Privacy Policy

1. What we collect

• Details you provide: your name, email address, delivery address, and the 3D model files you upload.
• Account details, if you create one: your name, email address and a securely hashed password (we never store your password in plain text).
• If you choose “Sign in with Google”: your name, email address and profile image from your Google account.
• Order and transaction details (items, materials, quantities, prices, order status).
• Messages you send us.
• Basic technical data such as IP address and server logs.

Payments are processed by Stripe. We do not receive or store your full card details.

2. How we use it, and our lawful bases

• To prepare quotes and fulfil your orders — performance of a contract.
• To take payment — performance of a contract.
• To send order and delivery updates — contract and legitimate interests.
• To keep accounting records and meet legal obligations — legal obligation.
• To keep the service secure and working — legitimate interests.

3. Your model files

We treat the files you upload as confidential. They are stored in a private store and used only to produce your order. We do not share or publish them. We retain them for up to 90 days after an order is completed and then delete them, unless you ask us to keep them or we must retain them for a legal reason.

4. Service providers we share data with

We use trusted providers who process data only on our instructions:

• Stripe — payment processing.
• Vercel — website hosting and secure file storage.
• Neon — order database.
• Resend — transactional email.
• Google — only if you choose “Sign in with Google” (authentication).
• Delivery carriers (such as Royal Mail) — shipping.

We do not sell your personal data.

5. International transfers

Some providers may process data outside the UK or EEA. Where they do, appropriate safeguards apply, such as the UK International Data Transfer Agreement or equivalent contractual protections.

6. How long we keep it

Order and transaction records are kept for up to 6 years for tax and accounting. Model files are kept as described in section 3. Other data is kept no longer than necessary.

7. Your rights

Under UK GDPR you can ask to access, correct, erase, restrict or port your data, and object to certain processing. If you have an account, you can delete it any time from your account page — we confirm by email, then remove your account and sign-in data. We must still keep order and transaction records for the period in section 6 to meet legal and tax obligations, even after an account is deleted. To exercise any other right, email 3dlab@dfff.studio. You can also complain to the Information Commissioner (ICO) at ico.org.uk.

8. Cookies

We use only essential cookies to keep you (or an administrator) signed in and to secure your session. We do not use advertising cookies. If we add analytics in future, this policy will be updated and consent obtained where required.

9. Security

Files are held in a private store, payments are handled by a PCI-compliant provider, and access to order data is restricted.

10. Changes and contact

We may update this policy; the date above shows the latest version. For any privacy question, contact 3dlab@dfff.studio or write to DFFF LTD, Arch 8, Cranleigh Mews, Battersea, London, SW11 2QL.