Privacy Policy

1. Overview & Architecture

Bulk Designer is an enterprise-grade automated design extension developed by Edgi ("we", "us", or "our") for Adobe Express. This Privacy Policy governs how Bulk Designer collects, uses, and safeguards information when you use our add-on, website, and related services.

Unlike traditional cloud SaaS applications that upload user assets to remote server farms, Bulk Designer is engineered with a client-first execution model. Spreadsheet parsing (CSV, Excel .xlsx, TSV), field binding, image resizing, and page duplication take place directly within your local browser runtime via the Adobe Express Add-on SDK and Document Sandbox APIs.

2. Cloud Storage & Data Integrations

Bulk Designer enables users to connect external cloud storage providers to import spreadsheets and product images directly into their creative workflows:

• Google Drive & Google Sheets
• Microsoft OneDrive
• Dropbox
• Box

How Each Service Connects

• Dropbox and OneDrive: The add-on connects to them directly from your browser. Files are downloaded straight into the add-on and never pass through our servers.
• Google Drive, Google Sheets and Box: Requests go through our server (hosted on Vercel), which passes them to the provider and returns the result to the add-on. Our server doesn't save, index, or log your files, spreadsheet contents, or folder lists.

Sign-in Tokens

• Dropbox and OneDrive: Sign-in tokens are kept only in the add-on's storage on your device (ClientStorage) and are never sent to our servers.
• Google and Box: A short-lived access token and a session ID are kept on your device. The refresh token, which keeps you connected without signing in again, is kept on our server in a secure session store (Upstash Redis). It's deleted after 30 days without use, or as soon as you disconnect. When you disconnect Google, we also ask Google to cancel the token.

Google User Data

When you connect Google, Bulk Designer can read only the following, and only when you choose to import something:

• Google Sheets (read-only): the sheet names and cell values of the spreadsheet you pick.
• Google Drive (read-only): the list of your Google Sheets files so you can pick one, the files in a Drive folder you pick, and the images you import.
• Your Google account: your name, email address, and Google account ID.

We use spreadsheet contents and Drive files only to create the designs you ask for in Adobe Express. Bulk Designer never creates, changes, or deletes anything in your Google account, and we don't store your spreadsheet contents or Drive files.

We save your Google name, email address, and account ID with your Bulk Designer account, so we know which Google account you connected. We also add your email address to our mailing list, so we can send you news about Bulk Designer. To be removed from the list, email us at bulkdesigner@edgidesign.com.

If you use an AI feature on an image you imported from Google Drive (for example, Enhance images), that image is sent to the AI provider only to do the task you asked for.

To remove Bulk Designer's access, disconnect Google in the add-on, or remove Bulk Designer at myaccount.google.com/permissions. To have your saved Google details deleted, email us.

3. Team Workspaces & Collaborative Presets

For collaborative and Enterprise teams, Bulk Designer provides shared workspace features powered by our secure cloud database (Supabase):

What We Store in Workspace Presets:

• Preset Blueprint Metadata: Preset name, Adobe Express document page ID, creation/update timestamps, and the pseudonymized internal User ID of the creator (created_by) for team auditability.
• Column & Binding Mappings: Schema rules linking spreadsheet column names to Adobe Express canvas layers (e.g. "Product Title" → Text Layer 1, "Hero Image" → Image Element).
• Layout Overrides (Deltas): Compact per-row coordinate and rotation tweaks made by designers during preflight review. Only delta modifications are saved—never full row data.
• Team Notes & Guidelines: Custom creative instructions written by team members, strictly limited to a maximum of 2,000 characters.
• Asset Filename Manifests: Lists of expected image filenames (e.g. shoe-1.png) so collaborating team members can match their local asset folders.

Seat Management & Invitations:

Workspace administrators manage seat allocations within their organization. To provide this service, we store:

• Member email address and assigned role (admin or member).
• Membership status (active, pending, or revoked).
• Single-use seat verification codes.

Transactional emails related to seat invitations and membership updates are dispatched securely via Resend. We do not use member email addresses for third-party marketing.

4. Artificial Intelligence (AI) Services & BYOK

Bulk Designer offers intelligent generative and image enhancement features powered by leading AI service providers:

• Claid.ai: Studio shadow generation, image enhancement, and background cleanup.
• OpenAI (GPT-5.5): Text summarization, content variation, and copywriting.
• Anthropic (Claude Haiku 5.5): Structural copy analysis and carousel generation.
• Google Gemini (Gemini 3.8 Flash): Fast content extraction and template matching.
• Black Forest Labs (FLUX.1): Visual design variations and generative fill.
• xAI (Grok): Content assistance and structured generation.

On-Demand Transmission Only

Data (such as text prompts or specific product images) is transmitted to an AI provider only when you explicitly trigger an AI feature (e.g. clicking "Generate Shadows" or "Create Copy Variations"). No automated background scanning or unsolicited AI uploads take place.

No Model Training on Your Data

Bulk Designer does not use your creative designs, spreadsheet data, or prompts to train foundation AI models. Third-party commercial API agreements provide that enterprise API requests are not utilized for model training or retained beyond ephemeral processing windows.

Bring-Your-Own-Key (BYOK) Encryption

Enterprise teams can configure their own third-party AI keys in the Workspace Key Vault. All vault credentials are encrypted using industry-standard AES-256-GCM encryption prior to storage in Supabase. Personal key overrides remain solely within your local browser storage.

5. Payments & Subscription Billing

Paid subscriptions and enterprise license activations are processed by our authorized Merchant of Record, Lemon Squeezy:

• Lemon Squeezy manages all payment processing in strict compliance with PCI-DSS Level 1 standards.
• Bulk Designer never sees, handles, or stores your credit card number, bank details, or CVV.
• We receive only transaction confirmation webhooks containing your license key, plan tier, renewal date, and customer email address to provision add-on capabilities.

6. Local Storage, IndexedDB & Caching

Bulk Designer relies on native browser storage mechanisms for essential functionality:

• IndexedDB: High-performance caching for resolved local image files (FilenameImageCache), ensuring large batches generate rapidly without re-reading disks.
• localStorage & sessionStorage: User interface preferences, coachmark dismissals, active mapping selections, and ephemeral session states.
• ClientStorage (Adobe Express SDK): Safe storage for active license status, Dropbox and OneDrive sign-in tokens, and the access tokens and session IDs for Google and Box.

No Tracking Cookies: We do not deploy third-party advertising cookies, fingerprinting scripts, or cross-site behavioral tracking beacons.

7. Data Security & Storage Integrity

We implement rigorous technical safeguards to protect your workspace and configuration data:

• End-to-End Encryption in Transit: All network communications use TLS 1.3 / HTTPS encryption.
• Access Isolation: Supabase Row-Level Security (RLS) policies enforce strict tenant isolation so workspace presets and seats are accessible only by authenticated members of that workspace.
• Pseudonymized Identifiers: Adobe user IDs are cryptographically hashed using SHA-256 when used for verification and seat assignment.

8. Data Retention & Your Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you have fundamental rights regarding your personal information:

• Right to Access: You can request a summary of personal information associated with your account.
• Right to Rectification: You can update member details or editable notes at any time.
• Right to Deletion (Right to Be Forgotten): Workspace owners can delete shared presets or revoke member seats directly in the add-on settings. To request complete deletion of your workspace data or payment record, contact our privacy team.
• Right to Clear Local Data: You can clear your local cache, session storage, and IndexedDB files at any time via the add-on settings or browser clear data controls.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect new features, operational requirements, or regulatory standards. We will notify users of material changes by updating the "Last Updated" date at the top of this policy and through in-app notices where appropriate.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact our Data Protection team at: