Shopify App Privacy Policy

3D PRODUCT configurator_ / Shopify app

This policy explains how 3D Product Configurator (3DPC) handles information when merchants and their customers use our Shopify app.

Effective date: October 14, 2026
Privacy contact: info@3dproductconfigurator.app

1. Who we are and what this policy covers

3D Product Configurator is operated by Youssef Hassanien, based in Canada, under the 3DPC name. This policy covers our Shopify app, its storefront configurator, and support relating to that app. It does not replace a merchant’s store privacy policy or Shopify’s own privacy policy. The independently hosted WordPress plugin and general website activities are outside this app-specific policy.

For customer information supplied through a merchant’s store, we process information on the merchant’s behalf to provide the app. Merchants determine how they offer customization and use order information. We are responsible for information we use for our own account administration, support, security and legal obligations.

2. Information we process

• Shopify connection and account information: store domain and identifiers, installation permissions, authentication tokens and session information. Shopify may also supply the authorized staff member’s identifier, name, email address, role and locale. We use these to authenticate access and operate the app.
• Product and merchant content: product and variant identifiers, titles and related product data; uploaded 3MF models, generated 3D previews, part labels, filament brands and materials, colours, default selections, customization settings and processing times. Files and free-text fields may contain personal information if a merchant includes it.
• Customer configurations: selected parts, colours, materials, personalized text and associated preview settings, product references, configuration identifiers, timestamps and saved configuration snapshots. A configuration may be saved when a customer adds a customized item to their cart, even if checkout is not completed.
• Configured orders: order and line-item identifiers, order number, quantities, order date, configuration references, production deadlines and production status. We also process cancellation, refund and fulfillment status to keep production records current. Shopify order notifications may contain additional customer or transaction details; our production records are designed to retain the fields needed for configuration and production rather than customer names, email addresses, telephone numbers or delivery addresses.
• Subscription information: where paid plans are enabled, store and app identifiers, plan and subscription status, billing periods and cancellation information used to verify access. Shopify handles app billing; 3DPC does not collect payment-card numbers or bank credentials.
• Support and technical information: messages and files you send us, together with technical information processed by our hosting services, such as IP addresses, request times, browser or device information and error logs, to deliver and protect the service.

Please do not place passwords, payment details, government identifiers, medical information or other sensitive personal information in models, personalization fields or support attachments unless specifically necessary and agreed through an appropriate process.

3. How we use information

We use information to connect the app to a store; create and display configurable products; show 3D colour and text previews; preserve selections through cart and order processing; manage production tasks; generate compatible colour-configured 3MF exports; verify subscription access; troubleshoot problems; respond to support and privacy requests; prevent misuse; and comply with legal obligations.

We do not sell personal information, use customer configurations for targeted advertising, or use uploaded models or personalized text to train AI models. Customer information is not added to marketing mailing lists through use of the configurator.

Where a legal basis is required, we rely on providing the requested service or performing a contract, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent where applicable. Processing on behalf of a merchant follows that merchant’s lawful instructions.

4. Service providers and disclosures

Information is shared only as needed to operate the service, follow merchant instructions or meet legal requirements. Providers used for the hosted app include:

• Shopify: authentication, product and order integration, app distribution and billing where enabled. See Shopify’s privacy policy.
• Render: app hosting, database services and operational logs. See Render’s privacy policy.
• Cloudflare: model and preview-file storage through R2 and related delivery infrastructure. See Cloudflare’s privacy policy.
• Google-hosted software delivery: the 3D viewer loads a JavaScript library from ajax.googleapis.com. This sends ordinary network-request information, such as an IP address and browser information, to that provider. It does not by itself upload your model or personalized text to Google. See Google’s privacy policy.

Authorized support personnel and communication-service providers may process information you send us to resolve a request. We may disclose information where required by law, to protect rights and security, or as part of a business transfer subject to applicable privacy obligations. We do not make private source-model files publicly browsable; preview assets needed to display a configured product are delivered to store visitors.

5. International processing and security

We operate from Canada. Our hosted app and database are hosted on Render in the United States, and Shopify, Cloudflare and other providers may process information in other countries. Privacy laws in those countries may differ from those where you live. Where required, transfers must be covered by applicable contractual or other lawful safeguards. Contact us for information about the arrangements applicable to your data.

Our safeguards include HTTPS connections, authenticated administrative access, store-scoped data access and restricted credentials for storage services. Access is limited to people and service providers who need it for the purposes described above. No internet service or storage system can guarantee absolute security.

6. Retention, uninstalling and deletion

We retain product setups, models, previews, configurations and production records while needed to provide the merchant’s service, including production history and exports. A completed order or an abandoned cart does not automatically erase its saved configuration. Merchants can request removal of app-held data by contacting us.

Uninstalling the app triggers deletion of the shop’s app database records and stored model files when Shopify’s uninstall notification is successfully processed. We also process Shopify shop-redaction and customer-redaction requests. Contact us if you need confirmation of deletion or if an uninstall or deletion request has not completed.

Backup copies and infrastructure logs may remain until the relevant provider’s retention cycle expires. Support correspondence, billing records and records needed for legal obligations or disputes may be retained separately for as long as necessary for those purposes. Deleting data from 3DPC does not delete Shopify’s order records, copies held by a merchant, or exports already downloaded. Customer deletion requests involving personal information embedded in uploaded files should identify those files so they can also be reviewed.

7. Cookies and browser technologies

Authentication sessions and essential browser technologies support app access and storefront operation. The app is not designed to set advertising cookies or track customers across unrelated stores. Shopify, the merchant’s theme and other installed apps may use their own cookies and tracking technologies under their respective policies and consent settings. The 3D viewer also makes the third-party software request described above.

8. Your choices and privacy rights

Depending on applicable law, you may have rights to access, correct, obtain a copy of, delete, restrict or object to processing of your personal information, withdraw consent where processing depends on consent, and complain to a privacy regulator. We do not use app data to make automated decisions that produce legal or similarly significant effects on individuals.

If you are a customer of a store using 3DPC, contact that store first so it can verify your identity and coordinate a request. You may also contact us; we may need to work with the merchant to locate the relevant configuration and verify authority before disclosing or deleting information. Merchants can use Shopify’s privacy-request process and contact us for assistance. Include the store domain and relevant order or configuration reference, but do not send unnecessary sensitive information. We respond within the time required by applicable law.

9. Children

The app’s administrative service is intended for merchants and authorized staff, not children. We do not knowingly collect personal information directly from children under 13. If you believe a child’s personal information has been submitted, contact the merchant or us so that it can be reviewed and removed where appropriate.

10. Changes and contact

We may update this policy as the app or our practices change. The effective date above identifies the latest revision. Where required, we will provide additional notice of material changes.