Privacy notice
- We use your details to answer enquiries, run your account and provide our 3D configurator services. We do not sell personal data or use it for advertising.
- Our website sets no advertising or analytics cookies. Signing in stores a session token in your browser so that you stay signed in.
- 3D models and other files you upload stay yours. We do not use them to train AI models.
- You can ask us to see, correct or delete your data at any time by writing to info@3dattract.com.
1. Who is responsible
The controller for the personal data described here is 3D Attract Ltd, registered in Bulgaria under UIC 208368629, VAT number BG208368629, with its registered address at 24G General Ivan Kolev St., floor 6, apt. 20, Triaditsa district, 1407 Sofia, Bulgaria (“3D Attract”, “we”, “us”).
For any privacy question or request, email info@3dattract.com or write to the address above. We have not appointed a data protection officer, because the law does not require one for our activities.
This notice covers www.3dattract.com, the 3D Attract Studio at www.3dattract.com/studio, and the 3D configurators that our customers embed on their own websites. When a customer uses our services to process personal data for its own purposes (for example, quote requests from its shoppers), the customer is the controller and we act as its processor under our data processing agreement.
2. What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|---|
| Contact and consultation forms | Name, email, company, website address, your message, which form you used and when. Your IP address is used briefly to block abuse and is not stored with your enquiry. | To reply to you and prepare a proposal or quote. | Steps at your request before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f)). | 24 months after our last contact, unless you become a customer. |
| Emails you send us | Your email address, name, signature details and the content of emails you exchange with info@ or office@. | To reply, keep track of our conversations with customers and prospects, and act on requests (for example, to stop sending you product news). Emails to and from these addresses are copied into our customer records (CRM) at Twenty. | Steps you ask for before a contract and performance of a contract (Art. 6(1)(b)); otherwise our legitimate interest in running and keeping track of business correspondence (Art. 6(1)(f)). | Up to 24 months after our last contact, or longer where an email is part of a contract or accounting record. |
| Product news (only if you tick the box) | Your name, email address and company, and the date and time you agreed, with the form and wording you agreed to. | To send you occasional product news: new 3D Attract features and updates, usually no more than once a month. If you ask us by email to stop, an automated check (using an AI feature of our CRM provider, Twenty) reads your email to recognise the request and unsubscribes you. It can only ever take you off the list, never add you, and our staff can see and correct what it did. | Your consent (Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, or by writing to info@3dattract.com. Withdrawing doesn’t affect emails sent before. | Until you withdraw your consent, or 24 months after our last contact with you, whichever comes first. After you unsubscribe we keep only your email address on a “do not email” list, so we don’t contact you again by mistake. |
| Live chat | Your messages, any name or email you give us (when you are signed in, your account email, name and company), and the page you chatted from. | To answer your questions about our services, and to support customers. | Steps you ask for before a contract, and performance of a contract (Art. 6(1)(b)); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)). | Up to 24 months after the conversation, unless it becomes part of a customer relationship. |
| Your account | Email address, password (stored only as a secure hash by our authentication provider) or the Google or GitHub account you sign in with, workspace and team details, sign-in and security events. | To create and secure your account and provide the service. Your name, email address and company are also added to our customer records (CRM) so we can support you as a customer, together with your plan, billing period and trial or subscription status. | Contract (Art. 6(1)(b)); for our customer records, our legitimate interest in managing customer relationships (Art. 6(1)(f)). | Your account: while it is open. After closure you have 30 days to export your content; we delete the account within 90 days of closure, and backups are overwritten within a further 30 days. If an account has no paid plan and nobody has signed in for 24 months, we close it after warning the owner by email. Our customer record of you: up to 24 months after your account closes or our last contact, whichever is later. |
| Signing in with Google or GitHub (only if you choose it) | What Google or GitHub sends to our authentication provider (Supabase) when you sign in with them: your name, your email address and whether it is verified, a link to your profile picture, and your Google or GitHub account ID. GitHub also sends your GitHub username. We never receive your Google or GitHub password, and we cannot see anything else in those accounts. | To create your account or sign you in. If you already have an account with the same verified email address, the sign-in is added to that account. Your Google or GitHub name may be shown as the name on your account. | Contract (Art. 6(1)(b)). | As for “Your account”. Our authentication provider updates these details each time you sign in with Google or GitHub. |
| Files and projects you upload | 3D models, textures, images, logos, configuration settings and published configurators. These can contain personal data if you include it. | To store, convert, optimise, display and publish your configurators. | Contract (Art. 6(1)(b)). For personal data inside your files we act as your processor. | While your account is open. After closure you have 30 days to export them; we delete them within 90 days of closure, and backups are overwritten within a further 30 days. |
| Team members and client workspaces | The email address of a person invited to a workspace, who invited them, the workspace, their permissions and when they accepted. Once they accept, their own account (see “Your account”). | To let agencies and companies give their team and clients access, and to send the invitation email. | Performance of our contract with the workspace owner, and our legitimate interest in letting them invite people (Art. 6(1)(b) and (f)). | Invitations expire after 14 days. Invitation and membership records are kept while the workspace exists and are deleted with it. |
| Quote requests in an embedded configurator | The shopper’s name, email address, message and the options they chose. | To send the request to the business running the configurator and a confirmation to the shopper, and to stop the form being misused. | We process this on behalf of that business, which is the controller. | The emails are sent from info@3dattract.com through our Google Workspace account (see section 4). Our delivery record keeps no email text and no email addresses: only one-way codes (hashes) and whether each email was delivered. We keep it for up to 30 days to prevent abuse and investigate delivery problems. |
| Configurator usage counts | Anonymous counts per page view (interactions, active time, quote-button clicks) with a random ID that changes on every page load. No cookies and no identifiers across visits. | To show customers how their configurators are used. | Legitimate interest (Art. 6(1)(f)). | Aggregated; no personal data is kept. |
| Paid plans and invoices | For Standard, Pro and Guru: your plan, billing period, subscription status, billing country and the customer reference that Link gives us. For custom and managed projects: company name, billing contact, address, VAT number, invoices and payment status. Card and bank details are handled by the payment provider; we never see full card numbers. | To give you the plan you paid for, invoice custom work and keep accounting records. | Contract and legal obligation (Art. 6(1)(b) and (c)). | Accounting documents and registers for as long as Bulgarian accounting and tax law requires (up to 10 years); subscription records while your account is open and then as part of those accounting records. |
| Website visit statistics | Which pages are viewed, the referring website, country, device type and browser. No cookies are set and no identifier follows you across sites or days; visits are counted using a short-lived hash that cannot be turned back into your IP address. | To understand which pages help visitors and improve the website. | Legitimate interest (Art. 6(1)(f)). | Aggregated statistics only. |
| Server and security logs | IP address, browser type, requested address, time and errors. | To keep the services running and secure. | Legitimate interest (Art. 6(1)(f)). | Short term, as set by our hosting provider (typically days to weeks). |
You do not have to give us personal data, but we cannot answer an enquiry without an email address or open an account without one.
Where we did not get your details from you: if someone invited you to a workspace, we got your email address from them. If you sent a quote request through a configurator, we got it from the business running that configurator’s form. For paid plans, Link tells us your plan and payment status.
3. Cookies and browser storage
We do not use advertising, tracking or analytics cookies. When you sign in, our authentication service stores a session token in your browser’s local storage so that you stay signed in. This is strictly necessary for a service you asked for, so it does not need consent. Signing out removes it.
We also keep a few small items in your browser’s local storage: if you open an invitation link, the invitation until you accept it; if you choose a paid plan on our pricing page, that choice for up to 24 hours so you can finish checkout after signing up; and, when you are signed in, which workspace you last opened and a note that your account has been added to our customer records, so this isn’t repeated on every visit. Clearing your browser’s storage for our site removes them. If you click “Continue with Google” or “Continue with GitHub”, we also keep a small note in that browser tab’s session storage: which one you chose, whether you were signing in or creating an account, and which part of the account page and payment result to show when you come back. It is deleted as soon as you return, is ignored after 30 minutes, and is removed when you close the tab.
Our live chat (Crisp) loads only when you click “Chat with us”. From then on, Crisp stores a chat session identifier in your browser so your conversation continues across pages and visits. You asked for the chat, so this does not need consent. You can delete it by clearing your browser’s storage for our site.
Our website and the Studio editor serve their fonts from our own servers, so your browser does not contact a font provider when you use them.
The open-source program code our pages use (such as React and three.js) is served from our own website, not from public code-delivery networks.
4. Who we share data with
We use the service providers below to run our services. Most of them act on our instructions under data processing terms; where a provider is responsible for data in its own right, the table says so. We share only what each one needs.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Vercel Inc. | Website and Studio hosting, form handling, cookieless visit statistics | EU (Frankfurt) for our functions; global network for page delivery; Vercel is US-based |
| Supabase Inc. | Accounts, database and file storage | London, United Kingdom |
| Google LLC and GitHub, Inc. | Only if you choose to sign in with them: they confirm who you are and send us the details listed in section 2. They are responsible for this in their own right, under their own privacy policies. We do not send them your 3D Attract data. | United States and other locations |
| Google (Google Workspace) | Business email (info@ and office@); sending quote-request emails from configurators, from info@3dattract.com (Google Apps Script); and enquiry records from before we moved them to Twenty | EU and other Google locations |
| Twenty.com PBC | Our customer records (CRM): emails you exchange with info@ and office@, your enquiry, contact details and our follow-up notes and tasks; for account holders, the account name, email address, company name, when the account was opened, and the plan, billing period and trial or subscription status. Twenty’s AI feature reads emails to recognise unsubscribe requests. | EU (Frankfurt, Germany); Twenty is US-based. Its AI feature uses an AI model from TypeSafe AI, Inc., in the United States. |
| Sold through Link, LLC (“Link”, a Stripe company) | Sells the Standard, Pro and Guru subscriptions as merchant of record: takes payment, charges VAT, sends receipts and invoices and handles refunds and payment questions. Link decides how it uses this payment data and is responsible for it in its own right, as an independent controller; see Link’s privacy policy. | Ireland (EU) and United States |
| Stripe Payments Europe, Ltd | Payment processing for custom and managed projects. Stripe is also responsible in its own right for some payment data it handles, such as fraud checks. | Ireland (EU) and United States |
| Crisp IM SAS | Website live chat: your messages, the email and name you give us, and when signed in, your account email, name and company. Also basic technical data (browser, page, approximate location from your IP address) | European Union (France) |
| Resend (Plus Five Five, Inc.) | Sending emails: the confirmation and our internal alert when you use a website form, and team invitations | EU (Ireland) for website form emails; United States for other emails; Resend is US-based |
| Anthropic Ireland, Limited, with Anthropic, PBC | The AI provider behind the AI assistants our team uses for operations, support and development (our Ops and Studio agents). When our staff use them for a task, they may process the data that task needs, such as enquiries, customer records, support emails and project data. We use them under Anthropic’s commercial terms and data processing addendum, which don’t allow Anthropic to train its models on this data. | United States |
| Cloudflare, Inc. | Bot checks (Turnstile) on the quote-request form in published configurators, once we switch them on: technical data about your browser and device, and your IP address, to tell people apart from automated abuse | Global network; Cloudflare is US-based |
Quote-request emails from configurators are sent from info@3dattract.com through Google Workspace.
We may also share data with our accountant and other professional advisers, or with authorities where the law requires it. If our business is sold or reorganised, data may pass to the new owner under the same protections.
We do not sell personal information or share it for cross-context behavioural advertising, as those terms are defined in US state privacy laws.
5. Transfers outside the EU
Some providers in section 4 are in the United Kingdom or the United States, or can access data from there.
- United Kingdom (Supabase’s data centre in London): the EU has decided that the UK protects personal data adequately.
- United States (Vercel, Supabase, Twenty and its AI provider TypeSafe, Resend, Google, Stripe/Link, Anthropic and Cloudflare): we rely on the EU–US Data Privacy Framework for providers certified under it, and on the European Commission’s standard contractual clauses for the others, together with checks on the risks of the transfer. For Anthropic we rely on the standard contractual clauses in its data processing addendum.
You can ask us for a copy of the relevant safeguards at info@3dattract.com.
6. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you or another provider in a portable format. Where we rely on consent, you can withdraw it at any time. We reply within one month. If a request is complex we may need up to two more months, and we will tell you why within the first month.
We do not make decisions about you that have legal or similarly significant effects based only on automated processing. (The automated check that reads unsubscribe requests can only take you off our mailing list.)
If you think we have handled your data wrongly, please tell us first. You also have the right to complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or to the authority where you live or work. If you are in the UK, you can also complain to the Information Commissioner’s Office (ico.org.uk).
If your data reached us through one of our customers (for example, a quote request in their configurator), contact that business first. We will help them respond.
7. Security
Data is encrypted in transit, access is limited to the people who need it, our staff accounts with providers use strong sign-in with two-factor authentication where available, and our database applies per-account access rules. No system is perfectly secure; if a breach puts your data at risk we will tell you and the authorities as the law requires.
When you open the account pages or Studio, our hosting provider (Vercel) tells our website which country your IP address belongs to. We use this only to block access from countries where EU sanctions stop us offering the Services (currently Russia and Belarus). The legal basis is our legal obligation to comply with EU sanctions (Art. 6(1)(c) GDPR). We don’t store it.
8. Children
Our services are for businesses and are not meant for anyone under 16. We do not knowingly collect children’s data.
9. Changes
We will update this notice when our services or the law change and show the date at the top. If a change matters to you, we will tell you by email or in your account.