Who is responsible
Layerform is the data controller for the personal data described here. Contact hello@layerform.co.uk with any question about it.
What we collect, and why
- Your name and email address
- To create your account, confirm it is yours, and send you order updates. Lawful basis: performance of a contract.
- Your delivery address and phone number
- To calculate delivery and get the parcel to you. The phone number is optional and only passed to the carrier when they need it. Lawful basis: performance of a contract.
- The 3D files you upload
- To measure, price, review and manufacture your order. Lawful basis: performance of a contract.
- Your orders, quotes, payments and refunds
- To fulfil the order, and afterwards to meet our accounting and tax obligations and to resolve disputes. Lawful basis: performance of a contract, and legal obligation.
- Messages you send us through the contact form
- Your name, email address, the message itself and, if you give one, an order number — to read and answer it. We also keep a scrambled code derived from your connection, which cannot be turned back into your address, only to stop the form being flooded. Lawful basis: legitimate interests.
- Technical logs
- Ordinary server logs recording that a request happened, used to keep the service secure and working. Lawful basis: legitimate interests.
We do not use advertising or analytics cookies, and we do not build a profile of you. See cookies.
How long we keep things
Your uploaded 3D files are treated separately from everything else, because they are the most sensitive thing you give us.
- 3D files: deleted 14 days after your order closes — that is, once it is completed, cancelled, declined or refunded. We email you beforehand so you can ask us to keep it.
- Files kept longer: only where there is a dispute or chargeback, an open support case, a refund investigation, a legal hold, or an operational investigation. We record why, and delete once it is resolved.
- Order, quote, payment and refund records: kept for six years to meet accounting and tax obligations. These do not contain your 3D file.
- Your account: kept until you ask us to close it.
- Email records: a log of which order emails were sent to you and when, kept alongside the order record.
- Contact form messages: deleted automatically two years after you send them.
Who else sees your data
We use a small number of processors, and no more than we need:
- Supabase — database, authentication and private file storage.
- Stripe — card payments. Stripe receives your email address and the amount. We never receive or store your card details.
- Resend — sending order emails. Receives your email address and the message.
- Vercel — hosting.
- Our carriers — your delivery address and, where needed, your phone number.
We do not sell your data and we do not share it for anyone else’s marketing. Some of these providers process data outside the UK; where they do, the transfer is protected by the safeguards UK data protection law requires — UK adequacy regulations, or the International Data Transfer Addendum in the provider’s data processing terms.
Keeping it safe
- Your files are in private storage with no public address, and are never listed publicly.
- Access is enforced at the database level, per row, so one customer cannot reach another’s order or file even if the application had a bug.
- Download links are generated on request and expire after 60 seconds.
- Passwords are hashed by our authentication provider; we never see them.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, where we are not required to keep it;
- restrict or object to how we use it;
- provide it in a portable format.
Email hello@layerform.co.uk and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.