Privacy Policy

1. Introduction

Cherniuk Tech Services Corp. ("we", "us", or "our") operates CTS-Corp.Store By Yuliia at https://cts-corp.store, a store for custom apparel, drinkware, and gifts. This policy explains how we access, collect, use, store, share, and delete personal information when you browse, submit an order or inquiry, or use Google Sign-In.

Google Sign-In is an optional sign-in method for store administrators. Browsing the shop and submitting a customer order do not require a Google account. Successful Google authentication alone does not grant administrator access; separate approval is required.

2. Information we access and collect

Google OAuth scopes and account information

When you choose Google Sign-In, we request only these identity scopes:

• openid: your stable Google account identifier (the sub claim) and identity-token information needed to verify the account.
• email (Google's https://www.googleapis.com/auth/userinfo.email scope): your Google email address and whether Google has verified it.
• profile (Google's https://www.googleapis.com/auth/userinfo.profile scope): basic profile information, including your name and profile picture URL, when provided by Google.

We also receive OAuth access tokens, any refresh token Google issues, token expiry and granted-scope information, and identity tokens used in the sign-in flow. We never receive your Google password. We do not request access to Gmail messages, Google Calendar events, contacts, or Google Drive files.

Information you provide directly

• Order and inquiry details: name, email, telephone number, delivery address, messages, order notes, uploaded artwork, personalized text, and proof approvals.
• Administrator account details and preferences: admin login, saved approval status, store settings, and password credentials when using the separate store password sign-in.
• Privacy and support correspondence, including information needed to verify and respond to a request.

Essential technical information

We process session identifiers, sign-in timestamps, IP addresses, user-agent information, and operational or security logs. Essential cookies maintain sign-in sessions and artwork ownership. Browser storage holds cart contents, language, currency, theme, and checkout retry information. Artwork ownership cookies last up to 90 days; browser storage remains until you clear it or the application updates it. We do not use Google user data for advertising tracking.

3. How we use Google user data

We use Google user data strictly to provide and maintain the app's core administrator sign-in functionality:

• Verify the identity of the Google account requesting access.
• Associate that identity with an approved store administrator and maintain secure sign-in sessions.
• Identify the signed-in account within the administration interface and support account recovery or access requests.
• Protect sign-in, investigate authentication failures or abuse, and maintain the reliability of these features.

We do NOT use Google user data for serving personalized advertising, market research, or unrelated data mining. We do not use it to train generalized artificial intelligence or machine learning models.

Separately, we use information you provide directly to respond to inquiries, prepare and fulfill orders, obtain proof approval, communicate about services, and maintain necessary business records.

4. Data sharing and third-party disclosures

We do NOT sell or rent Google user data, or transfer it to data brokers or advertising platforms. We do not transfer it to third parties for their independent marketing or other unrelated purposes.

• Google: Google processes the authentication request and supplies the identity information you authorize. Google's own handling of your account is described in the Google Privacy Policy.
• Infrastructure and support: the application and its SQLite database operate on server infrastructure controlled by us. Hosting, network, backup, or technical support providers may process information only as necessary to operate, secure, or support the service on our behalf, under appropriate confidentiality and access restrictions.
• Microsoft, if you select it: optional Microsoft sign-in processes Microsoft account information separately; choosing Google does not link your Google identity to Microsoft.
• Legal and security disclosures: we may disclose the minimum necessary information when required by applicable law or to investigate security incidents or abuse, consistent with Google's applicable policies.

Operational service-provider processing is limited to the purposes above; it does not give a provider permission to independently use Google user data. Authorized personnel may access information only where needed for account support with your agreement, security investigations, or legal obligations.

5. Data storage, security, and protection

• Encryption in transit: the public website and Google OAuth communications use HTTPS/TLS.
• OAuth token encryption at rest: stored OAuth access and refresh tokens are encrypted by the authentication library using XChaCha20-Poly1305 authenticated encryption and a server-held secret.
• Access control: server-side authorization checks, explicit administrator approval, signed sessions, restricted database and server access, and rate limiting protect administrative operations.
• Session and password protection: authentication cookies are HttpOnly, SameSite-protected, and Secure on HTTPS. Store passwords saved through the password-management process are salted and hashed.
• Private uploads: access to customer artwork and proofs requires the applicable ownership cookie, private order link, or authorized administrator session.

Account records, order records, uploaded files, and backups are stored on our server infrastructure and protected by server access controls. Token encryption is distinct from whole-disk encryption; this policy does not represent that every database field, file, or backup is AES-encrypted. No storage or transmission method can guarantee absolute security.

Keep private order links confidential: anyone with a valid link can view the corresponding order page and access its associated files.

6. Data retention, deletion, and revoking access

How long we keep information

Google identity records and account approvals are retained only as long as needed to provide account access or handle legitimate security and support requirements. An account that has not been approved may still have a stored identity record after an attempted sign-in. There is no automatic inactivity-deletion period; you can request deletion at any time.

Administrator sessions expire after up to 24 hours. Signing out invalidates the current session, but does not delete the account record. Token expiry limits a token's validity, but does not automatically erase its stored record. We retain order and inquiry information only as needed for fulfillment, support, recordkeeping, and applicable legal obligations. Backups are managed separately and may retain copies until they are removed or replaced.

Request deletion of your information

1. Email support@cts-corp.store with the subject "Privacy data deletion request".
2. Identify the Google account email or relevant order reference and tell us whether you want Google sign-in data, an account, uploaded files, or other personal information deleted. Do not send passwords, access tokens, or private keys.
3. We will verify that you are entitled to request deletion. We may ask for limited additional information to prevent unauthorized deletion.
4. After verification, we will remove the relevant Google account record, saved approval, associated tokens, and sessions, and address other requested records and backup copies. We aim to complete verified requests within 30 days, and will explain any necessary delay or specific legal retention requirement.

Information retained solely for a legal obligation or security requirement will be restricted to that purpose. If a backup is restored, applicable deletion requests must be reapplied before normal processing resumes.

Revoke Google's authorization

1. Open your Google Account connections and permissions while signed in to the relevant Google account.
2. Select CTS-Corp.Store By Yuliia and choose the option to remove or delete its connection or access.
3. Sign out of this store. To delete records already stored by us, also send the deletion request described above.

Revoking access at Google prevents further authorized access under that grant; it does not by itself erase our records or necessarily end an existing store session immediately. Signing in with Google again may create a new account record and require fresh administrator approval.

7. Google API Limited Use Policy disclosure

Read the Google API Services User Data Policy. We will update this policy and request additional consent where required before accessing new types of Google data or using existing data for a new purpose.

8. Contact information

For privacy questions, access or correction requests, deletion requests, or concerns about Google user data, contact: