Privacy Policy

Who holds your data

The data controller for LayerFlow3D is Indigo Dress Inc, a company registered in the United States, at 1151 Walker Rd Ste 100 PMB 728, Dover, DE 19904, United States. Development work is carried out in Ukraine. Where this policy says "we", it means Indigo Dress Inc.

1. Who This Covers

LayerFlow3D ("the Service") is used by three kinds of people, and this policy speaks to each:

• Workspace users - the people who register a company workspace and work in it.
• Buyers - people who order from a workshop's public shop page. The workshop that runs the page is the seller and decides what to do with your order; LayerFlow3D stores and processes it on the workshop's behalf. For anything about a particular order, the workshop is who to ask first; we help either of you with what is in Section 13.
• Visitors to layerflow3d.com, its calculators, guides and status page.

2. Information We Collect From Workspace Users

• Account Data: company name, country and currency, the administrator's name and email address, a contact phone if you give one, the plan you asked for, and a referral code if you arrived through a partner.
• Credentials: passwords are protected with the bcrypt one-way hashing algorithm; plain-text passwords are never stored. Email confirmation, invitation and password reset links are stored only as hashes, and expire.
• Signing In With Another Account: where the Service offers it, you may sign up or sign in with a Google or Microsoft account instead of a password. Your browser goes to that provider, you identify yourself there, and it returns a short-lived signed token naming you. We read two things out of that token - the email address and the provider's own identifier for your account - and we accept it only where the provider states it has verified the address. We never receive your password for that account, no access to it, and nothing else in it. The token itself is checked and discarded; nothing about which provider you used is recorded, and your email address is stored exactly as it would be after an ordinary sign-up. Signing in this way replaces our own confirmation email, because the provider has already proved the address.
• Passkeys: you may add a passkey to your account and sign in with it instead of typing the password. Your device creates a key pair and keeps the private half; we store only the public half, the identifier the device gave the key, the name you typed for it, when it was added and last used, and whether the device reported it as synced to a password manager. A passkey works only on this site, so it cannot be phished, and we never see your fingerprint, face or PIN: the device checks those itself. The password stays, and removing a passkey deletes its record at once. Platform operators may add one to their own account the same way.
• Production & Inventory Data: orders, spool weights, filament pricing, printers, print models and what they cost to make.
• Your Clients: the client records your workshop keeps - names, phones, emails and addresses of the people you make things for - and the buyers who order through your shop page (Section 3). You are responsible for having the right to record them.
• Orders Brought In From Elsewhere: when you import an order export or connect a shop platform, we keep the order, its lines and the buyer's name. A buyer's email address in such an import is read to match the order and is not stored.
• Printer Telemetry: status, temperatures, progress, the file being printed, the printer's serial number and firmware, and the most recent reading pushed by the telemetry agent running on your own network.
• Agent Check: when someone in your workspace presses Check printers, the agent answers with what it last read from each printer, how long each read took and its recent warnings, together with its own version, the operating system of the computer it runs on and that computer's local network addresses. Only the latest answer is kept, and the next check replaces it.
• Printer Connection Settings: if you choose to connect a machine, the local network address, access code or API key, and serial number you enter are stored so the agent can reach it. The access code and API key are stored encrypted, under a key kept apart from the database and its backups. They are used for nothing else, never shown outside your workspace, and clearing the fields removes them.
• Images You Upload: print model preview and product photos, printer photos, and your shop's logo. No SVG, no model files.
• Keys You Store: API keys for carriers, shop platforms and payment providers you connect are sealed with AES-256-GCM under a key that never enters the database, and are only ever used to call that provider for you.
• Support Messages: what you write to us, with your name and email address, the app version, your interface language, how many printers the workspace has and whether its agent is reporting in. If you tick the box, this tab's error log is attached. Nothing from your orders, clients or files is sent unless you paste it.
• Notification Settings: the Telegram chat you link, and for browser push the subscription your browser hands us, which includes its browser string.
• Activity Log: who did what in the workspace and when, with the acting user's email. Everyday entries are kept for 90 days; entries about security, billing and access for 365 days.
• How You Found Us: which of our calculators you saw first, if any, which partner referred you, and the kind of place you first came to our site from - search, Threads, Instagram, a partner's link, and so on, never the page itself. All three are kept on the workspace record for as long as it exists.

Model files. Uploading model files (.gcode, .3mf, .stl) to us is switched off across the Service, and no new ones can be stored here. Files uploaded before this change remain in your workspace and are covered by everything below.

Your own cloud storage. Instead, a workspace administrator may connect the workspace's own cloud storage account, and model files then live in that account rather than with us. When you do, we store which provider you connected, the address of the account, who connected it and when, and for each file you attach: the provider's own identifier for it, its name, and a link we build to open it. We never receive the file itself - you pick or upload it in the provider's own window, in your browser, and the contents travel between your browser and your provider without passing through us. We do not hold a password or a long-lived access token for that account, and we ask the provider for the narrowest access it offers, which limits us to the files you hand the application yourself.

3. Buyers on a Workshop's Shop Page

A workshop can open a public page at layerflow3d.com/s/<its address> and sell what it prints there. If you order from one, this is what happens to your data:

• What you enter: your name, phone, and if you give it your email; the delivery you chose - a street address, a carrier branch or a parcel locker, and a note for the courier; the items, colours and quantities; a comment to the workshop. The workshop sees all of it, because it has to make and send your order.
• Bot check: the order form is protected by Cloudflare Turnstile, which receives your IP address and a challenge token. We keep a salted hash of your IP address on the order to limit how many orders one connection can leave waiting; the address itself is not stored.
• Your order page: the link in your confirmation opens your order and its status. It is a private link: anybody holding it can see the order, so treat it as you would a receipt.
• Emails you receive: at most one for each stage of your order - received, in work, ready, shipped, cancelled, paid - sent on the workshop's behalf from our address, with the workshop's name on it. They carry the order and, once shipped, the tracking number. They do not carry your name, on purpose.
• "Tell me when it is back": if you leave an email for a sold-out colour, we keep it for up to 90 days or until the letter is sent, whichever comes first, and use it for nothing else.
• Asking for something that is not on the shelf: where the workshop offers it, you can describe what you would like made and, if you have one, attach your model file or give a link to it. What you send - your name, email, an optional phone, the description, and the file - goes to that workshop and to nobody else. The file is not published anywhere: it is stored the way every other file here is, and the workshop reaches it through a link that carries a signature and expires; our storage is not open to the internet. A request is kept until the workshop deletes it, and deleting it deletes your file with it; once the workshop has marked it answered or declined, it and your file are deleted automatically after 90 days. Where the workshop has set up pricing, a model whose slicer already worked out its printing time and weight is read on our servers the moment you attach it, and you are shown what that workshop would charge. Reading it tells us only those two figures and what they cost here; the file itself goes nowhere else, and the price is the workshop's, not ours. A price stands for 24 hours, and a price nobody took up is deleted, with the file under it, a week after it stops standing. If you go on to order at that price, it becomes an ordinary order of that workshop's - everything in the order section above applies to it, including that the file then stays with the workshop's records for as long as its workspace exists, because it is what was made for you. The same bot check and the same salted hash of your IP address apply as to an order, to limit how many requests one connection can leave in a day. There is no price and no payment in a request: it is a question, and anything that follows is arranged between you and the workshop.
• Visits: the workshop sees how many people opened its page and where they came from. We count a visitor once a day using a salted hash of the IP address and browser string; the hash is kept for 90 days, the address never.
• Who the seller is: the seller's name, address, tax number, terms of sale and right of withdrawal shown at the bottom of a shop page are written by that workshop and are its responsibility.
• Payment: where the workshop has enabled it, you pay on the page of a payment provider the workshop chose (Stripe, PayPal, LiqPay, Monobank, Revolut, Razorpay, WeChat Pay or Mercado Pago, where offered). Card details go to that provider and never to us; the provider receives your email address so it can send its receipt. The money goes to the workshop's own account. Otherwise the workshop arranges payment with you itself. A workshop may instead show you its own WeChat Pay code on your order page; you pay it in WeChat, and we only show the picture the workshop uploaded.
• Delivery: when the workshop creates a shipment, your name, phone and delivery address go to the carrier it chose (Nova Poshta, or EasyPost, Sendcloud or InPost where offered) to make the waybill, and the tracking status comes back.
• The workshop is told: a new order reaches the workshop as an in-app notification and, if it chose them, an email, a browser push or a Telegram message. Those carry your name, the items and the delivery city and branch - never your phone, email or street address.

Your order stays with the workshop's records for as long as its workspace exists, because it is the record of a sale. A shop platform's erasure request (Section 7) blanks who you are and leaves the sale.

4. How We Use Collected Data

Collected information is used strictly to:

• Provision and maintain your isolated company workspace
• Authenticate users and enforce role-based access control
• Calculate filament costs, print estimates, prices and subscription plan limits
• Deliver telemetry updates and status alerts, in the app, by email, by browser push and on Telegram where you asked for them
• Take, deliver and settle the orders your buyers place on your shop page
• Send transactional email: confirmation and one reminder to confirm, invitations, password resets, a warning before a trial ends, the letters that follow a payment that failed (when it fails, a few days before the workspace becomes read-only and on the day it does), a notice when a plan we granted has ended, a note on what we decided about a review you wrote, a notice when sign-in is paused after too many wrong passwords, and - to whoever runs a workspace, unless they switch it off - a Monday summary of the workspace's last week; and - to the owner of a workspace, unless they switch them off on their account page - a welcome, one reminder if the workspace has no printer and no order after a few days, and one note after a month without opening it
• Bill paid plans through Stripe
• Answer your support messages

We do not sell your data, we do not share it with advertisers, and we do not use your production data, files, or images to train machine-learning models. No data of yours is sent to any AI model provider.

5. Multi-Tenant Data Isolation

Data privacy and tenant isolation are enforced at the database level. Each record (order, spool, printer, model, client, buyer) is strictly bound to its owning company. Cross-tenant data access is prevented by API authorization on every request. Our own operators can see which workspaces exist, their plan and their members' email addresses, in order to run the Service and answer support; they do not browse your orders, clients or files.

6. How Uploaded Files Are Stored and Served

Files are held in S3-compatible object storage (Cloudflare R2) and encrypted at rest by the storage provider. The storage bucket is not publicly readable. Nothing links to it directly, and it cannot be reached from the internet.

Every file is served by this application, from this domain, behind a link that carries an expiry and a cryptographic signature. A link that is unsigned, altered, or expired returns nothing. Signed links are issued only to a request that has already passed authentication and tenant checks, and they are deliberately short-lived - 15 minutes for a model file, 24 hours for a preview image. Product photos and logos a workshop puts on its public shop page are, by its choice, public. All traffic between your browser, our API, and file storage is encrypted in transit over HTTPS/TLS.

Files in your own cloud are not stored or served by us at all. Where a workspace has connected its own storage, the application shows a file's name and a link that opens it in that provider, and who may open it is decided by that provider's own sharing settings, not by ours. Disconnecting the storage stops new files being filed there; it deletes nothing from your account, and deleting a print model here never deletes anything from your account either.

7. Retention, Deletion, and Erasure

• Unconfirmed sign-ups. If an address is never confirmed, the account and its workspace, with everything entered in it, are deleted automatically 7 days after registration. We send one reminder 2 days before.
• Deleted records. Orders, spools, printers, print models and clients you delete are soft-deleted into your company's Trash. A workspace on a paid plan can restore them from it; on the Free plan they wait there and cannot be brought back. After 60 days they are purged permanently, and any files they referenced are deleted from storage. A user removed from the workspace goes to the Trash as well and stays there until an administrator purges it.
• Workspace erasure. A company administrator can request deletion of the whole workspace, and can withdraw that request while it is still open. We review it; on approval the workspace is closed, and for 60 days after that it can still be restored on request. Once those 60 days pass, the workspace and everything in it - users, orders, clients, buyers, files - is erased completely, not hidden. An owner with more than one workspace can also delete one of them, other than their main one, themselves, confirming with their password or a passkey; the same 60 days apply.
• What survives an erasure. One record remains, deliberately: the date the erasure was requested, the date it was carried out, an irreversible hash of the requesting email address, and which of our operators approved it. It contains no personal data of yours and cannot be reversed into an address, but it lets us prove to you - or to a regulator - that we did what you asked and when.
• Backups. The database is backed up every night. Backups are encrypted with a key that is held only by us, off every server, and are kept for 30 days locally and off-site in the same storage provider as your files. Data you delete or erase therefore lingers in backups for up to 30 days and then ages out; backups are used only to put the Service back after a failure.
• Erasure requests from a shop platform. When a shop platform you connected (such as Shopify) sends a request to erase a buyer, we blank the buyer's name and delivery details on the orders it names and keep the order itself, which is your sale record. A platform's request for a buyer's data is logged for you to answer; it is yours to fulfil as the seller.
• Logs and counters. Everyday activity log entries are kept for 90 days and security-relevant ones for 365 days; storefront visit hashes for 90 days; our own site's visit counts for 400 days; restock requests for up to 90 days; a request to make something, and the file sent with it, for 90 days after the workshop marks it answered or declined; a price quoted on an uploaded model, and that file, for 7 days after the price stops standing. Server logs are kept for up to 30 days and hold no addresses of buyers. Notifications in the bell and the receipts of messages from connected services (a marketplace, a payment or billing provider) are removed after 90 days; the record of each print a machine ran, after 180 days; visits to a partner's link, after 365 days.

8. Cookies, Local Storage, and Analytics

LayerFlow3D uses browser LocalStorage to keep you signed in, to remember interface preferences (theme, language, currency, the section of a page you were last on), uncommitted form drafts such as an in-progress order, your answer to the advertising question below, and a referral, a calculator page or the kind of place you arrived from, for sixty days. The application's own error log lives in the tab's session storage and leaves it only if you attach it to a support message. We do not use third-party analytics products, and nothing inside your workspace is tracked. What does run is named here rather than buried:

• Advertising measurement. Our public pages carry the Meta pixel, which tells Meta that a browser arrived from one of our ads and, if it happens, that a workspace was created. It sets Meta's own cookies (_fbp, and _fbc after an ad click) and is subject to Meta's privacy policy. It does not load until you accept it - the question is asked once, on the public pages, and until it is answered nothing is loaded and nothing is sent. Declining is remembered the same way accepting is, and neither changes how the Service works. It never receives your name, your email, or anything from inside your workspace, and it does not run inside the signed-in application beyond the sign-up screens. Browser tracking protection or an ad blocker stops it as well.
• Fonts. Our public pages serve their typefaces themselves, so reading them tells Google nothing. The workspace application still loads its typefaces from Google Fonts, so Google sees that request the way any site's visitor is seen: an address, a browser, a page. No cookie is set and nothing about you is sent with it.
• Bot check. Shop pages and the sign-up form use Cloudflare Turnstile, which receives your IP address and browser details to tell a person from a script.
• Errors. When the application fails in your browser, the error is written to this tab's own log and nowhere else. It reaches us only when you choose to attach it to a support message, and is then stored with that message.
• Partner links. Visiting a partner referral link records the destination page, the referring site, and a daily salted hash of your IP address and browser string. The address itself is never stored - the hash only distinguishes fifty visits by one person from fifty people.
• Our own visit count. To know which of our pages and posts bring people who go on to use the product, our public pages and the sign-up screen tell our own server when a browser opens a page, presses a button that leads to sign-up, opens the demo, changes a figure in a calculator, sees the sign-up form or sends it - with the kind of place it came from (search, Threads, a partner's link, and so on) and the page's language. No cookie is set and no consent is asked, because nothing identifies you: the server counts a browser once a day by a salted hash of the day, your IP address and browser string, and keeps neither the address nor the browser string. The hash changes every day and cannot be joined to your workspace or to anything else. These counts are kept for 400 days.
• The free calculators. Nothing you type into one is sent anywhere - the sums run in your browser, and the numbers only ever leave it if you copy the link and send it yourself. The visit count above notes that a figure was changed, never what it was. If you go on to open a workspace, we record which of our calculators you saw first, so we know which of them is worth writing more of. That is a page of our own site, kept in your browser for sixty days and then on the workspace record. It is not shared, and it does not follow you anywhere else.
• Google, when you use your own cloud storage. The storage screens load Google's own sign-in and file-picker scripts, so Google sees the request the way any site's visitor is seen: an address, a browser, a page. It happens only on those screens, only where a provider is offered, and nothing from your workspace is sent with it.

9. Optional Telemetry Research

Each printer carries a research setting that is off unless you turn it on, per printer. When it is on, the agent reports the shape of what that machine publishes: field names, their data types, and the ranges numbers fall into, together with the printer model and firmware version. We use it to support more printers properly.

It never carries values that could identify you or your work. Serial numbers, device identifiers, job and file names, IP addresses, access codes, network names, RFID tags, and free-form text are excluded before anything leaves your network, and numbers are reported as ranges rather than readings. You can turn it off at any time.

Separately, the power draw you type for a printer is kept, with the printer's make and model and nothing else about you or your workspace, as one figure among the owners of the same model: the form offers the typical figure to the next owner of that machine. Clearing the field removes yours.

Separately, and regardless of this setting, once a day we ask Bambu Lab's public error-text service for the wording of the fault codes your printers can raise. That request carries the first three characters of each printer's serial number - the part that names the model family - and nothing else.

10. Service Providers

We rely on the following processors to run the Service. Each processes data only to deliver its function, never for its own purposes, except where noted:

• Hetzner Online GmbH (Falkenstein, Germany) - the servers the Service runs on, and the database.
• Cloudflare - object storage (R2) for files and encrypted backups, the Turnstile bot check, DNS, and routing of mail sent to our addresses.
• Resend (EU region, on Amazon SES infrastructure) - sends every email the Service sends, including the ones sent on a workshop's behalf to its buyers.
• Stripe - billing of paid plans. Card details are entered on Stripe's own page and never reach us. Stripe receives the workspace's administrator email.
• Meta - advertising measurement from our public pages only, as described in Section 8, and the one processor that also uses what it receives for its own purposes.
• Google - fonts on every page, the sign-in and file picker on the own-cloud-storage screens, and, where offered, signing in to the application with a Google account.
• Microsoft - where offered, signing in to the application with a Microsoft account. It receives only that somebody is signing in to this Service; we receive the address and the account identifier out of the token it signs.
• Browser push services (Google, Apple, Mozilla, as your browser dictates) - carry push notifications you switched on. The content is encrypted to your browser; the service sees only that a message was sent.

The following are engaged by your workshop, with its own account and its own keys, when it connects them. Their terms and privacy policies apply to what they receive, and we act on the workshop's instructions: Nova Poshta, and where offered EasyPost, Sendcloud and InPost (waybills, branch and locker lookups: the buyer's name, phone and delivery address); Kazpost (a parcel's tracking number, to read where it is: its answer names the recipient, and that is not kept); Prom.ua (orders pulled into the queue: the buyer's name, phone, delivery method and address, how the order is paid and the buyer's note to the shop, kept on the order; the email is read and not kept); Shopify and Squarespace (orders pulled into the queue: the buyer's name and, read but not kept, email); Telegram (order alerts to the workshop's own chat); Stripe, PayPal, LiqPay, Monobank, Revolut, Razorpay, WeChat Pay (Tencent) and Mercado Pago (a buyer's payment to the workshop's own account, where the workshop has enabled one). The filament catalogue is refreshed from the public SpoolmanDB and carries no personal data.

A cloud storage account you connect yourself is not one of our processors. The relationship is between you and that provider, under their terms and their privacy policy, and we are not a party to it - we hold no credential for it and cannot reach anything in it beyond the files you hand the application. Google Drive is the provider supported today.

11. Testimonials

A workshop may write one testimonial about the Service. We publish it - on our pages, in our materials - only with the separate consent you give on the form, and only with the name you chose to sign it with and your city and country. You can withdraw that consent from the same place at any time, and the quote comes down. The reward for writing one is described in the Terms of Use; it is not withdrawn when the quote is.

12. Referral Codes

A workshop holding a referral code is shown, for each workspace that signed up through its link, the date it signed up, how far it has got - registered, finished its first order, subscribed - and what that earned them. It is not shown that workspace's name, who runs it, their email address, or what they pay us. A code holder is not an operator of the Service, and holding one does not make the shops they introduced visible to them.

If you signed up through somebody's referral link, we record which code brought you and when, on your workspace, for as long as the workspace exists - it is what a reward was paid for, and removing it would leave a payment with no reason on it.

13. Your Rights (GDPR & CCPA)

Under applicable data protection laws (including GDPR and CCPA), you have the right to access, rectify, export, or request permanent deletion of your personal data. Workspace administrators can export their client list from the app and start a workspace erasure from Company Info settings; for a copy of everything else we hold about you, or to correct it, write to us and we fulfil it by hand within 30 days. A buyer's request about an order should go to the workshop that sold it; where you cannot reach it, write to us and we will help.

14. Policy Updates

We may update this Privacy Policy to reflect technical or operational changes. The "Last Updated" date at the top of this policy indicates when the latest revisions were published.

15. Privacy Contact

For inquiries regarding data protection or to exercise your privacy rights, please contact the Privacy Officer at Indigo Dress Inc, 1151 Walker Rd Ste 100 PMB 728, Dover, DE 19904, United States: privacy@layerflow3d.com, or +1 (302) 450-8715.