Privacy Policy

Who is responsible for your data

NFT3D.ai is run by an individual maker, not a company. The operator is the data controller for the personal data described here and can be reached at workshop@nft3d.ai. We reply to privacy requests within 30 days, and usually within 2 business days.

Payment data

We do not capture payment on this site — there is no card form, and no card number, expiry, or security code ever reaches our servers. Payment is arranged with you by email after your order is confirmed, so any payment details live with whichever provider we settle through, not with us.

What we collect

1. Order details — name, email, phone, and shipping address you enter at checkout, plus your order number, configuration, any note you leave, when you confirmed you hold the rights to the artwork, and when you told us the piece arrived.
2. Quote requests — your email, name, the country the piece would ship to, an optional phone number, the configuration (for cast metal, the alloy and finish), and any note you leave. If you accept a quote, it becomes an order and the order details above apply.
3. Artwork you submit — images you upload, and artwork imported from an NFT you point us at. These are stored so we can generate a 3D model and produce the piece.
4. Wallet addresses and ENS names you look up — used only to fetch the publicly visible NFTs at that address. A lookup asks for no signature and is not linked to your identity.
5. Account details — if you create an optional account: your email (or, if you sign in with a wallet, that wallet's address) and authentication records; any wallet you add to the account, which you prove by signing a message — never a transaction; guest orders and quotes you attach to it; and the messages you exchange with the workshop from its Support tab. An account is not required to order.
6. Server logs — your IP address, browser user-agent, and the pages and API endpoints you request. These are used to run rate limits, investigate abuse, and debug errors. They rotate automatically and are not archived or used to profile you.
7. Browser storage — your cart, your recent order and quote numbers (with the email address and link that open them), and your site preferences are kept in your own browser's local storage, not on our servers. Signing in sets a session cookie. We use no advertising, retargeting, or cross-site tracking cookies.

We do not collect payment or card details, because the site takes no payments. If that changes, this page will be updated before it does.

Why we use it, and on what legal basis

• Producing, photographing, shipping, and supporting your order, pricing a quote you ask for, and generating a 3D model from the artwork you submit — performance of our contract with you, or steps you ask us to take before one. This includes the transactional email we send about the order or quote itself; we send no marketing email and run no mailing list.
• Looking up the NFTs at a wallet address you enter — your own request, and your consent, which you can withdraw by not using the lookup.
• Rate limiting, abuse prevention, security, and debugging — our legitimate interest in keeping the service available and its GPU costs survivable.
• Answering your questions and rights requests — performance of our contract with you, and our legal obligations.

We do not sell your personal information, and we do not use it for automated decision-making or profiling.

Service providers we use

Producing a print means your data passes through a small number of third parties. Here is every one of them and exactly what it receives:

• fal (United States) — receives the image you uploaded or imported and runs the image-to-3D engine you pick (Meshy, Tripo or Rodin) on it, on its own servers or those of the engine's maker. It receives the artwork, not your name or address.
• Replicate (United States) — a fallback for the same job, used only when fal is unavailable: it receives the image and runs the AI model that turns it into a 3D mesh. It receives the artwork, not your name or address.
• Alchemy (United States) — receives the wallet address or ENS name you enter, and returns the publicly visible NFTs held at it. When you sign in with a smart-contract wallet (a Safe or Coinbase Smart Wallet, say), it also receives the wallet address, the sign-in message and your signature, so the signature can be checked on chain. Nothing else about you is sent.
• Cloudflare R2 (global network) — stores and serves your uploaded images, the generated 3D models, and QC photographs of your piece. Files served from cdn.nft3d.ai are reachable by anyone who has the exact link, so treat that link as private. It also stores the production files we prepare for a manufacturing partner (below); those are never served publicly.
• Manufacturing partners — Craftcloud (All3DP, Germany) and the print shop it routes the job to, which may be in another country; JLC3DP (China); Slant 3D (United States); Shapeways (Netherlands); and Materialise OnSite (Belgium). Whichever partner prices or makes your piece receives the 3D model (for full-color pieces, with its color texture) and the engraving text only — which includes any words you chose for the front of an engraved base — with production instructions that carry our order and serial number. Your piece is shipped to our studio first, so partners never receive your name or address — nor your email or phone number. If we use a print shop not listed here, it receives the same and nothing more, and we add it to this list.
• OpenRouter (United States) — receives public NFT metadata (collection name, token ID, traits) to draft the collector's note shown alongside a piece. No personal data is sent to it.
• Our email provider (Resend or Cloudflare Email Service, United States) — receives your name, your email address, and the details of whichever message it is sending: the order or quote number, the amount due, paid, quoted or refunded, the lead time, and the carrier and tracking number once the piece ships — and, for support messages, the subject and text of the message it is telling you (or the workshop) about. It also carries short notices to our own inbox as an order or quote moves — a new order, a quote request, your approval of the photos, and the like — which can include your name, email address, the city and country the piece ships to (for a quote, the country only), and any note you left. It is used only for that order, quote, and support email, never for marketing.
• Our hosting provider — runs the server and database that hold order and quote records. Access is restricted to the operator.

We may also disclose data where the law requires it, or to establish or defend legal claims — for example a rights-holder dispute over printed artwork.

International transfers

The providers above process data outside the country you are in, including in the United States. Our manufacturing partners are in Germany, the Netherlands, Belgium, China, and the United States, and receive no contact details — only the model and engraving text described above. Where a transfer leaves the UK or EEA we rely on the transfer safeguards set out in each provider's published data processing terms.

How long we keep things

• Order records — while we produce and support the order, and afterwards for as long as we may need them to handle a dispute or a rights claim, or for as long as tax and accounting law requires us to keep a record of the sale. Where no such obligation applies, we delete on request.
• Quote requests — kept like order records; a quote that never became an order is deleted on request.
• Uploaded images and generated models — kept on our storage so you can reorder or re-download a piece. Deleted on request.
• Production files — the print files and instructions we prepare for a manufacturing partner are kept with the order record, so a piece can be remade exactly.
• Account records, including linked wallets and support messages — until you ask us to close the account.
• Server logs — short-lived and rotated automatically.

If you would rather not wait, ask us — deletion on request is the fastest route and the one we recommend.

Your rights

There is no self-service export or delete tool on this site, and most orders are placed as a guest with no account at all. The way to exercise any right is to email workshop@nft3d.ai — include your order or quote number if the request concerns one, so we can find the right record. You do not need an account, and we will not charge you.

If you are in the UK or the EEA, the GDPR gives you the right to access your data, correct it, have it erased, restrict or object to how we use it, receive a portable copy, and withdraw consent at any time. You may also complain to your local data protection authority.

If you are a California resident, the CCPA/CPRA gives you the right to know what we collect, to delete it, to correct it, and not to be discriminated against for asking. We do not sell or share personal information as those terms are defined, and we have not done so in the past 12 months.

Children

The service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has sent us personal data, email us and we will delete it.

Security

Data is encrypted in transit, access to the order database is limited to the operator, and QC photos and models are served from URLs that are not indexed. No method of transmission or storage is completely secure, and we don't claim otherwise.

Changes to this policy

We will update the date at the top of this page whenever this policy changes, and material changes will be described here. The update of 28 September 2026 added our manufacturing partners, fal (which runs the 3D engines you pick), quote requests, and the rights confirmation and delivery date we now record with an order. We do not email you about a change to this policy, so check that date if it matters to you. Email about an order is a separate thing and we do send it — see Shipping & returns for the messages an order can produce.

Contact

Privacy questions, requests, and complaints: workshop@nft3d.ai.