Privacy Policy
Last updated: 5 September 2026
This Privacy Policy explains how 3DUploader collects, uses, shares and protects your personal data when you visit 3duploader.com, create an account, buy or download 3D models, upload your own models, subscribe to our newsletter or contact us (together, the “Service”).
We are based in the European Union, so this policy is written to comply with Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 (“LOPDGDD”). Specific sections for visitors in the United Kingdom and in California are included at the end.
1. Who is responsible for your data
- Data controller: 3DUploader Inc
- Website: 3duploader.com
- Privacy contact: support@3duploader.com
2. What personal data we collect
2.1 Data you give us
- Account data. Username, email address, password (stored only as a cryptographic hash), display name and, optionally, a profile picture and biography.
- Billing and order data. First and last name, billing address, country, postcode, phone number, email address, company name and VAT or tax number where you provide one, plus the products you purchase and your order history and invoices.
- Payment data. Card and payment details are entered directly into the systems of our payment providers. We never see or store full card numbers. We only receive the transaction result, the payment method type, the last four digits, the expiry date and any risk or fraud indicator our providers return.
- Content you upload. If you publish models on 3DUploader, we process the files themselves (STL, OBJ, STEP and similar formats), preview images, titles, descriptions, tags, licence choices and any metadata embedded in those files. Note that 3D and image files can carry metadata such as author name, software used or geolocation — please remove anything you do not want to be public before uploading.
- Payout data (contributors only). If we pay you for sales, we process the identification and payment details needed to make and document that payment, including your PayPal address or bank details and any tax information required by law.
- Communications. The content of contact forms, support emails, product reviews, ratings and comments, together with the name and email address you submit with them.
- Marketing preferences. Your newsletter subscription status and the date, time and source of your consent.
2.2 Data we collect automatically
- Technical and log data. IP address, browser type and version, operating system, device type, screen size, language, referring URL, pages viewed, timestamps and error logs. Our hosting provider and CDN generate these records for every request as part of operating and protecting the site.
- Usage and analytics data. Pages and products you view, searches you run, items added to the cart, downloads you start and the approximate location (city or region level) derived from your IP address.
- Cookies and similar technologies. See section 5.
2.3 Data we receive from third parties
- Social login. If you sign in with Facebook, Google or another supported provider, we receive your name, email address, provider user ID and profile picture, according to the permissions you grant. We never receive your password on those services.
- Payment providers. Confirmation of payment, refunds, chargebacks and fraud-prevention signals.
We do not intentionally collect special categories of data (health, political opinions, religious beliefs, biometrics and similar). Please do not include such information in forms, reviews or uploaded content.
3. Why we use your data and on what legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and manage your account and let you sign in | Account data, social login data | Performance of a contract (Art. 6.1.b) |
| Process orders, deliver downloads, issue invoices and handle refunds | Billing, order and payment data | Performance of a contract (Art. 6.1.b) |
| Publish and distribute the models you upload, and pay you for sales | Uploaded content, payout data | Performance of a contract (Art. 6.1.b) |
| Answer your questions and provide customer support | Communications, account and order data | Performance of a contract, or our legitimate interest in responding to enquiries (Art. 6.1.b / 6.1.f) |
| Keep the site secure, prevent fraud and filter spam | Technical and log data, comment and form data | Legitimate interest in protecting the Service and its users (Art. 6.1.f) |
| Measure audience and improve the site with analytics | Usage data, analytics cookies | Your consent (Art. 6.1.a), given through the cookie banner |
| Show advertising, including personalised advertising | Usage data, advertising cookies and identifiers | Your consent (Art. 6.1.a) |
| Send you our newsletter and commercial communications | Email address, marketing preferences | Your consent (Art. 6.1.a), or our legitimate interest in offering similar products to existing customers (Art. 6.1.f), which you can object to at any time |
| Comply with accounting, tax and consumer-protection obligations | Order, billing and invoice data | Legal obligation (Art. 6.1.c) |
| Establish, exercise or defend legal claims, including copyright complaints | Any relevant data | Legitimate interest and legal obligation (Art. 6.1.f / 6.1.c) |
Where we rely on consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interest, we have balanced that interest against your rights and you may object as described in section 9.
4. Automated decisions and profiling
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Our payment providers do run automated fraud checks that may result in a transaction being declined; if that happens you can contact us to have the decision reviewed.
5. Cookies and similar technologies
We use cookies and comparable technologies (local storage, pixels) for the following purposes:
- Strictly necessary. Sign-in sessions, shopping cart contents, checkout, security tokens, load balancing, page caching and remembering your cookie choices. These are set on the basis of our legitimate interest and cannot be switched off.
- Preferences. Language, currency, recently viewed products and layout choices.
- Analytics. Google Analytics, to understand how the site is used. Set only with your consent.
- Advertising. Google AdSense and related services, to display ads and, where you allow it, personalise them and measure their performance. Set only with your consent.
When you first visit the site, our consent banner lets you accept all cookies, reject all non-essential cookies, or choose by category. You can change your decision at any time through the cookie settings link in the site footer, and you can also block or delete cookies in your browser settings — note that blocking strictly necessary cookies will break the cart and checkout.
6. Who we share your data with
We do not sell your personal data. We share it only with the service providers we need in order to run the Service, each of which acts as our processor under a data processing agreement, or as an independent controller where indicated:
- Hosting and infrastructure. Our web host and our CDN and object-storage provider (Cloudflare), which serve the site and the model files hosted on
files.3duploader.com, and which also provide security and DDoS protection. - Payments. Stripe (through WooPayments) and PayPal, which act as independent controllers for the payment data you provide to them and apply their own privacy policies.
- Email delivery. The SMTP provider used to send order confirmations, account notifications and support replies.
- Newsletter. Mailchimp (Intuit), if you subscribe.
- Analytics, advertising and search. Google (Analytics, AdSense, Search Console), subject to your cookie choices.
- Spam filtering. Akismet (Automattic), which checks comments and form submissions.
- Social login providers. Facebook and Google, when you choose to sign in with them.
- Professional advisers and authorities. Accountants, lawyers, tax authorities, courts and law-enforcement bodies, where we are legally required to disclose data or need to defend our rights.
- Business transfers. If the business is sold or merged, your data may be transferred to the acquirer, who will remain bound by this policy until you are notified otherwise.
7. International transfers
Some of the providers listed above are established in the United States or process data outside the European Economic Area. In those cases the transfer is protected by one or more of the following: the provider’s certification under the EU–US Data Privacy Framework, the European Commission’s Standard Contractual Clauses, or an adequacy decision for the destination country. You may request a copy of the safeguards in place by writing to support@3duploader.com
8. How long we keep your data
- Account data: for as long as your account is active, and up to 12 months after you close it, so that we can handle any pending incident.
- Orders and invoices: 6 years from the transaction, to meet Spanish commercial and tax record-keeping obligations, and up to 10 years where anti-money-laundering rules apply.
- Uploaded content: for as long as it is published, plus a reasonable period afterwards for backups and for handling copyright complaints.
- Support messages and form submissions: up to 3 years from the last interaction.
- Newsletter data: until you unsubscribe, plus proof of your consent for as long as any claim about it could be brought.
- Server and security logs: normally up to 12 months.
- Analytics data: according to the retention period configured in Google Analytics, by default 14 months.
Once these periods expire, data is deleted or irreversibly anonymised. Copies may persist in encrypted backups for a limited time until those backups are rotated out.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data (the “right to be forgotten”), where we are not required to keep it.
- Restrict processing in certain circumstances.
- Object to processing based on our legitimate interest, and at any time and without justification to direct marketing.
- Data portability: receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller.
- Withdraw consent at any time, without affecting processing already carried out.
To exercise any of these rights, write to support@3duploader.com from the email address associated with your account, stating which right you wish to exercise. We may ask for additional information to verify your identity. We will respond within one month, which may be extended by two further months for complex requests; we will tell you if that happens. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
You can also manage much of this yourself: edit your details from your account page, unsubscribe using the link at the bottom of every newsletter, and change your cookie choices from the footer.
If you believe we have not handled your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country of residence. We would appreciate the chance to resolve the matter directly first.
10. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS) across the whole site and the file delivery domain, hashed password storage, access control and least-privilege administration, a web application firewall and DDoS protection at the CDN layer, regular software updates and periodic backups. No system is completely secure, so we cannot guarantee absolute security; if a breach occurs that is likely to result in a high risk to your rights, we will notify you and the competent authority as required by law.
11. Children
The Service is not directed at children. You must be at least 16 years old to create an account — or at least 14 where Spanish law applies to you and no purchase is involved. If we learn that we have collected data from a child below the applicable age without valid parental consent, we will delete it. If you believe this has happened, contact us at support@3duploader.com .
12. Third-party links and content
The Service contains links to third-party sites and may embed content such as videos. Those providers may set their own cookies and collect data about you. We do not control them, and this policy does not apply to their processing; please read their own privacy policies.
13. Additional information for UK visitors
If you are in the United Kingdom, this policy applies to you with the UK GDPR and the Data Protection Act 2018 in place of the EU GDPR, and references to the AEPD should be read as references to the Information Commissioner’s Office (ico.org.uk). Transfers of your data outside the UK are covered by the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.
14. Additional information for California residents
If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and how we use and disclose it, to request its deletion, to request correction, to opt out of the “sale” or “sharing” of personal information and of targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.
We do not sell personal information for money. However, our use of advertising and analytics cookies may qualify as “sharing” for cross-context behavioural advertising under California law. You can opt out by rejecting advertising cookies in our cookie banner, by using the cookie settings link in the footer, or by enabling a Global Privacy Control signal in your browser, which we honour as a valid opt-out request. To exercise any other right, write to support@3duploader.com ; an authorised agent may submit a request on your behalf with proof of authorisation.
15. Changes to this policy
We may update this Privacy Policy to reflect changes in the Service or in applicable law. The “Last updated” date at the top always shows the current version. If the changes are significant, we will tell you by email or with a prominent notice on the site before they take effect.
16. Contact
For any question about this policy or about how we handle your data, write to support@3duploader.com
