Privacy Policy
Effective Date: October 24, 2026 • Compliance with GDPR, CCPA, and Stripe PCI-DSS Standards
No Data Selling
We never sell, rent, or trade your photos, personal profiles, or 3D files to third parties or advertising brokers.
Zero Card Storage
Payment card numbers never touch our servers. Payments are tokenized and processed directly by Stripe PCI-DSS Level 1 infrastructure.
End-to-End Encryption
All communications are encrypted in transit with TLS 1.3 and stored in encrypted S3/R2 storage with strict access controls.
1.Overview & Who We Are
SnapToSTL ("we", "us", "our" operating at snaptostl.com) is committed to safeguarding the privacy and security of users who utilize our 2D-to-3D computer vision and 3D printing conversion studio. This Privacy Policy details what information we collect, how it is processed, and your rights concerning your personal data.
2.Uploaded Photos & 3D Model Processing
Client-Side Background Removal: Whenever possible, portrait and object background isolation is performed directly inside your web browser using WebAssembly. Your uncropped photos never leave your device until you confirm generation.
3D Mesh Reconstruction: When you click "Generate 3D Model", your isolated image is transmitted via TLS 1.3 encryption to our secure synthesis pipeline solely for the mathematical reconstruction of 3D geometry vertices and faces.
No AI Training on Private Creations: We do not use your private personal photographs or confidential product prototypes to train public foundation models without explicit consent.
Storage & Deletion Lifecycle: Intermediate 2D image caches on cloud processing nodes are purged automatically according to our automated lifecycle rules (typically within 24 to 72 hours). Completed 3D models (.STL) are archived in Cloudflare R2 under your account so you can re-download them for free at any time.
3. User Accounts & Google Firebase Data
When you create an account or authenticate via Google OAuth, we store minimal account records in Google Firebase (Firestore and Firebase Authentication):
- Your email address (for login verification, credit confirmations, and support).
- Hashed authentication credentials (passwords are one-way salted and hashed by Google Firebase; SnapToSTL never has access to plaintext passwords).
- Your current digital credit balance and historical generation metadata (mode, target dimensions, timestamp).
4. Cloudflare R2 Storage & File Security
Exported binary .STL and .OBJ meshes are hosted on Cloudflare R2, an S3-compatible encrypted object storage network:
- Private Storage Buckets: Buckets are private and not indexed by public search engines.
- Authenticated Downloads: Re-download endpoints (
/api/download/[id]) cryptographically verify account ownership before serving files. - Encrypted at Rest: All files stored in R2 are encrypted at rest with AES-256 standard encryption.
5. Stripe Payment Processing & Financial Data
SnapToSTL integrates Stripe Checkout to process payments for credit packs:
Zero Credit Card Storage: When purchasing credits, your credit card number, expiration date, and CVC security code are sent directly to Stripe's PCI-DSS Level 1 certified servers. SnapToSTL servers never receive, store, or log raw credit card details.
Transaction Logs: We receive only a sanitized transaction token, the amount paid, currency, the last 4 digits of your card, and payment status to fulfill your credit balance atomically.
6. Your Rights (GDPR & CCPA Compliance)
Depending on your location, you have statutory rights concerning your personal data:
- Right of Access: You can view all your stored 3D models and transaction history inside the "My Creations" dashboard.
- Right to Deletion ("Right to be Forgotten"): You may request complete erasure of your account, creation history, and associated STL storage files by contacting support.
- Right to Rectification: You can update your email address or password at any time.
- Right to Non-Discrimination: We do not discriminate against users for exercising their data protection rights.
7. Privacy Officer & Contact Information
To exercise your privacy rights, request account deletion, or inquire about data practices, please contact our Data Protection desk: