Privacy Policy

Controller legal name and address: [TO BE ADDED]. Privacy contact: [EMAIL ADDRESS TO BE ADDED]. These essential details have not been finalised. Until they are published, you may use the contact form for a privacy enquiry; avoid submitting unnecessary personal information or sensitive files. This draft does not replace the obligation to identify the actual controller.

Personal data should be processed transparently, for specified purposes, proportionately and only for as long as necessary, with appropriate security under the GDPR. For an enquiry made at your request, the envisaged basis is Article 6(1)(b) GDPR where necessary for pre-contractual steps; other correspondence and essential security may rely on Article 6(1)(f) following an actual legitimate-interest assessment. Legal obligations may require Article 6(1)(c). Optional processing requiring consent must use Article 6(1)(a).

The actual controller must confirm the applicable bases before launch. A form's privacy acknowledgement is not blanket consent for advertising or unrelated use. No marketing permission is inferred from an enquiry.

This website is published through Lovable. Hosting infrastructure processes technical request information needed to deliver pages and keep the service secure, potentially including IP addresses, request time, requested URL, browser information and error data. The application contains error-reporting code and server error logging.

The exact contracting hosting entities, subprocessors, regions, log contents and provider retention periods have not been verified here and must be recorded before launch. Logs must not intentionally expose uploaded confidential files or unnecessary personal data.

Contact messages currently store your name, email address, optional subject, message, selected language and submission time. They are kept in the project's Lovable Cloud database and made available to authorised administrators for handling your message. A receipt email is sent to the submitted email address through Lovable Emails. Providing incorrect or third-party contact details can misdirect that acknowledgement.

File enquiries collect name, email, country, postal code, city, shipping address, description, technical requirements, chosen material and colour, quantity, optional dimensions and notes, language and attachment metadata. These fields support the planned assessment and shipping enquiry, not an accepted paid job. Avoid sending address or project details that are not necessary for your preparatory enquiry.

The current upload flow accepts STL and 3MF models, PDF technical drawings and JPG/JPEG/PNG/WEBP references. File names, sizes, type and private storage paths are recorded. Uploaded content is checked server-side and stored for administrator assessment. Do not upload special-category personal data, identity documents or files you are not entitled to disclose. PDF-to-model assessment is manual; there is no automatic model-generation service in this flow.

Product requests currently record contact details, country, shipping address, postal code and city (to calculate exact shipping costs), selected product and variant, quantity, notes, language and submission time. They are non-binding enquiries; no checkout or payment information is collected. Later quotation, approval, model-preview, payment-agreement and production-status fields exist in the administration, but paid work must not be accepted during pre-launch.

No credit-card processing or online payment provider is integrated in the current enquiry workflow. Future contract, payment, invoicing or shipping processing requires updated information before activation.

Lovable Cloud currently provides the database, authentication and private upload storage using its integrated backend services. Enquiries and contact messages are stored there. Visitors do not have direct read access to submissions; administrator access is role-restricted. Uploads use temporary signed upload links and are validated before the enquiry is saved.

Administrator-generated signed model-preview/download links can permit access to anyone holding the link for its limited validity. Keep those links confidential. Provider legal entities, processing region, processor terms, backup arrangements and any international-transfer safeguards must be verified; this draft does not claim an exclusively EU location.

Lovable Emails is configured for customer receipt messages using the verified sender domain notify.printwarriors.cc. Name, recipient address, selected language and relevant enquiry details, such as product or file names, are used to generate the message. Delivery management, rate limits, suppression and unsubscribe handling are provided by Lovable; no newsletter or advertising use is authorised by the current forms.

Administrator-prepared quotations are also sent through Lovable Emails, including manually entered prices and private response links. The link holder can record acceptance, rejection or a message; after shipping, a notice with the carrier tracking link (or a personal-delivery note) is sent the same way; response times and messages are stored with the enquiry and visible to authorised administrators. Links expire after seven days and must not be shared. Existing server code still contains Resend administrator notifications; credentials were not configured at the time of this draft, so that path is not described as active delivery. If enabled later, the controller must disclose the actual provider, purposes, data and transfer arrangements before use. Neither an installed code path nor a prepared template proves a delivered message.

Only administrator accounts are intended. Public signup is disabled and the second account requires an owner-approved invitation. Authentication uses email/password and persistent session tokens for signed-in administrators; roles restrict access to requests and messages.

To limit form abuse, the server stores a SHA-256-derived IP value with a timestamp and checks recent submissions over an hour. A hashed IP may remain personal data; it is not described as anonymous. No automatic deletion schedule for these records is currently implemented.

The website stores the language choice (pw-lang) locally in your browser. Authentication session storage is used for signed-in administrators, with different session handling possible in the embedded editor preview. The site's source does not implement an advertising-cookie or marketing-pixel integration.

Manrope is loaded from Google Fonts through external stylesheet/font requests, which can disclose technical connection data to Google. The actual provider terms, legal basis and transfer implications must be reviewed; local font hosting is an option to evaluate before launch.

Lovable's project analytics is enabled in the publishing platform. No separate analytics SDK was found in the application source. The platform's actual collection mechanism, identifiers, cookie/storage use, retention and any consent requirements still need verification. This draft therefore does not claim that the live website is cookie-free or tracking-free. Non-essential tracking must not operate without any legally required consent.

Enquiries, messages and uploads remain stored until they are removed; no automatic retention or deletion workflow is currently implemented. The controller must define and enforce purpose-based periods for enquiries, files, accounts, abuse-prevention records and logs, and confirm deletion from provider backups. This draft does not promise immediate or automatic deletion.

Information no longer needed should be deleted unless a specific legal obligation or justified legal-claims requirement applies. Future statutory accounting retention relates only to records actually subject to it, not every uploaded file. Request deletion through the future privacy contact or current contact form; completion depends on identity checks and applicable exceptions.

Access is intended for authorised project administrators and the providers necessary to host, store and deliver the requested communication. Uploads are not intended for public publication. The controller must establish processor agreements under Article 28 GDPR where applicable and document any further recipients.

Where a provider or subprocessor processes data outside the EEA, transfers require an applicable GDPR mechanism, such as an adequacy decision or appropriate safeguards including standard contractual clauses, and additional measures where needed. Actual regions, certifications and safeguards are not confirmed by this draft.

Where the GDPR applies, you may request access, rectification, erasure, restriction and, subject to the relevant conditions, data portability. You may object to processing based on legitimate interests for reasons relating to your situation. Consent can be withdrawn for the future without affecting prior lawful processing. These rights are subject to statutory conditions and exceptions.

No automated decision-making with legal or similarly significant effects is implemented in the enquiry workflow; feasibility and quotations are reviewed manually. Privacy requests should be handled after proportionate identity verification, generally within one month, with legally permitted extensions explained where applicable.

You may complain to a competent supervisory authority if you consider personal-data processing unlawful. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde); official complaint information is available at https://dsb.gv.at/eingabe-an-die-dsb/beschwerde. A data-protection complaint is separate from an ordinary product or customer-service complaint.

This information must be updated when the operator, purposes, providers or website functions change. Final controller details, retention arrangements and a review of current pre-launch processing remain outstanding.