Privacy policy

1. Data controller

The data controller is Deeploy Tech, company registration number 198010133232. Send questions about your data to (not provided).

2. Which data we process

• Account: your email address. If you sign in with Google, we also get your name and profile picture from Google, plus the temporary sign-in tokens Google sends to sign you in.
• Session: IP address and browser information are stored together with your sign-in, so we can protect the account against abuse.
• Orders: name, street address, postal code, city and phone number when you choose shipping, the model files you upload, your choices and notes, order history and payment status.
• Payment: we learn whether the payment went through. Card details are handled only by Stripe and never reach us.
• AI designer: your descriptions, the models created and your credit history.
• Technical: technical logs that our hosting provider keeps to keep the service secure and running.

3. Why we process it

• To perform our contract with you: print and deliver the order, let you sign in and use the designer, handle credits and subscriptions.
• If you place an order but do not pay for it, we send one reminder by email, once per order, about a day later. It is part of the order, not marketing.
• To comply with the law: the Swedish Bookkeeping Act requires us to keep purchase records for seven years.
• Our legitimate interest: protecting the service against abuse and fraud, troubleshooting and answering your questions.

4. Who we share data with

We never sell your data. We share it only with providers that help us run the service and process it on our behalf:

• Cloudflare: hosting of the website, the database and the storage of model files. At sign-in, Cloudflare Turnstile also checks technical signals about your browser to tell a human from a bot, without advertising cookies or tracking.
• Stripe: payments, subscriptions and receipts.
• Mailtrap: sending email, such as sign-in links and order confirmations.
• Google: sign-in, only if you choose to sign in with Google.
• Anthropic: the AI model behind the designer. Anthropic receives your description and earlier steps of the same part, but not your name, email or address. Under Anthropic’s terms, data from their API is not used to train their models.
• PostNord: name, address and phone number when we ship your parcel.

Some providers are based in the United States. Transfers there rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

5. How long we keep data

• Files for an unpaid order: deleted 72 hours after the order was created, if it is not paid. This runs in a daily job, so the file is deleted within about a day of that, and it can take a further day if many orders are waiting at once.
• Files for an order that has been picked up, shipped, delivered or refunded: deleted 90 days after that, in the same kind of daily job.
• Order data and receipts: seven years, under the Swedish Bookkeeping Act. Your name, street address and phone number on the order are removed once those seven years have passed, while the postal code, city, amount, date and order number are kept for bookkeeping.
• An order that is cancelled before it is paid: your name, street address, phone number and notes on the order are removed within a month after it was cancelled, since the bookkeeping duty does not apply to it. The postal code and city are kept, the same way as above.
• Your credit history for the AI designer: kept for as long as the account exists. If you delete the account, it is anonymised, but the credit history remains linked to the anonymised account, without your name or email, as the record behind your credit balance.
• Parts you create in the designer: kept until you delete them or your account. When you delete a part, we remove the description, the generated code and the preview. A part that has become part of an order is still kept, as part of that order’s data, for as long as the order data above is kept. The description in failed or abandoned attempts in the designer (with no finished part) is removed automatically within a month.
• Your account: until you ask us to delete it. To delete your account or get an export of your data, write to (not provided) and it happens within a month.
• Technical logs: a short time, only as long as needed for operations and security.
• Backups: the database has restore points for the last seven days, and we also take regular backups that are kept for a time outside normal operation, so we can restore the service after a technical failure. Data you have asked us to delete may still exist in such a backup until it is overwritten or removed.

6. Cookies and browser storage

We only use cookies that the service needs to work, so no consent is required:

• a sign-in cookie that keeps you signed in,
• if you sign in with Google, a short-lived cookie that protects the sign-in itself and expires after a few minutes,
• a cookie that remembers whether you chose the light or dark theme.

The draft of your order and the files you uploaded are also kept in your own browser, in IndexedDB, among other things to carry a part over from the designer to an order and so they are still there if you leave the page and come back. They do not leave your device until you submit the order. If you sign out, the draft and the files you uploaded are cleared from your browser. We use no tracking, no advertising and no third-party analytics.

7. Your rights

You have the right to know which data we hold about you, to have errors corrected, to have data deleted, to restrict or object to processing and to receive your data in a machine-readable format. Write to (not provided) and we reply within one month. Data that the Bookkeeping Act requires us to keep cannot be deleted early.

If you are unhappy with how we process your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).

8. Changes

We update this policy when we change how we process data. We announce larger changes by email or on the website.