Privacy Policy

Effective 19 September 2026

This policy explains what Purple Spiral LLC, trading as My3D.Shop of Georgetown, Texas, United States (“we”, “us”) does with personal data when you visit our websites, subscribe to My3D.Shop, run a Store on it, or buy from a Store that runs on it. We've written it to be read, not skimmed past.

1. Three kinds of people

Visitors to my3d.shop and our partner site.
Store owners (and their staff) who subscribe to My3D.Shop. For your account and billing data, we are the data controller.
Store customers who buy from a Store. The Store owner is the controller of your order data; we process it on their behalf to run their Store. Questions about a specific order or your data at a particular Store should go to that Store first — every storefront has its own contact page.

2. What we collect

Store owners

Account details: name, email, password hash, sign-in timestamps.
Store details: name, address, contact email, brand assets, products and prices, shipping settings, domain.
Billing: your plan, invoices and subscription status. Card details go directly to Stripe; we see only the last four digits and card brand Stripe shares with us.
Stripe Connect: the identifier and status of the Stripe account you connect (not its banking details).
Support: messages you send us and our replies, including any attachments you include.
Usage: server logs (IP address, browser, pages requested) and actions in your dashboard, kept for security and troubleshooting.

Store customers

What you enter at checkout: name, email, shipping address, the items you ordered and any notes. Payment details are entered on Stripe's secure form and never touch our servers.
Order status events and shipping tracking, so the Store can send you updates.

Visitors

Server logs as above. If you arrive via a partner's referral link we store a referral cookie (see Cookies below).
Anything you send through our contact form.

3. Why we use it

To provide the Service: run storefronts, take orders, send order emails, create shipping labels, bill subscriptions. (Performance of our contract with you.)
To support you: answer messages, investigate problems. (Contract and legitimate interests.)
To keep the Service safe: detect fraud, abuse and security incidents; keep audit logs of administrative actions. (Legitimate interests and legal obligations.)
To pay partners: attribute a referred subscription to the partner whose link you followed. (Legitimate interests.)
To improve the Service and, for store owners, to tell you about changes to it. We do not sell personal data and we do not run third-party advertising.

4. Who we share it with

We use a small number of providers to run the Service. Each receives only what it needs and processes it under its own privacy terms and our agreements with them:

Stripe — payments, subscriptions and connected-account payouts.
Supabase — database, authentication and file storage.
Vercel — application hosting and content delivery.
Mailgun — transactional and support email.
Shippo — shipping rates, labels and tracking.
Mapbox — address autocomplete at checkout and locating pickup areas (the address is sent to Mapbox to suggest matches; no account data).
OpenAI — optional AI product-listing drafts (only when a store owner uses the feature).

We may also disclose data when the law requires it, to enforce our terms, or as part of a merger or sale of the business (in which case this policy continues to apply until you are told otherwise). Store owners see the order data of their own customers, naturally. Partners see aggregate referral statistics, never a referred customer's personal details.

5. Cookies

Essential: a session cookie to keep you signed in, a cart cookie on storefronts, and a cookie remembering which Store you were working in. These can't be switched off without breaking the site.
Referral: if you arrive through a partner link we set a cookie for up to 60 days so the partner is credited if you subscribe. It contains a partner code, not your identity.
We do not use advertising or cross-site tracking cookies. Stripe sets its own cookies on its checkout and fraud-prevention scripts.

6. Where data lives and how long we keep it

Our infrastructure is hosted in the United States. If you are outside the US your data is transferred there; our providers rely on standard contractual clauses or equivalent safeguards where required.
Store and order data is kept while your subscription is active and for up to 90 days after it ends so you can reactivate or export it, then deleted. If you cancel under the 30-day money-back guarantee, operational Store data is deleted promptly after the refund.
Billing records are kept for as long as tax and accounting law requires (typically seven years). A minimal record that a money-back refund was claimed for an email address is kept to prevent repeat claims.
Support conversations and audit logs are kept for up to two years. Server logs are kept for 30 days.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to production data is limited to people who need it to run the Service, is authenticated, and administrative actions are logged. Card data is handled entirely by Stripe, which is PCI-DSS Level 1 certified. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any regulator as the law requires.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or the California Consumer Privacy Act) you may have rights to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent. Store owners can update most account and Store data directly in the dashboard and export orders and products from it. For anything else, contact us; we will respond within the time the law allows. If you are a Store customer, please contact the Store first — we will assist them in fulfilling your request. You can also complain to your local data-protection authority.

9. Children

The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data; if you believe a child has provided it, contact us and we will delete it.

10. Changes

We'll post any changes here and update the effective date. For material changes affecting store owners we'll also email you or notify you in the dashboard.

11. Contact

Privacy questions or requests: send us a message. We read every one.