Privacy policy

The data controller is the owner of ImpriForge, a 3D printing and modelling service, trading as a self-employed individual (autónomo) in Spain.

For anything concerning your data, write to impriforge@gmail.com.

Each time a page loads we store one row with the following:

• The IP address you connect from, taken from the connection itself.
• The approximate country, region and city our provider derives from that IP.
• The page or search engine you arrived from, when your browser tells us.
• Your browser identifier (user-agent) and whether the visit comes from a phone, a computer or a bot.
• Which pages you visit on the site, and when.
• Clicks on the WhatsApp button and on the order buttons, so we can see which sections lead to real contact.

These rows carry no name, no email and no user identifier, and cannot be linked to an account: the site has no accounts.

Two things and nothing else: measuring how many people visit the site and where they arrive from, and spotting abuse such as automated requests or attempts to flood the forms.

The legal basis is our legitimate interest, Article 6(1)(f) GDPR: we need to know whether the site works and to protect it from abuse. We do not use this data for advertising, we do not sell it, and we do not pass it to third parties for commercial purposes.

The IP address is erased after 30 days. An automated job replaces it daily with an empty value in the row itself, leaving no copy.

The rest of the row — country, source, page and date — is kept indefinitely, by then without any IP, as aggregate visit statistics.

In a database managed by Supabase and hosted in the United Kingdom (London), acting as our processor. The United Kingdom holds an adequacy decision from the European Commission, so the transfer needs no additional safeguards. We send this data to no other country.

When you place an order or send a modelling request we store what you enter yourself: name, email address, delivery address and the details of the job, together with any file you upload. Payment is handled by Stripe or PayPal, which receive what they need to process it under their own policies; we never see or store your card details.

Model files over 50 MB are never uploaded and never stored: your own browser works out the volume and the dimensions, and only those three numbers reach us. If you order a print of one, we write to you after payment so you can send us the file however you prefer.

The legal basis is performance of the contract, Article 6(1)(b) GDPR, together with our legal invoicing obligations. We keep this information for as long as the relationship lasts and for the tax and commercial retention periods the law requires.

We do not sell your data and we do not pass it on for commercial purposes. It leaves our hands only towards the companies needed to keep the site running and to get your order to your door, and each one receives no more than it has to:

• Vercel, the platform this site is published on, hosts the site and runs the server that answers every request. It acts as a processor on our behalf, and this project is configured to run in its Frankfurt region (Germany), inside the European Union.
• Supabase stores the database, under the conditions described in the section above.
• Stripe or PayPal process the payment when you pay, each under its own policy.
• The transport company that carries the parcel receives your name, your delivery address and your phone number. Without those three there is no delivery; nothing else about your order is passed to it.
• Packlink is involved at two separate moments, with different data each time. To work out the shipping price before you pay, we query its rates: that request carries only the destination country and postcode and the parcel's size and weight — not your name, your address or your phone number. Later, when we buy the label for your parcel in its panel, Packlink does receive your delivery details — your first name and surname, your e-mail address and the destination address — and passes them on to the carrier that collects the parcel. Without them there is no label and no delivery: the legal basis is performance of the sales contract.

Beyond that list, we would only disclose data to public authorities, the courts or law enforcement where a legal rule obliges us to.

This site sets at most two first-party cookies. The first, “NEXT_LOCALE”, holds the language the site is shown to you in. It is a first-party session cookie — it is deleted when you close your browser — and its only job is to keep your language from resetting as you move between pages. We set no analytics, advertising or third-party cookies, and create no identifier that follows you across sites. Because it is a user-interface preference cookie, it falls outside the prior-consent requirement of article 22.2 of the LSSI, which is why you will see no cookie banner. Your IP is read from the connection, not from your device. If you sign in to the admin panel, one further first-party cookie (“if_visitor”) is stored, whose only purpose is to keep our own visits out of the statistics; it is never set for an ordinary visitor.

You may request access to the data we hold about you, its correction or its deletion, object to processing based on legitimate interest, and ask for restriction or portability.

To exercise them, write to impriforge@gmail.com. If your request concerns a specific visit, tell us the approximate date and IP address: these rows are tied to no identity, so without that we cannot find them.

If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (aepd.es).