Privacy

Swiss3Design, Thomas Prud’homme, Chemin de l’Aubépine 9B, 1196 Gland (Vaud), Switzerland — contact@swiss3design.ch. This policy describes how personal data is processed in accordance with the Swiss Federal Act on Data Protection (FADP).

Customer account: name, e-mail address, password (hashed, never in plain text), Google sign-in identifier, or passkey — in the latter case, only the public key and technical device metadata are stored on our servers; your fingerprint or facial recognition data never leaves your device. Orders: delivery address, items, history. Payment: processed exclusively by Stripe; we neither see nor store any card data. Custom quotes: project description and 3D files submitted. Reviews: if you leave a review on a purchased product, your display name, rating and comment are published on the product page after moderation. Correspondence: e-mails and exchanges. Technical data: when you browse the site, your IP address, browser type and connection logs are processed automatically for security, abuse-prevention and proper operation of the site.

Fulfilling orders and quotes, managing the customer account, sending transactional e-mails (confirmation, shipping, quotes, account security), complying with legal obligations (accounting retention) and preventing abuse. No data is sold or used for advertising purposes. With the sole exception of a cart reminder you have explicitly requested (see below), we do not send any advertising e-mails; all other e-mails are strictly transactional (orders, account). We also anonymously measure traffic to and use of the site in order to improve it (see “Audience measurement”).

Only if you explicitly request it by ticking the dedicated box in the cart do we keep your e-mail address and cart contents to send you a single reminder if you have not completed your order. The legal basis is your consent, which you can withdraw at any time via the unsubscribe link in that e-mail. This data is deleted once the order is placed, upon unsubscribing, and at the latest after 30 days.

If you enable the newsletter or new-product alerts from your account area (My account → Notifications), we use your e-mail address to send you these communications. The legal basis is your consent, given by turning on the relevant toggle — you can withdraw it at any time from your account, or via the one-click unsubscribe link included in every e-mail. Resend (listed as a processor below) is used to send these e-mails.

An agent’s access to your account: if you allow an application or an artificial intelligence agent (“AI agent”) to access your account (consent screen or entry of a six-digit code), we record the application, the permissions granted and the access tokens, stored encrypted or hashed. The agent only reads the data covered by these permissions (profile, orders, quotes); you can withdraw its access at any time under My account → AI agents. Expired, revoked or never used access is deleted automatically.

Purchases through an AI agent: when you order through an AI agent (for example a chat assistant connected to Stripe), we receive from Stripe or from the agent’s platform the data needed for the order — name, e-mail address, shipping address, items, amount and, where applicable, the agent’s name; payment data stays with Stripe. We process it to fulfil the order, like an order placed on the website. Our catalogue (products, prices, stock), without any personal data, is sent to Stripe, which makes it available to partner AI agents. The agent’s platform (for example OpenAI, Microsoft, Google or Perplexity) processes your conversations and data under its own responsibility and according to its own privacy policy; these platforms may process data in the United States.

To understand how the site is used and improve it (pages viewed, where visits come from, products viewed or added to the cart, checkout steps and purchase amounts, technical errors, loading speed), we use PostHog, whose data is hosted in the European Union (Frankfurt). A “ph_…” cookie holding a random identifier (kept for up to one year) recognises a returning browser. Your IP address is not stored; country, canton and city are derived by Cloudflare at the time of the visit. No name, e-mail address, postal address or payment data is sent, and page addresses are stripped of personal parameters. Statistics are kept under PostHog’s terms (one year on our current plan). This measurement is based on our legitimate interest in improving the site. In line with Art. 45c of the Telecommunications Act, the banner shown on your first visit informs you about it, and you can decline it at any time, which also stops visit recordings:

PostHog also records how visits unfold (pages, clicks, scrolling, mouse movements) to help us spot what gets in the way on the site. Input fields and displayed personal data are hidden, your account pages and order tracking are never recorded, and recordings are deleted after 30 days. Declining audience measurement (banner or button above) also stops recordings.

We do not carry out any profiling or automated individual decisions producing legal effects concerning you or significantly affecting you.

We use technical service providers: Cloudflare (hosting, content delivery network and file storage), Neon (PostgreSQL database, hosted in the European Union), Stripe (payment — including, where applicable, Stripe Link, which lets you reuse a card already saved with another merchant using Stripe; we ourselves never store any card data), Resend (e-mail delivery), Google (Google sign-in, if used), PostHog (audience measurement, data hosted in the European Union). Some of these providers process data abroad, in particular in the European Union and the United States; these transfers are based on recognised safeguards (the European Union provides an adequate level of protection recognised by Switzerland; the Swiss-U.S. Data Privacy Framework for certified US providers, or standard contractual clauses). For sales through AI agents, Stripe passes our catalogue on to partner agent platforms, which act as independent controllers (see “AI agents”).

The site uses a session cookie to keep you signed in to your account and the browser’s local storage for the cart, favourites, resuming a payment and your choices about audience measurement. Audience measurement also sets a “ph_…” cookie and uses local storage (random identifier, up to one year), which you can decline (see “Audience measurement”). No advertising cookies and no cross-site tracking.

Account: until deleted by the customer. Orders: 10 years (accounting retention obligation, Art. 958f of the Swiss Code of Obligations). Quote requests and 3D files: deleted no later than 2 years after the end of the project or rejection of the quote.

In accordance with Art. 25 et seq. FADP, you may request access to your data, as well as its rectification, erasure or delivery in a common format. An instant export of your data (profile, orders, quotes, addresses) is available from My account → Privacy; for any other request, write to contact@swiss3design.ch. You may also contact the Federal Data Protection and Information Commissioner (FDPIC). We generally respond within 30 days and may request proof of identity before acting, in order to protect your data.

Connections are encrypted (TLS), passwords are hashed and access to the data is restricted to the Operator. Quote files are stored in a private area that is not publicly accessible.

The shop is intended for adults. Minors may only order with the consent of their legal representative. We do not knowingly collect data concerning children.

This policy may be amended; the version published on this page, together with its update date, prevails.