Privacy Policy

1. Introduction

Graff Technologies LLC, operating as 3DPrintMe™ ("3DPrintMe," "we," "us," or "our"), is a limited liability company that operates an online marketplace connecting buyers and sellers of 3D prints and custom commissions. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website at 3dprintme.com (the "Platform").

By using the Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, username, and password when you register.
• Seller information: shop name, business type (individual or business), tax identification number (SSN/EIN, stored encrypted), bank account or payout details (processed by Stripe), government-issued ID (if required for identity verification).
• Shipping addresses: full name, street address, city, state, ZIP code, country, and phone number when you make a purchase or save an address.
• Payment information: credit/debit card details, bank account information. Payment data is processed and stored by Stripe, Inc. We do not store full card numbers on our servers.
• Communications: messages you send through our internal messaging system, dispute claim descriptions, and customer support inquiries.
• Listings and reviews: print titles, descriptions, images, STL files, and reviews you create.

2.2 Information Collected Automatically

• Usage data: pages visited, search queries, listings viewed, items added to cart, and purchase history.
• Device information: IP address, browser type and version, operating system, and device identifiers.
• Cookies and similar technologies: see Section 7 below.

2.3 Information from Third Parties

• Stripe: payment confirmation, payout status, and fraud signals.
• Shippo / shipping carriers: tracking events and delivery confirmations.
• Google reCAPTCHA: bot-detection signals for form submissions.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and provide Platform services.
• Process transactions, payments, and payouts.
• Calculate and collect applicable sales taxes and remit them to the appropriate tax authorities (via Stripe Tax).
• Generate and fulfill shipping labels; share your shipping address with carriers (USPS, UPS, FedEx, DHL) to deliver your order.
• Send transactional emails (order confirmations, shipping notifications, dispute updates).
• Display listing views and cart counts to improve buyer confidence.
• Detect and prevent fraud, abuse, and policy violations.
• Comply with legal obligations, including tax reporting (IRS Form 1099-K for sellers with annual gross sales exceeding applicable thresholds).
• Improve and personalize the Platform experience.
• Respond to your requests and provide customer support.

Lawful Basis for Processing (GDPR — EU/EEA/UK Users)

If you are located in the EU, EEA, or UK, we rely on the following lawful bases under GDPR Article 6:

• Contract (Art. 6(1)(b)): Processing necessary to perform the contract between you and Graff Technologies LLC, including account management, order processing, payment processing, shipping, and dispute resolution.
• Legal obligation (Art. 6(1)(c)): Processing required by law, including tax reporting, DMCA compliance, and anti-fraud obligations.
• Legitimate interests (Art. 6(1)(f)): Processing for fraud prevention, platform security, abuse detection, and improving platform features, where our interests do not override your rights. You may object to this processing under Art. 21 GDPR.
• Consent (Art. 6(1)(a)): Processing for non-essential analytics cookies, where we have obtained your consent. You may withdraw consent at any time.

4. Information Sharing

We do not sell your personal information. We share your information only as described below:

• With other users: your public profile (username, shop name, reviews) is visible to other users. Your shipping address is shared with the seller solely for the purpose of fulfilling your order.
• With service providers: Stripe (payments), Shippo (shipping labels and tracking), Google (Analytics 4, reCAPTCHA, Places API), SendGrid/SMTP (email), and cloud infrastructure providers. These parties are contractually obligated to protect your data.
• With shipping carriers: your name, address, and phone number are shared with shipping carriers (USPS, UPS, FedEx, DHL) to facilitate delivery of your order.
• For legal compliance: we may disclose information when required by law, court order, or governmental authority, or to protect our rights and safety.
• Business transfers: in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Tax Compliance

3DPrintMe uses Stripe Tax to automatically calculate, collect, and remit sales tax on applicable transactions. As a marketplace facilitator operating in states with Marketplace Facilitator laws (currently 47 states and the District of Columbia), 3DPrintMe is responsible for collecting and remitting sales tax on behalf of sellers for transactions facilitated on our Platform. Sellers are not responsible for collecting sales tax on orders processed through 3DPrintMe for states covered by Marketplace Facilitator laws.

Sellers with gross sales exceeding IRS reporting thresholds ($5,000 in 2024 and $2,500 in 2025, transitioning to $600 thereafter) will receive an IRS Form 1099-K. We may collect your taxpayer identification number (SSN/EIN) for this purpose.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. We retain transaction records for a minimum of 7 years to comply with tax and financial regulations. You may request deletion of your account data subject to our legal retention obligations.

7. Cookies

We use the following types of cookies:

• Essential cookies: required for authentication and session management (e.g., JWT token storage).
• Analytics cookies: help us understand how users interact with the Platform.
• reCAPTCHA cookies: Google reCAPTCHA v3 uses cookies to assess whether form submissions are made by a human or a bot.

You may disable cookies in your browser settings, but some features of the Platform may not function correctly.

8. Security

We implement industry-standard security measures including TLS/HTTPS encryption for data in transit, bcrypt hashing for passwords, tokenized payment processing via Stripe, and role-based access controls. However, no method of internet transmission is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information. To exercise any of these rights, contact us at privacy@3dprintme.com. We will respond to verified requests within 30 days (or as otherwise required by applicable law). We may need to verify your identity before processing your request.

• Access (Art. 15 GDPR / CCPA): Request a copy of the personal information we hold about you.
• Correction (Art. 16 GDPR): Request correction of inaccurate or incomplete information. You may also update most account information directly in your account settings.
• Deletion (Art. 17 GDPR / CCPA): Request deletion of your account and associated personal data. Note: we retain transaction records for a minimum of 7 years for tax and financial compliance; these records cannot be deleted on request but will not be used for marketing or profiling.
• Portability (Art. 20 GDPR): Receive your personal data in a structured, machine-readable format (JSON or CSV) for data you provided to us where processing is based on consent or contract.
• Restriction (Art. 18 GDPR): Request that we restrict processing of your personal information in certain circumstances (e.g., while a correction request is pending).
• Objection (Art. 21 GDPR): Object to processing of your personal data based on legitimate interests (including profiling). We will cease such processing unless we demonstrate compelling legitimate grounds.
• Opt-out of non-essential communications: Unsubscribe from marketing emails at any time via the unsubscribe link in any email. Transactional emails (order confirmations, shipping updates, dispute notices) cannot be opted out of while your account is active.
• Global Privacy Control (GPC): We honor the GPC browser signal as an opt-out of sale and sharing of personal information, consistent with applicable state privacy laws. We do not sell personal information.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know the categories of personal information collected, the right to opt out of the "sale" of personal information (we do not sell personal information), and the right to non-discrimination for exercising CCPA rights.

EU/EEA/UK residents: If you are located in the European Union, European Economic Area, or United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not adequately addressed your concern. For EU residents, this is typically the supervisory authority in your country of residence or the lead supervisory authority for cross-border processing.

10. Children's Privacy

The Platform is not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal information, we will delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Platform after changes constitute your acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at: