Your data, plainly

This policy explains how [Company legal name] ("OAC") collects, uses and shares personal information when you use OAC. We collect what we need to run the marketplace, and we don't sell your personal information.

• Account details: name, username, email, password (stored hashed by our authentication provider), profile and storefront information.
• Listings and files: models, fabrication files, images, descriptions and settings creators upload.
• Orders: what you bought, configurations, shipping address, order history, entitlements to digital files, and messages about an order.
• Payments: handled by [payment processor]. We receive limited details such as the last four digits of a card and payment status, never full card numbers. Creators and makers who receive payouts provide identity and bank details directly to the payment processor.
• Maker profiles: for Mini Manufacturers, service area, equipment, materials and capacity.
• Usage: pages viewed, searches, viewer interactions, device and browser type, and approximate location from IP address.

• To run accounts, listings, checkout, delivery of files and fulfillment of orders.
• To pay creators and makers, and to prevent fraud, abuse and infringement.
• To send order updates and account notices, and marketing only where you've agreed.
• To improve search, recommendations and the 3D experience.
• To meet legal, tax and accounting obligations.

• Creators receive the name, shipping address and configuration for orders they fulfill.
• Mini Manufacturers receive the details needed to make and ship a job assigned to them, and only for that job.
• Service providers who process data for us: hosting and database ([e.g. Supabase]), payments ([e.g. Stripe]), email delivery, error monitoring and analytics.
• Authorities, when the law requires it or to protect people's safety.

Your public profile, storefront, reviews and makes are visible to everyone.

We use essential cookies and browser storage to keep you signed in, remember your cart and save viewer preferences. [Describe any analytics or advertising cookies and how to opt out.]

We keep account information while your account is open. Order and payment records are kept for [number] years to meet tax and accounting rules. When you delete your account we delete or anonymize your personal information, except what we must keep by law.

Depending on where you live, you can ask to access, correct, download or delete your personal information, object to or restrict some uses, and withdraw consent. Email [privacy email]. You can also complain to your local data protection authority.

Data is encrypted in transit, access is limited to people who need it, and private files are delivered through short-lived signed links. No system is perfectly secure; tell us at [security email] if you find a problem.

Our providers may process data in [countries]. Where required, we use safeguards such as standard contractual clauses.

OAC isn't meant for children under [age], and we don't knowingly collect their information.

We'll post changes here and notify you of material ones. Controller: [Company legal name and address]. Contact: [privacy email].