Privacy Policy

1. Who we are and who this policy covers

Custombull (formerly Akinzone, operating since 2021) is operated by AKIN INDUSTRIES LLC, a company established in the United States and headquartered in Houston, Texas: 11500 Main St. Suite 126, Houston, TX 77025, United States of America. In this policy "we", "us" and "our" mean AKIN INDUSTRIES LLC, and "you" means the seller account holder, the sub users they invite and visitors to our websites.

This policy covers the Custombull application and dashboard at https://app.custombull.com, this marketing website, the order tracking pages shown to buyers, the Custombull Chrome extension, the partner program, the producer application form, the blog newsletter, and any communication you have with us through these channels.

Custombull is built for business users: people and companies selling products on marketplaces, their teams, and our producer partners. The service is not directed to anyone under 18.

Our roles

• As a controller: your account, billing, support, security and technical data; data about website visitors, newsletter subscribers, and partner and producer applicants.
• As a processor: buyer data that arrives with your orders (name, shipping address, personalization text and, where the marketplace provides it, email), questions and personalization requests buyers submit on the tracking page, customer messages handled in the dashboard, and customer lists you upload to the Marketing Center. You, the seller, are the controller of this data and we process it only on your instructions under our Data Processing Agreement. We may also process it independently to a limited extent for security, abuse prevention and our own legal obligations.
• The marketplaces you connect (Etsy, Shopify, eBay, Amazon and others) are independent controllers of their own data, and their privacy policies also apply.

Data protection officer and representatives

If we appoint a representative in the EU or the UK under Article 27 of the GDPR or the UK GDPR, their name and contact details will be announced on this page. Until then, privacy requests from the EU, the UK and every other country can be sent directly to hello@custombull.com with the subject "Privacy request". Given the nature of our processing we do not consider the appointment of a data protection officer (DPO) mandatory; all privacy requests are handled through the same address.

2. Personal data we process and where it comes from

We collect only the data we need to provide the service. The table below lists each category and its source.

We do not ask for sensitive (special category) personal data. A buyer's personalization text or a message may contain such information without our asking; if so, we use it only to produce and deliver that order.

3. Purposes and legal bases

The table below shows why we process data and, for people in the EU and the UK, the legal basis under Article 6 of the GDPR. The equivalent bases under the Turkish KVKK (Articles 5 and 6) are set out in the KVKK Information Notice (in Turkish) and summarized in the Türkiye section below.

Where we rely on legitimate interest, we assess that our interest is not overridden by your rights and freedoms. You can request a summary of that assessment at hello@custombull.com.

4. Buyer data and the seller's responsibility

Buyer data in your orders reaches us only as part of orders you ask us to produce and ship. You are the controller of that data; we process it only on your instructions under our Data Processing Agreement.

• We use buyer data only to produce, pack and ship that order, to run its tracking page and for customer communication you initiate.
• We never use buyer data for our own marketing, profiling or advertising, and we never sell it.
• Giving buyers a privacy notice, obtaining consent where required and responding to their rights are the seller's obligations. If a buyer contacts us directly, we forward the request to you without delay and help you respond.
• Tracking pages open through an unguessable, order specific link and never show costs, internal notes or the seller's other customers.

5. Marketplace data and Etsy

We access marketplace data only after you authorize our application through that marketplace's OAuth flow, and only within the permissions you grant. For Etsy these are: reading and writing your listings, reading your shop details, reading and updating your orders so we can fulfill them and report tracking, and, if you allow it, reading your messages. For Shopify, eBay and Amazon we use only the scopes you approve on the connection screen.

We do not sell, rent or share marketplace data with anyone for their own purposes. We do not publish listings on your behalf except the actions you approve. If you choose the "auto publish" setting in Automated Production, publishing relies on that prior instruction of yours.

You can disconnect a shop at any time from the application. When you do, syncing stops immediately and stored access tokens are revoked. Imported data is deleted or anonymized as described in the Retention section. Where a marketplace's API terms require shorter retention or periodic refresh, we follow those terms.

The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

6. AI features

Features such as the idea engine, design and mockup generation, title, tag and description suggestions, copyright pre-checks and reply suggestions for customer messages use third party AI model providers based in the United States (text and analysis, and image and video generation).

• We send providers only the context needed for the task: product information, design images, prompt text and the message you want a reply suggestion for. Listing content prompts contain no buyer data; reply suggestions include only the relevant message text.
• We use these providers under API terms in which they commit, in their commercial terms, not to use API data to train their models by default; providers may retain data for a limited period to monitor abuse. We do not give your inputs to third parties for model training and we do not train general purpose AI models.
• AI output is a suggestion. No listing, image or message is sent to a marketplace or buyer without your approval (except the auto publish setting you choose yourself in Automated Production).
• Output may be inaccurate, incomplete or similar to other works; reviewing it before publishing is your responsibility. See the Terms of Service for details.

7. Marketing communications and the Marketing Center

Messages from us to you

Account, security, order and billing notices are part of the service and cannot be switched off. Promotional email and the blog newsletter are sent only with your consent. Every marketing email includes a one click unsubscribe link and our postal address (US CAN-SPAM Act). We honor opt-outs within 10 business days at the latest and keep a record of your consent to demonstrate it.

The newsletter form on this site (blog follow) stores your email, the topics you chose, the page the form was on and the time of consent. We use this data only to send the newsletter.

Marketing Center (messages to your customers)

The Marketing Center lets you send email, SMS and WhatsApp messages to your own customers through our email and messaging infrastructure providers. You are the controller and the sender of these messages; we act as your processor. You are responsible for:

• Obtaining and recording valid permission: GDPR and ePrivacy rules in the EU and UK; CAN-SPAM in the US and, for text messages, prior express written consent under the TCPA; CASL in Canada; Law No. 6563 and the Message Management System (IYS) registration in Türkiye.
• Honoring opt-outs: we add an automatic unsubscribe link to emails, process keywords such as STOP for SMS, and keep opted out contacts on a suppression list.
• Complying with local quiet hours and message content rules.

For campaign reports the Marketing Center records delivery, open, click and purchase events within 7 days after a campaign (last touch attribution). Open tracking relies on a tracking pixel in the email; in some countries this requires the recipient's consent, which the seller must obtain.

8. Who we share data with

We do not sell personal data, rent it or share it for cross context behavioral advertising. We share data only with the following recipients, and only as far as the service requires:

• Subprocessors: service providers acting on our behalf under contracts that prohibit them from using the data for their own purposes (categories in the table below and on the Subprocessors page).
• Contracted producers: independent print businesses in the United States that print, pack and hand your orders to the carrier. Custombull is not a manufacturer; producers are independent and receive only what the order requires.
• Marketplaces: for listing, order, tracking and message actions you initiate.
• Your sub users: the people you invite see only what their permissions allow.
• Authorities: where a valid legal obligation, court order or official request exists; we review the scope and lawfulness of each request and notify you unless prohibited.
• Corporate transactions: in a merger, acquisition or asset sale, data may pass to the acquirer provided the protections in this policy continue; we will tell you in advance.

The full current list of subprocessors, with their names, is provided to Custombull customers on request under a duty of confidentiality at hello@custombull.com; customers are notified at least 30 days before a new subprocessor is added and have the right to object.

9. International transfers

Our application servers are in the European Union. Our company is established in the United States, and our producers, shipping providers and most of the providers above process data in the United States. Because our users can be anywhere in the world, data is transferred outside your country.

• From the EEA: we rely on the European Commission's standard contractual clauses (SCCs, Decision 2021/914) with supplementary measures where needed. We do not participate in the EU-U.S. Data Privacy Framework; if one of our providers is certified under it, that may serve as an additional basis.
• From the UK: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs.
• From Switzerland: the SCCs as adapted to Swiss law.
• From Türkiye: the standard contracts announced by the Personal Data Protection Board under Article 9 of the KVKK (as amended in 2024 by Law No. 7499), with notification to the Authority, and Article 9(6) for incidental transfers.

You can request a copy of the relevant transfer documents (with commercial terms redacted) at hello@custombull.com.

10. Retention

We keep data only as long as its purpose requires. When the period ends, the data is deleted or anonymized so that it can no longer be linked to a person.

Where a legal dispute, official investigation or statutory retention duty exists, we may keep the relevant data until it ends.

11. Security

• Traffic is encrypted in transit (TLS). Credentials and marketplace access tokens are stored encrypted; passwords are hashed.
• Two factor authentication (TOTP) is enforced for seller accounts and comes with recovery codes.
• Sub user permissions are fail closed: anything not granted is denied. Team members can work without seeing orders or finances.
• Artwork and production files are served only through short lived signed links. Repeated failed logins are throttled.
• Access to production systems is restricted, logged and reviewed; backups are encrypted.

No system is completely secure. Keep your password confidential and tell us immediately about anything suspicious.

12. Data breach notification

If we become aware of a security incident affecting personal data, we contain it, assess its impact and record it.

• For data we control, we notify the competent supervisory authority where required within 72 hours of becoming aware of the breach (GDPR Art. 33; in Türkiye, 72 hours to the Board under KVKK Art. 12(5) and the Board's decision), and inform affected individuals without undue delay where there is a high risk to them.
• For buyer data we process, we give the seller an initial notice without undue delay and no later than 48 hours (Data Processing Agreement).
• We comply with US state breach laws: under Texas Business and Commerce Code § 521.053 we notify affected individuals within 60 days and, if 250 or more Texas residents are affected, the Texas Attorney General within 30 days.

13. Your rights and how to use them

Depending on where you live, you may have the right to access and obtain a copy of your data, correct it, delete it, port it in a machine readable format, restrict processing, object to processing based on legitimate interest or to direct marketing, withdraw consent and complain. We honor these rights for users worldwide to a reasonable extent, even where the law does not require it.

How to make a request

• Email hello@custombull.com with the subject "Privacy request"; writing from the address registered to your account speeds up verification. Many actions (viewing and correcting data, deleting your account, disconnecting a shop) are also available directly in the dashboard.
• We may ask for reasonable information to verify your identity and use it only for that purpose.
• An authorized agent may submit a request on your behalf; we will ask for the agent's written authorization and, where needed, verify your identity.
• Requests are free. For manifestly unfounded or excessive requests we may charge a reasonable fee permitted by law or refuse with reasons.

Response times

If you are a buyer and your data reached us through a seller's order, we recommend contacting that seller first; if you write to us, we will pass your request to the seller and help.

14. Region specific information

European Economic Area, United Kingdom and Switzerland

Our legal bases are listed in the Purposes section. Where we rely on consent you can withdraw it at any time without affecting the lawfulness of earlier processing. You have the right to lodge a complaint with the data protection authority in your country (the ICO in the UK, the FDPIC in Switzerland). If you contact us first, we will try to resolve the issue directly.

United States: Texas

Under the Texas Data Privacy and Security Act (TDPSA), Texas residents have the right to confirm whether we process their personal data and to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data and profiling that produces legal or similarly significant effects. We do not sell personal data, we do not engage in targeted advertising and we do not carry out such profiling. We do not process sensitive data without consent and never sell it.

We respond within 45 days. If we decline your request, you may appeal within 60 days of our response by emailing hello@custombull.com with the subject "Appeal"; we will decide the appeal in writing within 60 days. If you are not satisfied with the outcome, you may contact the Texas Attorney General (texasattorneygeneral.gov).

United States: California

Under the California Consumer Privacy Act as amended by the CPRA (CCPA), the categories of personal information we collected in the last 12 months and how we disclosed them are shown below.

We do not sell or share personal information as those terms are defined in the CCPA, and we do not knowingly sell the information of anyone under 16. We use sensitive personal information only for the purposes the CCPA permits (providing the service, security), so we do not process it in a way that triggers the right to limit. We treat a Global Privacy Control (GPC) signal sent by your browser as a request to opt out of sale and sharing for that browser. We will not discriminate against you for exercising your rights to know, delete or correct. Under California's "Shine the Light" law (Cal. Civ. Code § 1798.83), we disclose that we do not share personal information with third parties for their direct marketing.

Other US states and Nevada

Residents of Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with comprehensive privacy laws have similar rights to access, correct, delete, port and opt out. We answer these requests with the same timeline and appeal process described for Texas; if you are not satisfied with an appeal, you may contact your state Attorney General. For Nevada residents: we do not sell covered information as defined by Nevada law.

Türkiye

Under the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is AKIN INDUSTRIES LLC. The full notice under Article 10 is published in Turkish as the KVKK Information Notice; the Turkish text governs for data subjects in Türkiye. In summary:

• Legal grounds (Art. 5 and 6): performance of a contract, legal obligation, establishment and protection of a right, legitimate interest and, for marketing messages, explicit consent.
• Transfers abroad (Art. 9): our servers are in the EU and many providers are in the US; we rely on the Board's standard contracts under the 2024 amendment and on Art. 9(6) for incidental transfers.
• Your rights under Article 11: to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether data is used in line with that purpose; to know the third parties in Türkiye or abroad to whom data is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under the conditions of Article 7; to request that correction, deletion or destruction be notified to third parties to whom data was transferred; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
• How to apply: in writing to our postal address or by email to hello@custombull.com from the address registered with us, under the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer free of charge within 30 days at the latest.
• Complaint: if your request is rejected, the answer is insufficient or we do not answer in time, you may complain to the Personal Data Protection Board (KVKK) within 30 days of learning of our answer, and in any case within 60 days of your application.

Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, you may request access to and correction of your personal information. Your information may be processed outside Canada (in the US and the EU) and may be accessible to authorities there. You may complain to the Office of the Privacy Commissioner of Canada (OPC).

Brazil

Under Article 18 of the General Data Protection Law (LGPD), you have the rights of confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about the entities data is shared with, and withdrawal of consent. Our legal bases mirror their GDPR equivalents (performance of a contract, legal obligation, legitimate interest, consent). You may complain to the National Data Protection Authority (ANPD).

Australia and New Zealand

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), and the New Zealand Privacy Act 2020, you may request access to and correction of your personal information. Your information may be transferred to providers in the US and the EU; we require them by contract to protect it to a comparable standard. We answer complaints within 30 days; if you are not satisfied you may contact the OAIC (Australia) or the Office of the Privacy Commissioner (New Zealand).

Other countries

If you are in another country, the rights granted by your local data protection law remain unaffected. Use the request method in this policy and we will handle your request within the time and in the manner your local law requires.

15. Children's privacy

The service is only for people aged 18 or over and for businesses. We do not knowingly collect personal data from minors, including children under 13 covered by the US Children's Online Privacy Protection Act (COPPA). If we learn that such data has been collected, we delete it and close the account. If you believe a child has given us data, email hello@custombull.com.

Some products sellers offer (for example baby bodysuits) may be intended for children; that is order data given by an adult buyer and does not mean data is collected from a child.

16. Automated decision making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (GDPR Art. 22, KVKK Art. 11(1)(g)). AI suggestions, copyright and policy pre-checks and fraud signals are tools that support human decisions: publishing a listing depends on your approval, and suspending an account depends on review by our team. To challenge the result of an automated check, email hello@custombull.com and a person will review it.

17. Sign in with Google, Chrome extension and other services

• Sign in with Google: we receive only your name, email address and profile ID from Google. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this information for advertising and do not sell it.
• Chrome extension: when you activate it, the extension reads the message content on the open marketplace message page and sends it to your account to prepare a reply suggestion and attach the image you choose. It does not collect your browsing history or use data outside this function, and it complies with the Chrome Web Store user data policies.
• Order tracking page: when a buyer opens the page, necessary technical data (IP, time, language) is processed for security. The page contains no advertising or tracking cookies.
• Partner program: partner applications and referral records are processed to calculate commissions; commission terms are set out in a separate partner agreement.
• Producer application: contact, address and capacity details of businesses applying to become producers are processed to evaluate the application and manage the producer relationship.

18. Cookies

The application uses strictly necessary cookies for sessions and security. Analytics and error session cookies run only after you consent. This marketing website currently sets no cookies and uses no third party analytics or tracking tools; fonts are served from our own server, while product images load from our cloud file storage provider, which, as with any web request, can see your IP address. If analytics is added, we will ask for your consent in advance in the EU, the UK and Türkiye. See the Cookie Policy for details.

19. Changes

We publish every change to this policy on this page and update the date and version at the top. We notify you by email or in the application at least 30 days before any change that materially affects how we use your data takes effect. If a new purpose requires consent, we will ask for it separately. You can request earlier versions at hello@custombull.com.

20. Contact and language

AKIN INDUSTRIES LLC, 11500 Main St. Suite 126, Houston, TX 77025, United States of America. Privacy requests and complaints: hello@custombull.com.

This policy is published in English and Turkish. If the two versions conflict, the English text prevails unless mandatory law requires otherwise; for data subjects in Türkiye, the Turkish KVKK Information Notice governs. Türkçe sürüm.