us to request access or deletion and identify the Discord account or support conversation concerned.

Facebook and Instagram messages

When you message our business accounts, we may process your platform identifier, username, available profile and follower information, message text, message times and attachment indicators to manage the conversation and respond to enquiries. Our connected Meta app also supports publishing and managing content for our own business accounts.

We may use automated assistance for routine replies to registered creator conversations. Railway hosts the messaging service and its records. Where AI assistance is enabled, relevant conversation text is sent to OpenAI to prepare a response. Artwork, complaints, financial questions and requests for a person are referred for human handling. You can ask for a person or tell us to stop outreach in the conversation.

These records are used to answer messages, apply conversation preferences and prevent duplicate replies. Access is restricted to authorised operators and service providers. To request access to or deletion of messaging records, contact us using the email below and identify the social account concerned. We may need to verify the request before acting. The retention and international-transfer provisions below also apply.

Cookies and visit measurement

Essential cookies support sign-in, your cart, and security. If you accept optional cookies, we also measure page visits, collection and product views, creator leaderboard visits, and advertising attribution. Declining optional cookies keeps this browser tracking disabled while essential services remain available.

• storefront_cookie_consent_v1 remembers acceptance for up to one year. We also remember acceptance in local storage and the current visit's choice in session storage. For signed-in users, we may record that choice against the account.
• storefront_analytics_visitor_v1 is a first-party visitor identifier with a one-year expiry refreshed by ordinary tracked visits.
• storefront_analytics_session_v1 groups tracked visits and helps avoid counting the same collection visit repeatedly on the leaderboard. It expires ten minutes after the last ordinary tracking request that refreshes it. Leaving a page open without another tracked visit does not extend it.
• Optional advertising cookies and stored campaign identifiers support the measurement services described in this policy. You can remove cookies and local storage using your browser settings.

Our first-party visit measurement does not send periodic presence updates or infer visitor locations for a live visitor map. Historical live-viewer records may remain subject to the retention and data-rights provisions below; disabling this feature does not itself erase those records. IP addresses may still be processed for security, rate limiting, and consent records.

Our lawful bases

Where UK GDPR or similar laws apply, we generally rely on one or more of the following lawful bases:

• contract, where we need the data to create accounts, process orders, provide support, or operate merchant services you requested;
• legitimate interests, where we need the data to run, secure, improve, and administer our business and services in a proportionate way;
• legal obligation, where we must keep records, handle tax or accounting duties, respond to lawful requests, or support required Shopify compliance workflows; and
• consent where applicable law requires it for specific optional marketing, advertising, or similar processing activities.

Who we share data with

We share personal data only where needed to provide services, operate the app, or comply with law. Recipients may include:

• Shopify, for app installation, merchant authentication, product publishing, order synchronization, merchant-managed fulfilment workflows, and mandatory compliance webhooks;
• Stripe, for payment processing, checkout, and related customer or transaction metadata. We do not store full payment-card details ourselves;
• SendGrid, to send account, signup, welcome, support, or order-related transactional emails;
• Cloudinary, to store and deliver uploaded artwork, product media, and generated images;
• Discord, when you use Discord-based sign-in, linking, or support and community interactions;
• TikTok, where TikTok pixel or attribution tooling is enabled for campaign measurement and checkout attribution;
• Google advertising and analytics services, where Google tag, Google Tag Manager, Google Ads, or related conversion tooling is enabled for campaign measurement, attribution, and reporting;
• OpenAI advertising and measurement services, where the OpenAI Ads pixel is enabled after consent for campaign measurement and conversion attribution. Event details may include viewed or selected products, checkout, order, registration, or subscription activity and privacy-preserving SHA-256 hashes of an email or internal identifier when available, rather than the raw values;
• Cloudflare Turnstile, to help protect forms and signup flows from bots or abuse;
• OpenAI and related creator-tool providers, where prompts, uploads, or generated outputs are processed to provide creator tooling features; and
• professional advisers, hosting or infrastructure providers, regulators, courts, law enforcement, or transaction counterparties where disclosure is necessary and lawful.

We do not sell personal data as a standalone data-brokerage activity.

International transfers

Some of our providers or service infrastructure may be located outside the UK or European Economic Area. When personal data is transferred internationally, we aim to use lawful safeguards appropriate to the transfer, such as contractual protections, provider terms, or other recognized transfer mechanisms.

How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide services, maintain records, resolve disputes, enforce agreements, and meet legal, tax, accounting, or compliance obligations.

• account and profile records are normally kept while the account remains active;
• order, transaction, support, and merchant operational records may be kept for longer periods where needed for fulfilment history, audit, accounting, or dispute handling;
• media, generated assets, and product-operation records may remain available while they are required to support active listings, creator workflows, or merchant services; and
• minimal compliance or audit records may be retained after deletion or uninstall events where needed to demonstrate legal compliance, security, or business recordkeeping.

Your rights and Shopify data requests

Subject to applicable law, you may have the right to request access to, correction of, deletion of, restriction of, objection to, or portability of your personal data. You may also be entitled to complain to the UK Information Commissioner's Office or another relevant supervisory authority.

If you are a customer of a merchant using our Shopify app, that merchant may be the first point of contact for store-specific data requests. We also support Shopify's required compliance flows, including the standard customers/data_request, customers/redact, and shop/redact webhook processes used for app-store data-rights handling.

To make a privacy or deletion request, email hello@ggapparel.co.uk.

Security and changes to this policy

We use reasonable technical and organizational measures to protect personal data, but no online service can guarantee absolute security. You should also keep your credentials secure and contact us promptly if you believe your account has been compromised.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the last-updated date.