Client Data Storage and Security Overview

For visitors in the European Union, cookies and similar technologies are governed by the ePrivacy rules and GDPR. Non-essential cookies normally require clear, specific, informed and freely given consent before they are stored or read.

​

What Data Is Stored

• Clients Company name, client name, email, phone, billing and

• shipping addresses.

• Wix Data collections, primarily

• WorkflowJobs client-directory records.

​

Quotes and invoices

• Quote/invoice numbers, tokens, project details, line items,

• quantities, turnaround, totals, VAT, payment status and

• correspondence status.

• Quotes collection and WorkflowJobs

• invoice/workflow records.

Artwork approval

• Artwork links, version links, approval status, proof response,

• amendment notes, signature/name fields and proof tokens.

• WorkflowJobs proof/artwork records.

• Artwork files may be stored in Google

• Drive where upload links are used.

Suppliers/products

• Supplier contact details, product names, description variants,

• turnaround values and supplier mappings.

• WorkflowJobs supplier-directory and

• product-directory records.

​

Timesheets

• Month, client, invoice, note/job reference, time category,

• start/end times and duration.

• WorkflowJobs timesheet records.

Backups

• Exported page or directory backup data, including chunked

• backup records.

• WorkflowJobs data-backup and

• data-backup-chunk records; optional

• emailed/downloaded backup files.

​

Security Controls Visible in the Current System

• Admin functions require an admin access key or a valid staff portal session before private pages are shown.

• Workflow pages require workflow-level access or an admin session.

• Staff sessions use a signed portal session cookie called dp_portal_session with a one-hour expiry.

• Customer-facing quote, invoice, upload and artwork proof pages use tokenised URLs rather than public index pages.

• API keys and integration credentials are requested through Wix Secrets, including SendGrid, Stripe and QuickBooks secrets.

• The backend sanitises many text fields before rendering them into HTML and normalises artwork/Drive URLs.

• Client upload files are routed through a Google Apps Script/Drive workflow rather than being attached directly to emails.

• Backup and restore pages require admin access.