Privacy Policy

Last updated: September 25, 2026

This policy covers printready3d.com and everything you do on it, signed in or not. It is written to be read, not filed. If something here is unclear, write to privacy@printready3d.com and we will explain it.

Who is responsible

PrintReady3D is the data controller for the personal data described here. PrintReady3D is operated by its founder as a sole trader, not as a company.

Privacy contact: privacy@printready3d.com. We are not required to appoint a Data Protection Officer and have not appointed one; the founder answers privacy mail personally.

What we collect

Files you open in the free tools. Most free tools — viewers, converters, repair, calculators — process your files entirely in your browser. Those files are not uploaded to us and we never see them.

Account data. Your email address, and the display name and profile picture you choose. If you sign in with Google or GitHub, they send us your email address, name and profile picture — we never receive your password for those services. If you sign up with an email and password, we store a one-way hash of the password, never the password itself. We also record the IP address and country of your most recent sign-in, to protect accounts and prevent abuse of free credits.

What you type and upload into the AI generator. The description you write, the settings you choose, the prompt the system builds from them, and any reference image you upload. These are attached to the model they produced.

Models you generate. The concept images, the 3D model files and thumbnails, their settings, and whether they are public or private. If you have never made a purchase, your models are public and anyone with the link can view them; after a purchase, new models are private unless you choose otherwise.

Purchase records. We keep the order number, what was bought, the amount, the currency, the date, the payment status, and the payment record our processor returns to us, which can include the name and email address you gave at checkout. Full card numbers, CVC codes and bank details never reach our servers — they go directly to our payment provider (Creem or Waffo Pancake, depending on the checkout you used), which acts as merchant of record and holds them under its own privacy policy. We also keep your credit balance and a ledger of how credits were granted and spent.

Support messages. Anything you send to one of our mailboxes or through the feedback form, and our replies.

Usage and device data. Server logs generated by our hosting provider: IP address, the URL requested, the response code, timestamp, user agent string, and referrer. We also record which pages and tools are used, as described under cookies below.

Cookies and similar storage.

• A session cookie, set when you sign in, so you stay signed in. It is removed when you sign out.
• A consent cookie that remembers your choice in the cookie banner.
• A first-party visitor ID (a random identifier in a cookie and in local storage, kept for up to 12 months) so we can count how visitors move from the free tools to the generator. It is never shared with advertisers.
• A country cookie so prices and credit packs are shown correctly for your region, and an invite code cookie if you arrived through a referral link.
• Plausible Analytics, which is cookie-free and does not follow you across websites, runs for everyone.
• Google Analytics and Microsoft Clarity (which records how pages are used, including clicks and scrolling) run only if you accept analytics cookies in the cookie banner.
• Local storage in your browser for interface preferences. This never leaves your device.

We do not use advertising cookies.

Why we use it, and the legal basis

• Running your account and delivering what you bought — creating and authenticating your account, generating models, granting and spending credits, running subscriptions. Legal basis: performance of a contract with you.
• Taking payment and preventing payment fraud — passing the order to our payment provider (Creem or Waffo Pancake) and recording the result. Legal basis: performance of a contract; legitimate interests in preventing fraud.
• Screening prompts and images for content that breaks the Acceptable Use Policy. Legal basis: legitimate interests in running a lawful service and protecting other people; legal obligation where the content is illegal.
• Answering support, billing and refund requests. Legal basis: performance of a contract; legitimate interests in supporting our users.
• Keeping the service secure and available — rate limiting, abuse detection, preventing multiple accounts from collecting free credits, server logs. Legal basis: legitimate interests in security.
• Understanding which pages and tools are used — Plausible and the first-party visitor ID. Legal basis: legitimate interests in improving the product. Google Analytics and Microsoft Clarity: consent, which you can withdraw at any time in the cookie banner.
• Sending service email — sign-in and password emails, purchase receipts and account notices. Legal basis: performance of a contract.
• Keeping tax and accounting records. Legal basis: legal obligation.

We do not sell your personal data, and we do not use it for automated decisions that produce legal effects for you. We do not use your prompts, uploads or models to train AI models.

Who we share it with

We use the following processors. Each receives only what it needs.

• Creem and Waffo Pancake (payments, merchant of record; which one depends on the checkout you used) — your name, email address and payment details, which you give them directly at checkout. They return the order result to us.
• Cloudflare (hosting on Workers; file storage on R2) — everything the service stores or serves: requests, uploaded images and generated models.
• Supabase (managed PostgreSQL database) — your account, prompts, model records, credits and orders.
• fal.ai (AI model hosting) — your prompt text and the images a generation needs, for concept images, 3D generation, part splitting and image screening.
• Tripo (3D generation API) — the photos and settings for multi-view 3D generation.
• OpenRouter and OpenAI (prompt screening) — the prompt text only, to decide whether it is allowed. No account data.
• Resend (transactional email) — your email address and the content of the message we send you.
• Plausible Analytics — aggregate, cookie-free page analytics.
• Google Analytics and Microsoft Clarity — page usage, only after you accept analytics cookies.
• Google and GitHub — only if you choose to sign in with them.

We also disclose data where the law requires it, to respond to a lawful request from a public authority, or to establish or defend a legal claim. If the service is ever transferred to a new owner, your data would move with it and we would tell you first.

International transfers

Our processors operate in the European Economic Area, the United Kingdom, the United States and other countries. Where personal data leaves the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where the UK applies), or by an adequacy decision, as provided in each processor's data processing agreement.

How long we keep it

• Files opened in the free tools — never stored by us.
• Uploads that never finished processing — deleted automatically within 1 day.
• Reference images you uploaded, models, concept images, prompts and settings — kept until you ask us to delete them or close your account.
• Account data — kept while the account exists. When you close it, see below.
• Orders, payment records and the credit ledger — kept for 7 years after the transaction, because tax and accounting law requires it. These survive account closure.
• Server and application logs — held by Cloudflare for up to 7 days and then discarded.
• Support email — kept for 2 years after the conversation ends.
• Visitor ID — up to 12 months in your browser.

Deleting models or closing your account. Email privacy@printready3d.com from the address on your account and tell us which models to delete, or that you want the whole account closed. We complete it within 30 days. Closing an account cancels any active subscription, deletes your models and uploads, and removes your name, email address and profile picture. Order and credit records are kept for the accounting period above and are no longer linked to a usable account.

Security

• All traffic to and from the site is encrypted with TLS (HTTPS).
• Passwords are stored as one-way hashes. Nobody, including us, can read them.
• Access to production data is limited to the operator, and payment card data is never in scope because it never reaches us.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and will tell you directly without undue delay where the law requires it. To report a vulnerability, write to legal@printready3d.com.

Your rights

If you are in the EEA or the UK — and as a matter of policy, wherever you are — you have the right to:

1. Access the personal data we hold about you, and receive a copy.
2. Rectification — have inaccurate data corrected.
3. Erasure — have your data deleted, subject to records we must keep by law.
4. Restriction — have us pause processing while a dispute is resolved.
5. Portability — receive the data you gave us in a machine-readable format, or have it sent to another controller.
6. Object to processing we carry out on the basis of legitimate interests.
7. Withdraw consent at any time, where processing is based on consent. This does not affect anything done before you withdrew it.
8. Complain to your local data protection supervisory authority. We would rather you came to us first, but you do not have to.

If you are a California resident, you also have the right to know what we collect and to ask us to delete it, and we do not sell or share your personal information for cross-context behavioural advertising.

To exercise any of these, email privacy@printready3d.com from the address on your account. We answer within 30 days. If a request is unusually complex we will tell you inside those 30 days and explain how much longer we need. We do not charge for this.

Children

You must be at least 13 years old to use PrintReady3D, and users under 18 need the permission of a parent or guardian. We do not knowingly collect data from children under 13; if we learn that we have, we delete it. A parent or guardian can ask us to delete a minor's account at privacy@printready3d.com.

Changes to this policy

We may update this policy. Material changes are reflected in the date at the top of this page and, where appropriate, announced through the service or by email.

Contact

• Privacy questions and data requests: privacy@printready3d.com
• Anything else: support@printready3d.com
• Legal notices and security reports: legal@printready3d.com
• Copyright complaints: dmca@printready3d.com