Your Privacy Matters
Privacy Policy
We're committed to protecting your data and being transparent about how we use it.
Last updated: October 16, 2026
On this page
1. Introduction
Custom3D ("we", "our", or "us") is a Shopify application developed by Netsfera Solutions S.L. This Privacy Policy explains how we collect, use, and protect your information when you use our 3D product customization application.
2. Information We Collect
2.1 Store Information
When you install Custom3D, we collect:
- Store name and domain
- Store owner email address
- Store timezone and currency
- Shopify plan information
2.2 Product Information
To provide our customization service, we access:
- Product titles, descriptions, and images
- Product variants and pricing
- 3D models you upload for customization
2.3 Order Information
For orders containing customized products, we store:
- Order number, line items and customer email received from Shopify
- Customer design files and preferences
- Customization data (text, colors, images uploaded)
2.4 Customer Data
Personal data: Shopify order data can include a customer email address. Uploaded artwork, images and custom text may also contain personal information. We store these with the associated design and order to support customization and fulfillment.
2.5 Support conversations
When a store opens a support ticket, we store its title, description, replies, language, timestamps and status, linked to the authenticated store. Authorized Netsfera staff can add private notes and manage assignments; these notes are not shown to stores. Staff access uses Microsoft organizational identity and a separate restricted support session. Do not include API keys, passwords or private design links in messages.
3. How We Use Your Information
We use the collected information to:
4. Data Storage and Security
Application records are stored in Supabase PostgreSQL.
Uploaded models, images, design previews and print files use Supabase Storage.
Shopify access tokens and optional merchant AI API keys are encrypted with AES-256-GCM at rest. AI keys are used on the server to authenticate requests to the selected provider and are not returned to the editor.
Use HTTPS to access the application and Shopify to authorize store access.
5. Data Retention
Store, product and order records support the application and customized-order fulfillment. Their retention is separate from abandoned-design expiry. Temporary AI results become eligible for automatic cleanup after 30 days; outages or cleanup backlogs can delay deletion. Copies saved with a purchased design follow the order-artifact retention and deletion process.
New unpurchased cart designs receive a reference date based on the recorded store setting when first saved. Existing designs keep their recorded date. That date does not currently restrict access or downloads and does not automatically delete records or stored files. Designs linked to purchased orders have no cart expiry. Browser drafts are stored separately on the customer’s device and have a 7-day recovery window after their last saved edit.
Uninstallation and data deletion are separate processes. Shopify sends a shop-data deletion request after uninstall. Contact us about the status of a deletion request; uninstalling alone does not confirm erasure of all records and files.
Support conversations remain available as a saved history; resolving or closing a ticket does not delete it. This version has no scheduled age-based deletion of tickets. Shop-data deletion removes the associated support records. Contact us to request access or deletion, subject to applicable retention obligations.
6. Data Sharing
We do not sell your data. Service data is processed using:
Through their required APIs for app functionality
Vercel (application hosting), Supabase (PostgreSQL database and file storage).
Resend delivers support alerts to Netsfera and, when Netsfera replies publicly, to the store owner email retrieved from Shopify. Alerts contain a ticket reference and a link that requires store or staff authentication. Conversation text, ticket titles, private notes and uploaded files are not included. Email delivery status and provider identifiers are stored to handle delivery, retries and failures.
AI image creation and refinement are optional. When the merchant enables them and the customer explicitly requests generation, the store’s instructions and customer request are sent to the merchant’s selected image provider using the merchant’s API account. A reference image is sent only when provided. The selected provider’s data-processing and retention policies apply separately. For questions about processing arrangements or data location, contact us.
7. Your Rights (GDPR)
You have the right to:
Request a copy of your data
Correct inaccurate data
Request deletion of your data
Receive your data in a portable format
Object to certain processing activities
To exercise these rights, contact us at contact@netsfera.es
8. Customer Data Requests
Customers can contact the store merchant to request access to or deletion of their data. Merchants can submit requests through Shopify and contact contact@netsfera.es about data held by Custom3D. Shopify webhook acknowledgement is not confirmation that the requested action is complete. Requests may require review of applicable legal-retention obligations.
Technical diagnostics and optional recordings
We use Sentry in the European Union to receive sanitized technical error reports. We exclude credentials, request bodies, private URL parameters, prompts, artwork and support conversations. With your permission, we may also collect a masked recording of clicks and navigation from a sample of sessions. Text and input values are masked, media and design content are blocked, and recording URLs are sanitized before transmission. Recording permission is stored in your browser; you can change it using the diagnostic recording control. Withdrawing permission stops recording and discards unsent segments, but does not delete diagnostic data already received. Contact us for a data request.
10. Changes to This Policy
Updates to this policy are published on this page. Check the date above for the current version.
11. Contact Us
For privacy-related questions or requests: