Privacy: website, forms and purchases
Controller: Francisco Javier Venceslá Simón; privacy contact: info@demto3d.com.
We process data to answer enquiries and provide support; manage orders, payments, delivery and link recovery; issue tax documentation; moderate feedback submitted for publication; and protect the service. Depending on the purpose, lawful bases are contract/pre-contractual steps, legal obligations, consent to publish feedback, and legitimate interests in responding to communications and preventing abuse. Purchases and enquiries do not subscribe you to advertising.
Data may include name/display name, email, messages, rating, language, billing/tax location, payment references/status, accepted document versions and security/delivery records. Required fields are identified when collected. Stripe collects payment details in Checkout; DEMto3D does not receive full card numbers or security codes. Order data stays private. Approved feedback displays the public name, text, rating, date and language; email remains private.
Sered supplies hosting and email. Stripe handles payment, tax calculation and fraud checks for the services used, and may have independent responsibilities under its notice. Cloudflare Turnstile processes technical signals for form security and bot detection improvements. No other additional providers have been identified. Disclosures may also be required by law. Stripe and Cloudflare may process data outside the EEA using applicable safeguards; we do not claim all processing remains in Spain. Stripe privacy/transfers, Turnstile privacy.
Retention. Enquiries are kept while being handled and while their history is necessary to resolve the issue. Necessary sales and acceptance documentation is retained for 6 years from the last related accounting entry. If OSS is used, its records are kept for 10 years from the end of the transaction year. Longer retention applies where an obligation or claim requires it. Unpaid or abandoned purchase attempts without an incident are deleted 30 days after closure or expiry.
Technical logs are kept for 90 days from the event and administrative audit records for 12 months from the action, separating records needed for legal obligations and incidents requiring justified retention. Our own encrypted recovery backups are made daily and rotated 30 days after creation. Erased data may remain in those backups until rotation; restorations must reapply erasures. Legal archives are kept separately for their applicable periods, and records needed for legal liabilities are blocked where required.
Feedback is kept for publication and necessary related requests. Hiding public feedback does not itself erase private records. Unnecessary data will not be kept indefinitely.
You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw publication consent. Contact info@demto3d.com; extra identity information is requested only when needed. Complaints may be submitted to the AEPD. Information duty guidance.
Cookies and storage
Our application does not include analytics or advertising. Video is served from demto3d.com. Moderation uses the necessary session cookie demto3d_admin; authentication expires after 20 minutes of inactivity or 8 hours overall. The prepared purchase flow uses a 2-hour technical session and sessionStorage to reuse an attempt on retry. The first-party inventory is in the worksheet.
Cloudflare Turnstile. Forms load this service to protect against automated abuse. Cloudflare processes technical signals for protection and detection improvements under its privacy notice. Pre-clearance is disabled: cf_clearance is not identified as a cookie issued by that feature in the current configuration. Pre-clearance documentation. This does not establish that all Cloudflare services are cookie-free.
Stripe Checkout. Payment takes place on a Stripe-hosted page; the current website does not load Stripe.js or an embedded checkout. Stripe is an external provider to DEMto3D; on its own page, its cookies may be first-party to that domain. Official fraud-prevention references:
| Name | Domain listed by Stripe | Purpose | Published duration |
|---|---|---|---|
__stripe_mid | .checkout.stripe.com, depending on integration | Fraud prevention | 1 year |
__stripe_sid | .checkout.stripe.com, depending on integration | Fraud prevention | 30 minutes |
m | .m.stripe.com | Fraud prevention | 2 years |
Source: Stripe cookie inventory. These names and durations are documented by the provider, not presented as cookies already observed on demto3d.com. Actual cookies depend on payment and authentication options; the final flow will be checked during integration. Stripe privacy and integration.
Control. You can manage or delete cookies in your browser; blocking technical mechanisms may affect the service requested. Consent exemptions apply only to strictly necessary uses. Non-essential uses require prior consent and the ability to reject or withdraw it. AEPD guidance.