Last updated: 2026-08-27
Plain-English summary: We're a small workshop that prints and ships 3D-printed objects. We collect what we need to take your order, pack it, and mail it to you. We keep it safe, we never sell it, and we share it only with the services required to actually process the payment and ship the box.
To fulfill an order: your name, shipping address, email, phone (optional, for delivery texts), and the items you bought. To process the payment: your card is handled entirely by Stripe — we receive a token, not the card number itself.
If you create an account: also your password, hashed with argon2id. If you don't create an account, we still keep the shipping and order records tied to the email you used at checkout so we can pull it up if you contact us.
Automatically collected on the site: IP address, browser user agent, pages visited, timestamps. Used for security (rate limiting, fraud checks) and to see which pages people actually use. Retained for 90 days unless tied to a specific audit-log event.
To take your order, ship it, and follow up if something goes wrong. To send order confirmations, shipping tracking, and (only if you opt in) occasional new-product emails. To answer support questions. To handle returns and refunds. To run tax and accounting.
We do not: sell your data, use it to train AI models, hand your address to affiliate networks, or run third-party ad trackers on the checkout.
No advertising partners. No Facebook, Google Ads, or LinkedIn trackers.
Primary database and files: US-East region, encrypted at rest with AES-256. Backups: separate US region, also encrypted. Card data: never touches our servers — Stripe handles it directly through their own PCI-compliant infrastructure.
Order records (name, shipping address, items, total): 7 years, per US tax and consumer-protection law. Account: as long as your account exists; delete it any time via Settings → Account → Delete, and we purge everything except the tax-required order records within 30 days.
You can request a copy of all data tied to your email (Settings → Data export, or email us). You can delete your account. You can opt out of new-product emails at any time via the unsubscribe link in every email. EU/UK customers have GDPR rights (access, rectification, erasure, portability, restriction, objection); email privacy\.com to exercise them.
TLS 1.3 in transit; AES-256 at rest. Passwords hashed with argon2id. Optional 2FA via authenticator app. Full audit log on account changes. Regular vulnerability scans.
First-party session cookies to keep you signed in and to remember your cart. No third-party advertising cookies.
CastleRock3D is not intended for buyers under 13. If you believe a child has placed an order, email privacy\.com and we'll refund it and delete the record.
Privacy questions, data requests, GDPR requests: privacy\.com. Security disclosures: security\.com. General questions: support\.com.
This Privacy Policy is written in plain English by a small operator. Before scaling to significant volumes (especially in the EU/UK), have it reviewed by a privacy attorney.