Privacy policy

This policy explains how we process your personal data when you use 3dtoreal.com — our instant-quote calculator and 3D printing service operated from Dénia, Spain. We process your data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

The short version: we collect only what we need to quote, print, invoice and ship your order. We run no advertising and no marketing lists, we never sell your data, and the only optional extra is a single statistics cookie (Google Analytics) that we set only if you accept it in the cookie banner.

What we collect

• Order and contact details — first name, surname, email, phone (optional), delivery address, billing address, and for company orders the company name and VAT ID.
• Your 3D model files — the files you upload for quoting, and the print-prepared copies we derive from them. Your models are your confidential intellectual property; we use them only to quote and produce your order.
• Order notes — anything you write in the free-text notes field.
• Account data — your email and a password (stored only as a cryptographic hash), plus the profile details you save.
• Payment status — whether an order was paid, via Stripe. Your card details never touch our servers; payment happens on Stripe’s secure checkout.
• Ratings and comments you choose to leave after an order.
• Technical data — to prevent abuse we rate-limit uploads and orders using a salted hash of your IP address; the raw IP address is not stored by the application. Our web server and the Cloudflare network in front of it keep standard access logs for a short period for security purposes.

Why we process it (legal bases)

We do not use your data for advertising or profiling, and we send no marketing emails.

• To quote, review, print, invoice and ship your order, and to send you the transactional emails that belong to it (confirmation, payment link, receipt, shipping) — performance of a contract, Art. 6(1)(b) GDPR.
• To issue and keep invoices and meet tax and accounting obligations — legal obligation, Art. 6(1)(c) GDPR.
• To provide your customer account — performance of a contract, Art. 6(1)(b) GDPR.
• To protect the service against abuse (rate limiting, security logging) and to ask for a service rating after a completed order — our legitimate interest, Art. 6(1)(f) GDPR.
• To measure, in aggregate, how the site is used (Google Analytics) — only with your consent, Art. 6(1)(a) GDPR, given through the cookie banner and withdrawable at any time.

Who receives your data

We share data only with the providers needed to run the service:

• Stripe Payments Europe Ltd (Ireland) — payment processing. Stripe receives your email and the order amount; card data is entered directly with Stripe.
• Correos (Spain) — parcel delivery. Receives your name and delivery address on the shipping label.
• Cloudflare — content delivery and security in front of our website; processes connection data (IP addresses) as our processor.
• Our own mail server (mail.3dtoreal.com, EU-hosted) — sends the transactional emails, including invoice PDFs.
• The European Commission’s VIES service — for company orders with an EU VAT ID, the VAT ID is checked against VIES to determine the correct tax treatment.
• Google Ireland Ltd (Google Analytics) — only if you accept the statistics cookie in the banner; receives pseudonymous usage data (pages visited, approximate location, device type) to give us aggregate visit statistics. No order, account or model data is ever sent to Google.
• Bambu Lab cloud — our printers report production telemetry through the manufacturer’s cloud; this carries the order reference but none of your personal details.

How long we keep it

• Uploaded model files: deleted from our servers 90 days after upload; if you place an order, the file is kept while the order is active and for 90 days after, then deleted. The deletion also covers the print-prepared derivatives.
• Orders and invoices: kept 6 years, as required by Spanish commercial and tax law (art. 30 Código de Comercio).
• Copies of transactional emails we sent you: up to 12 months.
• Rate-limiting records (hashed IPs): 30 days.
• Login sessions: 30 days; expired sessions and used security tokens are purged automatically.
• Server access logs: rotated on a short schedule measured in days, for security only.

Your rights

You can ask us at any time to access, rectify, erase, restrict or export the personal data we hold about you, or object to processing based on our legitimate interest. You can edit most of your data yourself in your account settings. Note that data on issued invoices cannot be erased before the legal retention period ends.

Access, export and erasure are self-service at 3dtoreal.com/account/privacy — it works with or without an account. You can download a complete machine-readable copy of your data (JSON) or delete your account and data; both actions are confirmed through a one-time link sent to your email and take effect immediately. Deletion keeps only what tax law obliges us to keep (issued invoices and paid-order records, 6 years), and the confirmation page shows you the exact list before anything happens.

You can also exercise any right by email at the contact address shown above — we answer within one month. If you believe we process your data unlawfully, you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es).

Security

All traffic is encrypted with TLS. Passwords, session tokens and rate-limiting IPs are stored only as cryptographic hashes. Your files and data live on access-controlled servers in the European Union.

Cookies

We use technical cookies the site cannot work without, plus — only if you accept it in the banner — one optional statistics cookie (Google Analytics). The details are in our cookies policy.

Changes to this policy

When we change this policy in substance, the version and date above change, and orders always record the version you accepted at checkout.