Privacy policy

Effective from 4 September 2026.

We process only the data needed to operate an account, prepare a quote, manufacture and deliver a print, and keep the service secure. 3D files are private: we do not publish or sell them, and we do not use them to train models or build our own catalogue.

1. Data controller

The controller is DCRA sp. z o.o., with its registered office at ul. Mełgiewska 74/7, 20-234 Lublin, Poland, entered in the entrepreneurs register of the Polish National Court Register under KRS 0000718408, tax number NIP 9462678787 and REGON 369479181, operating the LayersFactory service.

For privacy matters and to exercise your rights, contact [email protected] or write to our registered office marked “GDPR”. Pre-order enquiries, including messages and files sent for quotation, are delivered to [email protected].

2. Data we process

• Account and identity data: first and last name, email, user identifier, authentication data — we store a password only as a cryptographic hash — and, for SSO sign-in available solely to authorised internal DCRA users, the identifier and identity data supplied by the identity system.
• Order data: print options, quote, status history, agreed details, order number and information needed to handle complaints.
• Delivery and billing data: recipient, address, telephone, invoice details, and payment status and identifier. The payment provider, not LayersFactory, handles full card details.
• 3D files and technical data: the submitted model, file name and metadata, analysis results, previews, manufacturing parameters and working copies needed for printing.
• Technical and security data: IP address, session identifiers, device and browser type, event times, error logs and security events.
• Communications: messages, complaints, data requests and notices about possible infringement of rights to a file.
• Order feedback: a rating and optional comment linked to the account and order. We do not publish it without separate, freely given consent.
• Data sent through the public quote form: name, email address, enquiry and any voluntarily attached 3D models or reference files.

3. Purposes and legal bases

• Answering a form enquiry, creating and operating an account, preparing a quote, taking payment, printing, delivery and complaints — steps requested before entering into a contract and performance of a contract (Article 6(1)(b) GDPR). If a message is not intended to lead to a contract, answering and retaining the correspondence is based on our legitimate interest in communication and the defence of legal claims (Article 6(1)(f) GDPR).
• Issuing and retaining accounting records, meeting tax duties and responding to competent authorities — compliance with a legal obligation (Article 6(1)(c) GDPR).
• Security, fraud prevention, error diagnosis, improving the service through order feedback, establishing and defending legal claims, keeping a record of arrangements, and protecting rights to files — the legitimate interests of DCRA sp. z o.o. and service users (Article 6(1)(f) GDPR).
• Marketing communications or other optional activities — only under separate, freely given consent if such a feature is introduced (Article 6(1)(a) GDPR). Consent may be withdrawn at any time without affecting earlier processing.

4. Whether data is required

Data marked as required is needed to create an account or fulfil an order. We cannot create an account without an email or complete delivery and billing without the relevant details. Other data is optional. We do not ask for special-category data such as health, political or origin information; please do not include it in files, file names or messages.

The service is not directed to anyone under 18. Only a person aged 18 or over with full legal capacity may create an account or place an order in their own name. If we learn that we received a child's data contrary to these rules, we will verify the situation and erase the data unless there is a legal basis to keep it.

5. Sources of data

Most data comes directly from you. A public user may create an account and sign in with an email address and password. Authorised DCRA users may use DCRA's internal SSO through the Keycloak system operated by DCRA at keycloak.3dcra.cloud; we then receive the account identifier and identity data shown before sign-in. External sign-in methods such as Google or GitHub are not currently active. Before enabling them, we will update this Policy and identify the provider, the data received, recipients and any transfers outside the EEA. Technical data is generated when you use the service and when the file is analysed, while payment and delivery providers may send us payment or shipment status information.

6. Recipients

• Hosting, file storage, backup, email, monitoring and system maintenance providers, only as needed to provide the service.
• Stripe or another payment provider identified before payment, and banks involved in settlement.
• Carriers and pickup-point operators selected to deliver the order.
• Accountants, legal advisers and insurers where needed to meet an obligation or protect a claim.
• Courts, law enforcement, tax authorities and other authorised institutions where disclosure is required by law. Customer data is not disclosed to a model-rights complainant without an appropriate legal basis.

7. Transfers outside the EEA

Some infrastructure, payment or other providers may process data outside the European Economic Area. Where they do, we use a transfer basis provided by the GDPR, especially a European Commission adequacy decision or Standard Contractual Clauses with any required supplementary safeguards. The Keycloak and Plausible systems operated by DCRA do not by themselves transfer data to external SaaS operators of those services. Contact us about privacy to request details of the applicable mechanism and a copy of the safeguards.

8. Retention

• Account data is kept while the account is active and, after closure, only as needed to settle contracts, comply with legal duties and defend claims.
• Order, payment, complaint and accounting data is kept during performance and then for periods required by tax and accounting law and applicable limitation periods.
• An order rating and comment are kept with the relevant order data, no longer than the applicable limitation period, unless the user successfully objects earlier to continued use of the comment for service improvement.
• 3D files, previews and working copies uploaded in the workspace and not attached to an accepted order are kept until the deletion date shown next to the model and generally no longer than 7 days after upload. 3D models and reference files sent through the public quote form or to [email protected] are removed no later than 7 days after receipt of the message unless the enquiry leads to an accepted order. A file attached to an accepted order may be archived for production, delivery, complaints, a legal duty or legal claims.
• The text of an enquiry sent through the form or ordinary email, after separating attached 3D models and reference files, is kept for the time needed to answer and continue arrangements, then until the applicable limitation period expires, or for a shorter period where there is no need to retain the message.
• Database backups, which may contain account and order data and file metadata, are kept for no more than 30 days under the current rotation. Backups are used only to restore the system after a failure, not to reintroduce data erased during ordinary use; applicable deletion periods are applied again after a restore.
• The object store used for models does not retain previous versions of a deleted object. Once scheduled deletion has completed, we do not keep a separate object version there; temporary technical objects that reach 7 days of age are also removed in a weekly housekeeping cycle.
• Container logs from all cluster namespaces sent to the central system, including application, ingress, database and Cilium and Hubble component logs, together with Kubernetes events and audit logs, are kept for no more than 1 month. The full Hubble network-flow stream is not archived in that system. Rotating local log files on cluster nodes are not a separate archive and may be erased earlier through technical rotation. Information extracted to investigate a specific incident or defend against abuse or a claim may be kept longer, but only until the matter is closed and the applicable limitation period expires.
• Consent-based data is kept until consent is withdrawn or the relevant purpose ends.

9. Your rights

Send a request to [email protected] or our registered office. We may ask you to verify your identity to protect the data. Limits to individual rights follow from the GDPR, for example where data remains necessary for a legal duty or legal claims.

• Access and a copy, correction, and — where the legal conditions apply — erasure or restriction.
• Portability of data you supplied where automated processing is based on consent or a contract.
• Objection, on grounds relating to your situation, to processing based on legitimate interests. An objection to direct marketing is unconditional.
• Withdrawal of consent at any time where consent is the legal basis.

10. Complaint to a supervisory authority

If you believe your data is processed unlawfully, you may complain to the President of the Polish Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, or to the supervisory authority for your place of residence or work. You are also welcome to contact us first so that we can investigate.

11. Automated file analysis and pricing

The system automatically analyses technical model features and may calculate an indicative or final price. We do not use this analysis to evaluate you or profile your behaviour. The analysis does not itself produce legal or similarly significant effects within Article 22 GDPR: you decide whether to accept the offer, and you can request human review if a result appears incorrect or the model is unusual.

12. Privacy of 3D files

A file is used only for technical analysis, quotation, production preparation, fulfilment, complaints, security and legal duties. We do not operate a public file library. Without separate, freely given consent, we do not publish or sell the model, use it for advertising, our own production or catalogue, or train machine-learning systems with it.

Upload only data needed for the print and remove unnecessary personal data about other people from the model, file name and metadata.

13. Cookies and browser storage

The table below lists the mechanisms actually used by the service. They are first-party mechanisms necessary for sign-in and functions requested by the user, or they remember a choice made by the user. Mechanisms marked “internal DCRA SSO” are activated only during SSO sign-in by authorised internal DCRA users and are not set during ordinary use of the service or email-and-password sign-in. We do not use advertising or marketing cookies. Access to information stored on a device is governed by Article 399 of the Polish Electronic Communications Law.

The service does not store a refresh token or a second cookie in the browser to extend the LayersFactory session. The lf_access cookie expires after no more than 1 hour and is not renewed automatically; after it expires, the user must start sign-in again.

The table covers mechanisms under the LayersFactory and keycloak.3dcra.cloud domains. Keycloak is operated by DCRA and this Privacy Policy also applies in its domain. After voluntarily continuing to the external Stripe Checkout service, the payment provider may store its own cookies under its privacy notice; LayersFactory cannot access cookies stored exclusively under Stripe's domain.

We use Plausible Community Edition hosted by DCRA sp. z o.o. at plausible.3dcra.eu to measure how the service works. Data is not sent to Plausible Analytics as an external SaaS service; only providers maintaining our infrastructure may access it as described in section 6. We collect aggregate page views with the visited URL, interface actions, API error status codes and browser exception categories. A URL may contain a technical model or quote identifier and query parameters. These events do not contain an account identifier, e-mail address, file name, API response body, exception message or stack trace. Plausible does not set analytics cookies or use browser storage to track a user across websites. Processing is based on our legitimate interest in detecting errors and improving the service (Article 6(1)(f) GDPR); you may object as described in section 9.

You can delete or block cookies and localStorage data in your browser settings. Blocking essential mechanisms may prevent sign-in, preference storage or correct workspace operation. If we later add analytics, advertising or other optional mechanisms that require consent, we will activate them only after obtaining the required consent and will update this table.

14. Security and policy changes

We use technical and organisational measures appropriate to risk, including access controls, encrypted connections, backups, event logging and limiting file access to people who need it for their task. The 3dcra.cloud and 3dcra.eu domains belong to DCRA sp. z o.o. The Keycloak identity system at keycloak.3dcra.cloud and Plausible Community Edition analytics system at plausible.3dcra.eu are operated by DCRA; they are not external SaaS services or separate data recipients. No internet service can guarantee the complete absence of risk.

We may update this policy when features, providers or law change. A new version will show its update date. We will give in-app or email notice of changes that materially affect use of data where the law requires it.

15. Language versions

This Policy is available in Polish and English. If the versions differ, the Polish version prevails, subject to the data subject's mandatory rights.