This policy explains what personal data we process when you use Craftshop, what we use it for, who we share it with and how you can exercise your rights. It is governed by Law 25,326 on the Protection of Personal Data of the Argentine Republic (Ley 25.326) and its implementing Decree 1558/2001.
Craftshop is an on-demand production service for 3D-printed products: a brand connects its online store, uploads its models once, and every sale becomes print jobs that are produced, checked with photos and shipped with the tracking sent back to the store. This policy covers the Craftshop app and this site.
Who is responsible for your data
The controller of Craftshop’s account database is Craftshop Labs, [company name and legal entity type of Craftshop Labs], CUIT [CUIT], with its legal address at [legal address], Argentine Republic.
Craftshop Labs decides on the data of the people who use the app (owners and members of brands and workshops) and of those who join this site’s waitlist or newsletter. The data of each brand’s buyers belongs to the brand; for that data Craftshop Labs acts as a service provider, as the section Buyer data we process on behalf of brands explains.
What data we process
- Your account data. When you sign in with Google we receive your name, your email and your profile picture. We don’t receive your Google password.
- Your organization’s data. The name of your brand or workshop, the people you invite, their roles and pending invitations.
- Your store connection data. The store’s domain and the credentials the store gives us to read orders and report shipments. Those credentials are stored encrypted.
- Your files and models. The 3D models, photos and production data you upload or that the process generates, such as quality check photos.
- Order data. The buyer’s name, shipping address and contact details, and the products they bought, as they arrive from your store.
- Personalization values. When a product is personalized (for example, a name on a keychain), the value is stored only on the print job that needs it.
- Technical logs. Operation and error logs that carry internal identifiers (of an organization, order or job), never credentials or buyer data.
- Waitlist and newsletter. When you join this site’s waitlist we store your email, whether you also chose to receive the newsletter, the site’s language, the page you joined from, the date and the version of the consent text you accepted. We don’t store your IP address.
- Use of this site. We measure the pages visited, clicks on the main buttons and on the links into the app, the browser and device type and an approximate location. We do it with PostHog in cookieless mode: nothing is stored on your device, and PostHog receives your IP address to compute, on its servers, an identifier that changes every day and to estimate the location. Links from this site into the app carry a mark that only says the visit came from here, not who you are.
- Bot check. When you open the waitlist form, Cloudflare Turnstile checks that a person is using it. For that, Cloudflare receives technical data from your browser and your IP address; we only use the result and don’t store it.
We don’t ask for sensitive data as defined in article 2 of Law 25,326, and we don’t process buyers’ card or payment data: your store collects the payment for each sale.
What we use it for
- Creating your account, identifying you when you sign in and showing you only the information of the organizations you belong to.
- Receiving your store’s orders, turning them into print jobs, checking their quality and shipping them.
- Reporting each shipment and its tracking number to your store.
- Sending you service notices, such as invitations, order alerts and changes to this policy.
- Keeping the service secure, investigating errors and meeting legal obligations.
- Letting you know when Craftshop opens if you joined the waitlist and, if you chose it, sending you the newsletter.
- Understanding, in aggregate, how this site is used so we can improve it. Those measurements are not used to identify you or for advertising.
- Protecting the waitlist form against bots and abuse.
We don’t sell personal data, we don’t use it for advertising and we don’t build profiles of buyers.
Giving us your account data is required to use Craftshop: without your name and email we can’t create the account or tell you what happens with your orders. If the data you give us is inaccurate, you can ask us to correct it as the section Your rights explains.
Joining the waitlist and the newsletter is voluntary. If you don’t, we can’t let you know when Craftshop opens, but you can still use this site.
Buyer data we process on behalf of brands
When a brand connects its store, we receive the data of its buyers that is needed to produce and ship each order. For that data the brand is the controller and Craftshop Labs provides a data processing service on behalf of third parties, under article 25 of Law 25,326. This means that:
- We use that data only to produce, check and ship the brand’s orders, and never for any other purpose.
- We don’t share it with anyone except those involved in producing and delivering the order (the workshop that prints it and the carrier that delivers it).
- When the store asks us to delete a buyer’s data or the whole store’s data, we delete it or make it anonymous.
- When the service with the brand ends, we destroy that data, except what a law requires us to keep.
If you are a buyer from a brand that uses Craftshop, your order is managed by that brand. You can ask the brand for access to, correction of or deletion of your data; if you write to us, we pass your request on to the brand.
Who we share it with
We share personal data only with those we need to provide the service, and only what each of them needs:
| Who | What for |
|---|---|
| Cloudflare, Inc. | Hosts the app, this site, the database and the files, runs background tasks, sends the service’s emails and, with Turnstile, checks that a person is using the waitlist form. |
| Google LLC | Identifies you when you sign in with your Google account. |
| PostHog, Inc. | Measures, in aggregate, how this site is used, without cookies. |
| Your online store | Receives each order’s shipment and tracking number. |
| Production workshops | See the data of each order they have to print, check and ship. |
| Carriers | Receive the buyer’s name, address and contact details to deliver the shipment. |
Cloudflare, Google and PostHog process the data as our service providers, under their own data protection terms. We may also disclose data when a competent authority orders it in accordance with the law.
International transfers
Cloudflare and Google process data on servers located outside Argentina, including the United States. PostHog processes this site’s usage measurements in the United States. Article 12 of Law 25,326 prohibits transferring data to countries that don’t provide adequate levels of protection, except for the exceptions the law allows, and the United States is not on the list of countries with adequate protection.
For these transfers we use [chosen international transfer mechanism].
How long we keep it
We keep each piece of data for as long as it is needed for the purpose we received it for, and then we delete it or make it anonymous. The periods for each category are [retention periods by category]:
| Data | How long |
|---|---|
| Your account and your organization | While the account is active, and [period] after closing it. |
| Store connection | Until you disconnect the store, and [period] after that. |
| Files and models | While the account is active, and [period] after closing it. |
| Buyer data | As long as needed to produce, ship and handle claims about the order, and [period] after that, unless the store asks for its deletion earlier. |
| Technical logs | [period]. |
| Waitlist and newsletter | While you stay on the waitlist or subscribed to the newsletter, and [period] after you ask to leave. |
| Usage measurements of this site | [retention period of the events in PostHog]. |
Cookies
The Craftshop app uses only its own cookies, and only those it needs to work:
| Cookie | What for |
|---|---|
better-auth.session_token |
Keeps you signed in. |
PARAGLIDE_LOCALE |
Remembers the language you chose. |
theme |
Remembers whether you prefer the light or dark theme. |
We don’t use advertising or analytics cookies. This site stores no cookies or other data on your device: usage measurement works without cookies. Cloudflare Turnstile loads only when you open the waitlist form; [confirm whether Turnstile stores cookies or data on the device, and which].
Security
We apply the technical and organizational measures that article 9 of Law 25,326 requires to protect data against loss, unauthorized access and tampering. Among them:
- All traffic is encrypted over HTTPS.
- Store credentials are stored encrypted and used only inside the service that connects to each store.
- Each organization sees only its own data, and within it each person sees what their role allows.
- Files are kept in private storage and downloaded through signed links that expire.
- Technical logs carry identifiers, never credentials or buyer data.
No system is invulnerable. If we detect an incident that affects your data, we will let you know and take the measures that apply.
Your rights
As the owner of your data, you can:
- Access the data we hold about you. We answer within ten calendar days of your request. Access is free of charge if you request it at intervals of no less than six months, unless you show a legitimate interest in requesting it sooner (article 14 of Law 25,326).
- Rectify and update data that is inaccurate or incomplete.
- Request the deletion of your data when it is no longer needed for the purpose we received it for, unless a law or a contract requires us to keep it.
We resolve rectification, update and deletion requests within five business days of receiving them (article 16 of Law 25,326). To exercise any of these rights, write to [privacy contact email] from your account’s email, or proving your identity in another way.
To leave the waitlist or the newsletter and have your email deleted, write to [privacy contact email] from that same email.
Supervisory authority
The Agency for Access to Public Information (Agencia de Acceso a la Información Pública, AAIP) is the supervisory authority of Law 25,326. As required by AAIP Resolution 14/2018, this is its mandated notice, in the original Spanish:
LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.
In English: the AAIP, as the supervisory body of Law 25,326, has the power to handle the complaints and claims filed by anyone whose rights are affected by a breach of the personal data protection rules in force.
You can reach it at www.argentina.gob.ar/aaip. The text of the law is on InfoLEG, Ley 25.326 (in Spanish).
Registration number in the National Registry of Databases: [registration number in the National Registry of Databases, if applicable].
Changes to this policy
If we change this policy, we publish the new version on this page with its update date. If the change is significant, we let you know by email before it takes effect.
This policy is in force from [effective date].
Contact
For any question about your personal data, write to [privacy contact email] or by post to Craftshop Labs, [legal address].