Create-your-own merchandise website CafePress is paying $370,000 to customers who were harmed by its failure to protect their sensitive data, the U.S. Federal Trade Commission said Wednesday.