Privacy Policy

Controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG):

Updruck - 3D Manufacturing & Design OG
Buchnerplatz 1, 4020 Linz, Austria
Email: office@updruck.com

We process personal data for the following purposes:

• Provision of the user account and studio features (registration, authentication, generation and storage of 3D models) — Art. 6(1)(b) GDPR (performance of a contract).
• Payment processing and credit management (pay-as-you-go credits, print orders) — Art. 6(1)(b) GDPR.
• Shipping and order fulfilment for physical prints — Art. 6(1)(b) GDPR.
• Operation, security and troubleshooting of the platform — Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service).
• Compliance with legal obligations (e.g. accounting retention) — Art. 6(1)(c) GDPR.

• Account data (e.g. name, email address, authentication data)
• Usage and transaction data (generations, credit balance, orders)
• Uploaded content (images/references) as well as generated models and metadata
• Payment and billing data (via the payment provider)
• Shipping address data for print orders
• Technical log data (IP address, browser/device information, timestamps) to the extent required for security and operations

To provide the service we use carefully selected service providers. These may include in particular:

• Clerk — authentication and account management
• Stripe — payment processing
• Neon — database hosting
• Amazon S3 — storage of images and 3D files
• AI / 3D generation providers (e.g. Hi3D, Tripo) — technical processing of uploaded references to generate models
• Sendcloud — shipping fulfilment for print orders
• Upstash QStash — asynchronous job / webhook processing
• Google Gemini (if enabled) — optional automatic naming of library items
• Sentry — error monitoring and performance diagnostics (user id only; no request body capture)
• Microsoft Graph (if enabled) — transactional email delivery

Transfers to third countries occur only where necessary for the respective processing and where appropriate safeguards exist (e.g. standard contractual clauses) or an adequacy decision applies.

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. Account-related data is generally retained for the duration of use of the service and thereafter for winding-up or statutory retention. Uploaded references and generated 3D files (including library items) are retained for up to 6 months and then automatically deleted from object storage — subject to technical backups and legal obligations. You may also delete library items earlier.

We use technically necessary cookies or comparable storage technologies for sign-in, session security and core platform functions. Where we use optional analytics or marketing technologies, this is done only on the basis of your consent (Art. 6(1)(a) GDPR), where legally required.

Under the GDPR you have in particular the right to:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on Art. 6(1)(f) (Art. 21)
• Withdraw consents given, with effect for the future

To exercise your rights, contact us at office@updruck.com.

You also have the right to lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at.

Without the data required for the contract and account we cannot provide the service. Purely voluntary information is marked separately.

There is no solely automated decision-making, including profiling within the meaning of Art. 22 GDPR, that produces legal effects concerning you or similarly significantly affects you.

We update this privacy policy when the law, services or processing change. The current version is always available at /privacy.