Privacy policy

Last updated: 31 October 2026

This policy explains how 3DCRAFTS (“we”, “us”) looks after your personal data when you use 3dcrafts.uk, request a quote or place an order. We are based in Edinburgh, Scotland, and handle your data in line with UK GDPR and the Data Protection Act 2018.

Who is responsible for your data

3DCRAFTS is the data controller. You can contact us about anything in this policy at hello@3dcrafts.uk.

What we collect and why

Quote requests: your name, email address, business name (if given), what you need, quantity, and any photos, sketches or design files you upload. We use these to reply to you and prepare a quote. Lawful basis: taking steps at your request before a contract, and our legitimate interest in running our business.
Orders: your name, email address, delivery address, the items you ordered, any personalisation text you provide, and order and payment status. We use these to make, dispatch and support your order, to keep records and to meet tax and accounting obligations. Lawful basis: performing our contract with you, and legal obligation.
Order tracking: when you look up an order we check the order number and email you enter against our records.
Basic technical data: such as IP address and browser details, processed by our hosting and security providers to deliver the site, prevent abuse and apply rate limits. Lawful basis: legitimate interests.

We do not collect your card details. Payments are taken by Stripe, which handles them under its own privacy policy. We receive only confirmation of the payment and limited details such as the last four card digits.

We do not use your data for automated decision-making, and we do not sell it.

Cookies and local storage

We use only what is needed to make the site work: your basket is saved in your browser's local storage so it is still there when you return, and administrators use a sign-in session cookie. We do not currently use advertising or analytics cookies. If that changes we will update this page and ask for consent where the law requires it.

Who we share data with

We use trusted providers to run the business, and they process data only on our instructions:

Stripe, for taking payments.
Supabase, for our database and file storage.
Resend, for sending emails such as quote replies and order updates.
Our hosting provider, for serving the website.
Upstash, for rate limiting to prevent abuse.
Delivery carriers, who receive your name, delivery address and, where needed, contact details so they can deliver your parcel.
Our accountants and professional advisers, where needed.
Internal messaging tools we use to alert our team about new quotes and orders.

Some of these providers may process data outside the UK. Where they do, we rely on safeguards such as the UK International Data Transfer Agreement or addendum, or an adequacy decision.

How long we keep it

Quote requests that do not lead to an order: up to 12 months.
Order and payment records: 6 years, to meet tax and accounting requirements.
Design files for repeat orders: while you remain a customer, unless you ask us to delete them sooner.

Your rights

You have the right to access your data, correct it, ask us to erase it, restrict or object to our use of it, and receive a copy in a portable format. Email hello@3dcrafts.uk and we will respond within one month. Some records, such as invoices, we must keep by law.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.