Introduction
This page describes what personal data we collect, why, and what you can do about it. We are the data controller under GDPR.
Data we collect
- Account: email, name, password hash (bcrypt), OAuth identifier when you use Google.
- Orders: items, total, shipping address, billing address, payment reference (we never store card numbers — those stay with Stripe / Easypay).
- Uploaded 3D models you save to your library, plus parsed geometry stats.
- Standard server logs: IP, user-agent, timestamps. Kept 30 days for security and debugging.
Legal basis
Contract (Art. 6(1)(b)) for order and account processing; legitimate interest (Art. 6(1)(f)) for security logs and fraud prevention; consent (Art. 6(1)(a)) for optional analytics if/when we add them.
Retention
Order records are kept for 10 years for tax law. Account data, addresses and uploaded files are kept until you delete them. Audit logs: 12 months.
Processors we use
- Stripe (Ireland) — card and Multibanco payments
- Easypay (Portugal) — MB Way payments
- Resend (US, EU data residency) — transactional emails
- Our own VPS in the EU
Your rights
Access, rectification, deletion, portability, restriction, objection. Use the export and delete buttons in your account settings, or email [email protected].
Contact
Privacy questions: [email protected]. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD).