Privacy notice
- We use your details to answer enquiries, run your account and provide our 3D configurator services. We do not sell personal data or use it for advertising.
- Our website sets no advertising or analytics cookies. Signing in stores a session token in your browser so that you stay signed in.
- 3D models and other files you upload stay yours. We do not use them to train AI models.
- You can ask us to see, correct or delete your data at any time by writing to info@3dattract.com.
1. Who is responsible
The controller for the personal data described here is 3D Attract Ltd (3Д Атракт ЕООД), registered in Bulgaria under UIC (ЕИК) 208368629, VAT number BG208368629, with its registered address at 24G General Ivan Kolev St., floor 6, apt. 20, Triaditsa district, 1407 Sofia, Bulgaria (“3D Attract”, “we”, “us”).
For any privacy question or request, email info@3dattract.com or write to the address above. We have not appointed a data protection officer, because the law does not require one for our activities.
This notice covers www.3dattract.com, the 3D Attract Studio at www.3dattract.com/studio, and the 3D configurators that our customers embed on their own websites. When a customer uses our services to process personal data for its own purposes (for example, quote requests from its shoppers), the customer is the controller and we act as its processor under our data processing agreement.
2. What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|---|
| Contact and consultation forms | Name, email, company, website address, your message, which form you used and when. Your IP address is used briefly to block abuse and is not stored with your enquiry. | To reply to you and prepare a proposal or quote. | Steps at your request before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f)). | 24 months after our last contact, unless you become a customer. |
| Live chat | Your messages, any name or email you give us (your account email when you are signed in), and the page you chatted from. | To answer your questions about our services, and to support customers. | Steps you ask for before a contract, and performance of a contract (Art. 6(1)(b)); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)). | Up to 24 months after the conversation, unless it becomes part of a customer relationship. |
| Your account | Email address, password (stored only as a secure hash by our authentication provider), workspace and team details, sign-in and security events. | To create and secure your account and provide the service. | Contract (Art. 6(1)(b)). | While your account is open, then deleted within 90 days of closure. |
| Files and projects you upload | 3D models, textures, images, logos, configuration settings and published configurators. These can contain personal data if you include it. | To store, convert, optimise, display and publish your configurators. | Contract (Art. 6(1)(b)). For personal data inside your files we act as your processor. | While your account is open, then deleted within 90 days of closure (backups roll over within a further 30 days). |
| Quote requests in an embedded configurator | Name, email, message and the selected options. | To send the request to the business running the configurator and a confirmation to the shopper. | We process this on behalf of that business, which is the controller. | We do not keep a copy after the emails are sent, apart from short-lived delivery logs at our email provider. |
| Configurator usage counts | Anonymous counts per page view (interactions, active time, quote-button clicks) with a random ID that changes on every page load. No cookies and no identifiers across visits. | To show customers how their configurators are used. | Legitimate interest (Art. 6(1)(f)). | Aggregated; no personal data is kept. |
| Billing (when paid plans start) | Company name, billing contact, address, VAT number, invoices and payment status. Card and bank details are handled by our payment provider; we never see full card numbers. | To invoice and keep accounting records. | Contract and legal obligation (Art. 6(1)(b) and (c)). | As required by Bulgarian accounting and tax law (generally 10 years for accounting documents). |
| Website visit statistics | Which pages are viewed, the referring website, country, device type and browser. No cookies are set and no identifier follows you across sites or days; visits are counted using a short-lived hash that cannot be turned back into your IP address. | To understand which pages help visitors and improve the website. | Legitimate interest (Art. 6(1)(f)). | Aggregated statistics only. |
| Server and security logs | IP address, browser type, requested address, time and errors. | To keep the services running and secure. | Legitimate interest (Art. 6(1)(f)). | Short term, as set by our hosting provider (typically days to weeks). |
You do not have to give us personal data, but we cannot answer an enquiry without an email address or open an account without one.
3. Cookies and browser storage
We do not use advertising, tracking or analytics cookies. When you sign in, our authentication service stores a session token in your browser’s local storage so that you stay signed in. This is strictly necessary for a service you asked for, so it does not need consent. Signing out removes it.
Our live chat (Crisp) loads only when you click “Chat with us”. From then on, Crisp stores a chat session identifier in your browser so your conversation continues across pages and visits. You asked for the chat, so this does not need consent. You can delete it by clearing your browser’s storage for our site.
Our website serves its fonts from our own servers. The Studio editor currently loads one typeface from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with Google when you use the Studio.
4. Who we share data with
We use the service providers below to run our services. They act on our instructions under data processing terms, and we share only what each one needs.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Vercel Inc. | Website and Studio hosting, form handling, cookieless visit statistics | EU (Frankfurt) for our functions; global network for page delivery; Vercel is US-based |
| Supabase Inc. | Accounts, database and file storage | London, United Kingdom |
| Google (Google Workspace) | Business email and our enquiry records | EU and other Google locations |
| Stripe Payments Europe, Ltd (when paid plans start) | Payment processing. Stripe is also responsible in its own right for the payment data it handles. | Ireland (EU) and United States |
| Crisp IM SAS | Website live chat: your messages, the email and name you give us, and when signed in, your account email. Also basic technical data (browser, page, approximate location from your IP address) | European Union (France) |
| Resend (Plus Five Five, Inc.) | Sending quote-request emails from configurators | United States |
We may also share data with professional advisers, or with authorities where the law requires it. If our business is sold or reorganised, data may pass to the new owner under the same protections.
5. Transfers outside the EU
The United Kingdom has an EU adequacy decision. For providers in the United States we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses. You can ask us for a copy of the relevant safeguards.
6. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you or another provider in a portable format. Where we rely on consent, you can withdraw it at any time. We reply within one month.
If you think we have handled your data wrongly, please tell us first. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or to the authority where you live or work.
If your data reached us through one of our customers (for example, a quote request in their configurator), contact that business first. We will help them respond.
7. Security
Data is encrypted in transit, access is limited to the people who need it, our staff accounts with providers use strong sign-in with two-factor authentication where available, and our database applies per-account access rules. No system is perfectly secure; if a breach puts your data at risk we will tell you and the authorities as the law requires.
8. Children
Our services are for businesses and are not meant for anyone under 16. We do not knowingly collect children’s data.
9. Changes
We will update this notice when our services or the law change and show the date at the top. If a change matters to you, we will tell you by email or in your account.