Privacy Policy
Last updated: October 2026
Send3DSend (operated by Unicorp H d.o.o., the data controller) respects your privacy. This policy explains what data we collect and how we use it.
1. Data We Collect
When you request a quote or place an order we collect: your name, email, phone (optional), and uploaded 3D model file. For business orders we also collect company name, OIB or EU VAT ID, and billing and shipping address. When you pay, payment is processed by Stripe - we do not store your full card number. If you start a quote but do not finish it, the details you entered so far (including uploaded model files and any contact information) are kept for up to 90 days so we can follow up and help you complete your order. After 90 days of inactivity they are deleted automatically; you can request earlier deletion at any time. While you fill in the quote form, the details you type (name, phone, company name, OIB or EU VAT ID, and billing address) are saved as you go so we can restore your draft and offer help if you get stuck; your email address is saved only after you continue past the contact step. A field you clear is deleted from our records as well.
2. How We Use Your Data
Apart from the measurement and advertising services described in section 4, which we use only with your cookie consent, we share your data only with the processors needed to fulfil your order: Stripe (payment processing), BoxNow and DPD (shipping), Resend (order emails), e-Računi (invoicing), and our infrastructure providers Vercel (hosting and file storage) and Neon (database). Each acts under data-processing terms and only for the purpose of delivering your order. We never sell your data.
3. File Storage
Uploaded 3D model files are stored securely and deleted 30 days after order completion unless you request otherwise.
4. Cookies & Analytics
We use essential cookies (language and theme) which are always active and need no consent. With your consent we also use Analytics (Google Analytics 4, Microsoft Clarity, and Vercel Analytics) and Marketing (Google Ads and Meta Pixel). Nothing in these two categories loads until you accept it. The cookie banner offers 'Accept all' and 'Reject all' on its first screen, and 'Customize' lets you choose per category. You can change your choice any time via 'Manage cookies' on this page or in the footer. Each consent choice is recorded with a consent ID, timestamp, the policy version, a pseudonymised (hashed) IP address and your browser type so we can demonstrate your choice; these records are kept for about 24 months. Your choice is stored in a cookie called s3s_consent, which our server sets for 12 months from the day you choose. It holds your choice and a random ID, and that random ID is also our visitor ID. With Analytics consent we send the visitor ID to Google Analytics as a user ID, so visits from the same browser are recognised for up to 12 months. With Analytics consent, Google Analytics also learns whether you buy as a private customer or a business and, with a purchase, what you ordered (product or material and quantity, never your file names), the amount and whether you have ordered from us before; products you add to the cart or take to checkout are reported the same way. With Marketing consent, the Google Ads tag receives the events of your visit (such as the steps of a quote and your enquiries) and the same cart, checkout and purchase events (what you ordered, never your file names, the amount and whether you have ordered from us before) for conversion measurement and remarketing. With Marketing consent we also send the visitor ID to Meta (as an external ID), keep the ad click that brought you to us (the Google Ads or Meta click ID, the keyword, campaign and ad, the page you landed on, and your first ad click if it differs) for 90 days in a cookie called s3s_attr, and, when you complete the contact step of a quote or place an order, share your email address, phone number, name and street address with Google in hashed form (SHA-256), together with your city, postcode and country, so Google can measure which ads lead to enquiries and orders (enhanced conversions); Meta receives with an order your hashed email address, phone number, name, city, postcode and country, your IP address and browser type (user agent), and what you ordered. When you order, we also store the visitor ID and your cookie choice with the order, so the sale can be reported under the choice you made. If you pay by bank transfer, the file we upload to Google Ads for that sale contains the ad click ID that brought you to us, if there is one, and, with Marketing consent, your email address and phone number in hashed form (SHA-256), so Google can match the sale to an ad you interacted with even when no click ID is on record. How long we keep measurement data with your order: the ad click IDs are deleted from orders and saved quotes 90 days after the click (the keyword, campaign and landing page stay with the order for our ad reporting); the Meta browser IDs, your IP address and browser type 7 days after payment, or 60 days after the order if it is never paid; the Google Analytics ID and the visitor ID 14 months after the order. Your cookie choice stays with the order as proof of the choice you made. For enhanced conversions, our generator pages keep your contact details in your browser for up to 24 hours after you place an order. Who is responsible for this data: for Google Analytics 4 and enhanced conversions, Google Ireland Ltd. acts as our processor and uses the data only on our instructions; for Google Ads conversion tracking and remarketing, Google Ireland Ltd. acts as an independent controller. For the Meta Pixel and the order data our server sends to Meta (Conversions API), we and Meta Platforms Ireland Ltd. are joint controllers for collecting the event data on our site and sending it to Meta, and Meta is an independent controller for what it does with the data afterwards; Meta uses your hashed contact details only as our processor, to match them to Meta accounts, and then deletes them. Under this joint-controller arrangement we are responsible for the collection on our site and for your consent, and Meta is responsible for its own processing and for handling requests about it; you can exercise your rights with either of us. The arrangement is set out in Meta's Controller Addendum at https://www.facebook.com/legal/controller_addendum, and Meta describes its own processing at https://www.facebook.com/privacy/policy. Microsoft Clarity gives us behavioural metrics, heatmaps and session recordings to improve our site. Microsoft Corporation processes this data as an independent controller and keeps recordings for up to 30 days (recordings we save as favourites for up to 9 months); we mask personal data in the recordings. See the Microsoft Privacy Statement at https://privacy.microsoft.com/privacystatement. The legal basis is your consent (Article 6(1)(a) GDPR, and the Croatian Electronic Communications Act for storing and reading cookies). You can withdraw it at any time via 'Manage cookies': withdrawal stops any further sharing, deletes s3s_attr and the Google, Meta and Microsoft Clarity cookies set for our site in your browser, and does not affect processing that took place before it. Links in our marketing emails route through our own domain before opening the page you chose. Each link carries a technical code identifying the campaign, the link and the individual email it was sent in. We use that code only while handling the click: to send you to the right page, to count clicks per campaign (each email is counted once per link), and to recognise and reject automated clicks made by mail security scanners. We write down only the campaign, the link and the time. We do not record who clicked, we do not build profiles, and we do not track whether emails are opened. Diagnostic records of rejected automated clicks are deleted after 90 days. The short-lived technical state used for this filtering and counting is processed for us by Upstash and cannot identify you.
5. Promotional email
We send promotional email on two legal bases. If you have bought from us, we may send offers for our own similar products and services (Croatian Electronic Communications Act, art. 50); you can object when you give us your address and in every message we send, with one click. If you have not bought from us, we send promotional email only with your consent, which you can withdraw at any time. We write to business contacts on the basis of legitimate interest (GDPR Art. 6(1)(f)); article 50 does not apply to legal persons. Every marketing message includes an unsubscribe link that works immediately and free of charge, and you can also unsubscribe by writing to info@send3dsend.com. We always honour an objection to direct marketing, with no balancing test (GDPR Art. 21(3)). We keep the record of your consent (when, from where, and which wording you accepted) while you are on the list and for two years after you unsubscribe, so that we can demonstrate we acted lawfully. Transactional messages about your own order (payment, printing, shipping) are not marketing.
6. Your Rights
Under GDPR, you have the right to access, correct, or delete your personal data. You can request a copy of everything we hold about your address, or its deletion, at info@send3dsend.com. Invoicing records are kept for the period required by accounting law even after deletion; everything else is removed and your address is permanently excluded from our mailing lists.
7. Data processors and transfers outside the EU
We use Resend (email delivery), Neon (database), Vercel (hosting and Vercel Analytics), Stripe (payments), Upstash (technical counters for rate limiting and email click filtering) and Google Ireland Ltd. (Google Analytics 4 and enhanced conversions, only with your cookie consent) as processors. Not every recipient acts only as our processor: for Google Ads conversion tracking and remarketing Google is an independent controller, Meta is a joint controller with us, and Microsoft is an independent controller for Clarity; section 4 explains these roles. Your data is processed in the EU or under EU-approved safeguards. Google LLC, Meta Platforms Inc., Microsoft Corporation and Vercel Inc. in the United States are certified under the EU-U.S. Data Privacy Framework, which the European Commission found to provide adequate protection on 10 July 2023; transfers of your data to them rely on it. Files you upload are stored as described in section 3.