Privacy notice

Your name, email address and phone number, entered at checkout (all three are needed to make and deliver the order and to contact you about it), when you submit a drawing for our fabricator’s review, or when you ask for your quote link by email. For a delivery order, the delivery address you enter at payment (Malaysia only).

The pieces you configured, the price, and the order’s history (when it was created, viewed, paid and produced, and by whom) are kept with the order, with a coded form of the address a quote was saved from (never the address itself), so one sender’s unpaid quotes can be held to their own share of the space their drawings take. A quote page is reachable by anyone who has its link, so treat the link like a key.

A DXF you upload is stored on our server so the shop can cut from the exact file you sent. It is kept for as long as an order, saved template or shared design link refers to it. On a quote that is never paid and the shop hasn’t worked on, it is kept until 60 days after the quote expires, is declined or is re-priced (180 days if the quote is in a verified account), or sooner when the unpaid quotes from one address or account, or from everyone, outgrow the space we keep for them; the quote itself, with its price and part previews, stays. An upload nothing refers to is deleted after 7 days.

Files you send with a quote request (STEP models or DXF drawings) are stored with your name, email, phone and company, if given, so the shop can price the job and reply to you. The files are deleted 12 months after they arrive; the request itself is kept as a record of what we quoted.

Your email address and password, plus a name and phone number if you give them. The password is stored only as a salted hash, never in plain text. We send a confirmation email when you register, a reset email when you ask for one, and an email if many wrong passwords for your account pause signing in to it from new browsers. While you are signed in, a signed session cookie keeps you signed in for up to 30 days; signing out or resetting your password ends it. To protect your account we count wrong passwords for it (in memory, for a day at most), and a browser you sign in with is remembered for a year (a signed cookie, kept when you sign out), so wrong passwords tried from elsewhere can’t lock you out of it; resetting your password forgets every browser.

Payments are handled by Stripe. Card details are entered in Stripe’s own payment form and go to Stripe; an FPX online banking payment is approved with your own bank. This site never sees or stores your card number or your banking login. We keep the payment reference, the amount and its status. Your receipt and any refund notice are emailed by us, not by Stripe.

If you publish a part when paying, the part becomes public: its picture, 3-D view and sizes, and the designer name you choose to show (none if you leave it blank). Your drawing file, your email, phone and address, and your order stay private. To apply the publishing discount’s limit, we keep which account, email inbox and browser took it, and when. Your store credit is a record of what you earned and spent, kept with your account; nobody who orders your part learns who you are, unless you chose to show a designer name.

Your email address, and where you signed up from, when it is entered in the mailing-list form in the site footer. If you get our mailing list without having joined it, tell us and we remove you; we then keep only the address, as a note not to send it to you again.

What you send through the feedback widget or the post-order prompt: the rating, the message, the page it was sent from, and your name and email if you give them. Each message is stored and emailed to the shop so it is read. Its IP address and browser details are not kept with it (the site logs below have them for their own 30 days).

What this browser does on the site, so the shop can see how the site is used and help with your parts: the pages you open, the parts you start and design (their shape, sizes and material), drawings you upload (the file name and how it read), what you type, draw or upload to the part builder’s AI and what it answers, your cart, checkout and payments. It is kept against the browser cookie below, and joined to your name, email or account once you give them (at checkout, when you email yourself a quote link, or when you sign in). Only the shop sees it, and it is never sent to Google.

For each call your browser makes to the site’s own API (pricing, uploads, quotes, payment, account): the method and path, the response status and timing, your IP address and browser (user agent), and the quote id when the call knows it. From your browser: page views (path, referrer and viewport size), script errors and performance timings. Signing up, signing in (including a wrong password), password changes and resets, and each email we send are logged with the email address involved. Never a password, session token or card number, and secret links are redacted before logging. Logs are kept 30 days in our database; a copy also goes to our hosting provider’s log stream, and the hosting provider keeps its own access logs of every request.

We use Google Analytics to see how the site is used: the pages visited, how you arrived (a search engine, an ad or a campaign link), your device, browser and approximate location (country or city, worked out from your IP address, which Google Analytics does not keep), and steps such as starting a part (from a shape, a drawing or the part builder), seeing its price, uploading a drawing (only its file type and whether it could be priced: never the file, its name, or what you type or draw), adding a part to the cart, starting checkout and completing a payment, with its amount and payment reference. Private parts of page addresses are removed before anything is sent: order and shared-design links, parcel numbers, and the codes in password-reset, email-confirmation and payment return links, so Google never receives them. Google Analytics never receives your name, email, phone or address, and it does not run on the shop’s admin pages. You can block it with Google’s opt-out add-on (tools.google.com/dlpage/gaoptout) or your browser’s tracking protection.

Our Google Analytics is linked to our Google Ads account. That lets Google tell us which of our ads led to a visit or an order, and Google may show our ads to people who have visited the site. You can turn off personalised ads from Google at myadcenter.google.com.

A session cookie, and the cookie that remembers a browser you have signed in with, only when you sign in to an account. From your first visit, a cookie holding a random code (nothing about you) remembers this browser: it ties together what the browser does on the site (above), and marks it as the one that made a quote or uploaded a drawing, so only this browser can copy the quote’s parts or open your drawing again; we keep a coded form of it with your activity, the quote and the drawing. Your cart, delivery choice and lead-time choice are kept in your browser’s local storage until you order or clear them, and up to 10 parts you are still building until you add them to your cart or remove them (30 days at most), so you can continue them. Stripe’s payment form runs in your browser under Stripe’s own privacy policy. Google Analytics sets its own cookies (_ga and _ga_MK6WEDGT1P) so a returning browser is counted once, and your browser remembers which payments it has already reported, so a refreshed receipt page is not counted twice. Because our Google Analytics is linked to Google Ads, Google may also set advertising cookies (named _gcl_…) that record which of our ads you clicked, so an order can be credited to it.