Privacy Notice
Last updated 12 October 2026
At a glance
- Your model stays on your device while the initial estimate is calculated.
- The actual model is uploaded only when you submit an order.
- Order models and production files are deleted within 30 days after fulfilment or cancellation.
- Coarse anonymous quote statistics are aggregated by day unless you object in Cookie settings; they contain no visitor reference, filename or exact price.
- With Analytics consent, limited quote information—including the filename, estimate, settings and checkout stage—is kept for up to 90 days. It does not include the model itself.
- Customer models are not sold, published or added to a permanent design library.
Who we are
LayerAndLoopStore is the trading name of Kian Low, a sole trader. Kian Low is the data controller responsible for the personal information described here.
- Privacy email
- [email protected]
What this notice covers
This notice applies when you use the site, select a model, generate a quote, submit, pay for or track an order, contact us, exercise a data right or make a data-protection complaint.
Your model file
When you select an STL or 3MF, the initial analysis and quote calculation take place in your browser. The actual model file, binary contents, geometry, preview and sliced data are not uploaded merely because you select it or obtain an estimate.
The model is uploaded only when you submit an order. We use it to review printability, verify the estimate, prepare or repair it where needed, slice and manufacture the ordered quantity, quality-check the result and deal with an immediate quality problem or authorised replacement.
We do not sell or publish customer models, reuse them for another customer, manufacture extra stock, use them in marketing or use them to train an AI system. Uploaded models and stored production files are deleted within 30 days after fulfilment or cancellation. The original filename is removed from the long-term order record at the same time. A later repeat order requires a new upload. A separately downloaded workshop or printer copy is covered by the same operational deletion deadline.
Saved quotes (“email me this quote”)
If you ask us to email you a quote, you are choosing to send it to yourself so you can come back to it. To do that we upload and store the model file(s) for that quote, together with your email address and the quote details (settings, quantities and price), and email you a private link to review and order it. We do this only with the consent you give on the quote form, as a step you have asked us to take before any contract.
We use your email address only to send you that quote and to reply about it or the resulting order. We do not add you to a marketing list or send marketing from it. The private link is the access key to the quote, so treat it like a personal link.
A saved quote and its uploaded file(s) are held for 7 days, after which the quote, the stored email address and the uploaded model file(s) are automatically deleted. If you place an order from the quote, that order is then handled and retained under the order sections of this notice, and the quote's own copy is still removed on the same 7-day schedule.
Quote journey analytics
We collect coarse first-party service statistics such as the number of quotes and stages reached, plus price, weight and print-time bands and totals by material, quality and colour. These are written directly into daily aggregates: we do not store a visitor reference, filename, exact price, contact detail or event-level record for this measurement. It is used only to understand and improve the quote service. You can object free of charge by turning off Anonymous service statistics under Cookie settings.
Separately, if you accept Analytics, we create a random reference for the current browser tab and record the timestamp, sanitised model filename, exact estimated quote value, weight/time and pricing breakdown, selected print settings, quantity, colour and furthest quote or checkout stage reached. These estimates help us improve pricing and ordering.
The filename is metadata only—it is not the model contents. The record does not include your name, email, delivery address, notes, uploaded model contents or an IP address as an analytics field. It remains in first-party analytics hosted with the service and is not sent to Google, Stripe or Royal Mail.
The reference is stored only in session storage, is not shared between tabs and is removed when Analytics is withdrawn. Detailed records are deleted after 90 days. Avoid personal or confidential wording in a filename.
If you estimate but do not order, the quote tool does not receive your actual model, name, email or delivery address. Depending on your choices it may add only the coarse daily statistics above or retain the limited detailed journey information, alongside a cookie-choice record and limited security data.
Information we collect
| Category | Examples | Why |
|---|---|---|
| Contact and delivery | Name, email, address, postcode, correspondence | Review, communicate about and deliver an order |
| Order | Reference, model, filename, settings, notes, quantities, price, status and timestamps | Quote, manufacture and support the order |
| Order messages | Messages exchanged with us about your order or custom request (on your tracking page and by email), with timestamps | Answer questions, agree custom details and prices, and support your order; kept with the order record |
| Payment metadata | Amount, status, date and Stripe transaction reference | Reconciliation, refunds and fraud prevention. Stripe receives full card details; we do not. |
| Security | IP address used transiently for rate limiting, request time and server logs | Protect the service and investigate faults or abuse |
| Consent | Category choices, timestamp and policy version | Remember and evidence your choices |
| Support and rights | Enquiries, complaint/request details and proportionate identity evidence | Respond and evidence the response |
Purposes and lawful bases
- Quotes and order requests: steps you ask us to take before a contract.
- Manufacture, communications and delivery: performance of the contract.
- Payments: contract and legitimate interests in administering payments and preventing fraud.
- Tax and accounting records: legal obligation.
- Security and necessary rate limiting: legitimate interests in operating and protecting the service.
- Anonymous daily quote statistics: legitimate interests in improving the service, using the PECR statistical-purposes exception and subject to your right to object.
- Detailed quote journeys, provider analytics, advertising and conversion matching: consent for the relevant category.
- Enquiries: pre-contractual steps or legitimate interests in replying.
- Rights requests and complaints: legal obligations and legitimate interests in managing and evidencing a response.
Advertising conversion matching
With Advertising consent, supported contact identifiers such as email and postcode may be normalised and transformed using SHA-256 for Google matching. A hash used for matching remains personal information. Providers may also receive order value, currency, timestamp, event ID and advertising interaction information. Plain contact values are not put in URLs or the matching field. Model filenames, model contents and customer notes are excluded. No matching request is made after rejection or withdrawal.
Who receives information
- OVHcloud (OVH): website, order, uploaded-model and technical data needed to host the service.
- SMTP2GO: recipient address and transactional email content.
- Stripe: payment details entered directly with Stripe; we receive payment status and transaction metadata.
- Royal Mail: name, delivery address and tracking-notification details where used.
- Google: optional Places search text, and consented Analytics/Ads event data.
- Workshop printer systems: production G-code needed to manufacture the order.
- Production contractors: for some custom, specialist or larger production orders we may use a vetted external manufacturing partner to produce or finish part of the work. Where we do, we share only what is needed to make and, where applicable, dispatch the order — typically the production file(s), the required material, colour and specification, and any delivery details — under a written contract requiring confidentiality, processing only on our instructions and deletion once the job is complete. Such a contractor acts as our processor.
A provider or contractor may act as a processor, joint controller or independent controller depending on the service. Some providers or contractors may process data outside the UK; where they do, we rely on appropriate safeguards, and verified transfer arrangements require periodic owner review. Contact us for more information.
How long we keep information
- Uploaded models and active production files: within 30 days after fulfilment or cancellation.
- Saved quotes you email yourself (quote details, email address and uploaded file): 7 days, then automatically deleted.
- Unreferenced temporary/failed uploads: 24 hours.
- Detailed quote journeys: 90 days; genuinely aggregate counters may be retained longer.
- Order, payment, tax and accounting records: up to six years; model filenames are removed with model files.
- Consent choices: reviewed/re-prompted at least every 12 months or when purposes materially change.
- General enquiries: normally 12 months after closure.
- Privacy requests and complaint records: normally 3 years after closure.
- Server/security logs and provider-side analytics/advertising data: actual rotation depends on configured provider accounts and is subject to owner verification.
Your rights
Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection, portability, consent withdrawal and rights concerning solely automated significant decisions. Rights are not absolute; we will explain any applicable exemption. You have a particular right to object to processing based on legitimate interests. Email [email protected]. Requests are normally answered within one month, subject to lawful extensions.
We do not use customer information to make solely automated decisions producing legal or similarly significant effects. With Advertising consent, Google may perform measurement, audience selection or profiling under its own notices.
Data-protection complaints
Email [email protected] with the subject “Data protection complaint”. We will acknowledge a complaint within 30 days, investigate appropriately, keep you informed if it continues and communicate the outcome without undue delay.
You may also complain to the Information Commissioner's Office. Contacting us first is not a condition of contacting the ICO.
Layer & Loop Manufacturing
The managed production service (Layer & Loop Manufacturing) is operated by the same controller, Kian Low. When you use it we process the information needed to quote, produce, support and dispatch a production order.
This can include your contact and company details and billing/delivery information; the model/production files you upload and their revision metadata; production estimates, formal quotes and quote history; sample records; Approved Production Specifications; production orders and batches; payment records (card details go directly to Stripe — we receive status and transaction metadata); your communications with us; and quality-assurance records where they contain information about you. Where you have separately agreed retention for repeat or recurring manufacture, we also retain the approved production file for the agreed period.
Purposes and lawful bases. Quoting and production requests are steps taken at your request before, and then to perform, the production contract. Keeping financial and tax records is a legal obligation. Operating, securing and improving the service relies on our legitimate interests. Retaining an approved production file for future repeat runs relies on your consent, which you can withdraw. Uploaded ordinary files are deleted within 30 days after fulfilment or cancellation; a file you have asked us to retain for repeat production is kept for the agreed period and then deleted on request, subject to records we must lawfully keep. Order, payment and accounting records are kept for up to six years.
Fulfilment on your behalf
Direct-to-recipient fulfilment is a controlled capability that is not enabled by default. Where it is deliberately enabled and you (a business customer) supply your own end-recipient details solely so we can pack and dispatch orders on your behalf, you are normally the controller of that recipient information and we act as your processor for that fulfilment processing. That data can include the recipient's name, postal address and any contact details you supply, an order reference and tracking information, including where imported by CSV. We use it only to fulfil and dispatch on your instructions, disclose it to the delivery carrier (e.g. Royal Mail) as needed, secure it, and retain or delete it in line with the fulfilment arrangement. When the capability is enabled we put in place written data- processing terms covering this role. For our own purposes — such as running and securing the service and meeting our legal obligations — we act as controller.
Security and changes
We use reasonable technical and organisational measures, restricted manager access, unguessable file references, validation and rate limiting. No online service can promise absolute security.
We update this notice when processing, providers, retention, tracking or relevant obligations materially change. Where appropriate, we will provide additional notice of a material change.
Questions? [email protected]
