Privacy Policy

What we collect

We collect only what we need to quote, make, ship and support your order.

• Contact and order details: email, name, shipping address and optional phone number.
• Design files you upload and the analysis we compute from them (geometry, manufacturability checks, quotes).
• Account data if you create one: email, display name, creator handle, and passkey public keys (never your fingerprint, face or device PIN).
• Make AI descriptions: your text is sent to our AI provider to produce an estimate; we store a fingerprint and length of it, not the text itself.
• Payment status from Stripe. We never receive or store full card numbers.
• Technical data: a device cookie that keeps your guest builds together, a session cookie when signed in, and IP addresses used briefly for rate limiting and fraud prevention.

Why we use it

To provide the service you asked for (quoting, production, shipping, support), to keep the service secure, to meet legal obligations (tax, accounting), and, with your consent where required, to send product updates. We do not sell personal data and do not use it for cross-site advertising.

Who we share it with

We share data only with the service providers and partners needed to run your order:

• Partner shops and suppliers making your order (design files, and your shipping details when they ship directly).
• Sourcing partners (Accio Work), which receive a redacted design package without your identity.
• Stripe (payments), EasyPost and carriers (shipping labels and tracking), Resend (email), Google (Make AI model), and our hosting, database and storage providers.

How long we keep it

Order, payment and Product Passport records are kept as long as required for tax, accounting and warranty purposes. Account data is kept while your account is open. Rate-limit records expire within hours. You can ask us to delete your account and the personal data we are not required to keep.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California law) you can ask to access, correct, delete or export your personal data, or object to certain uses. Email privacy@discovermake.com. We will verify the request and respond within the time the law requires. You can also complain to your local data protection authority.

Cookies

We use only strictly necessary cookies: the device cookie, the sign-in session cookie, the Kids mode cookie (while a grown-up has handed their device to a kid), the partner shop session cookie, and short-lived cookies that protect sign-in with Google or Apple. We do not use advertising or third-party analytics cookies.

Children

Children cannot create DiscoverMake accounts. Outside Kids & Family (below), DiscoverMake is not directed to children under 13, and we do not knowingly collect their data.

Kids & Family (draft: needs counsel review)

A parent or guardian with a DiscoverMake account (the “grown-up”) can add up to four kid profiles and hand their own signed-in device to a kid in Kids mode. The grown-up is the account holder: they set up each profile, give consent, choose the controls, approve and pay for every order, and receive every email. Kids never sign in, never have an email address and never pay.

For each kid profile we store only: a nickname chosen by the grown-up (one word of letters and numbers, at most 12 characters, so never a full name), an age band (6–9, 10–12 or 13–17, never a birthday), an avatar picked from our preset pictures (never a photo), the controls the grown-up sets (spending limit, allowed projects, Live viewing, kid-safe Discover), and the kid’s designs and requests (the project, its options such as colour and size, and up to 12 letters or numbers of words to print on it). We do not collect a kid’s email, phone number, photo, voice, address, school, birthday or location.

Why: to let the kid design a project, show the grown-up what was asked for, make and ship the approved order (the partner shop receives the 3D-print file, which includes the printed words, and ships to the grown-up’s address), and keep an activity log of approvals for the grown-up. Nothing a kid types is sent to an AI model or shown publicly; kid designs can never be published. Kids mode loads no third-party analytics or advertising, and kids cannot chat, ask questions in Live, upload files, or reach checkout or account settings.

Retention and deletion: kid profile data is kept while the profile exists. The grown-up can review everything about each kid on the Family page and delete a profile in one step, which deletes its designs, requests and activity entries and any designs that were never ordered. Orders the grown-up paid for are the grown-up’s purchase records and are kept for tax, accounting and warranty purposes as described above. A grown-up can also ask us to delete their whole account, including all kid profiles, at privacy@discovermake.com.

Parental rights (including under the U.S. Children’s Online Privacy Protection Act): the grown-up can review, change or delete their kids’ information at any time on the Family page or by emailing us, and can stop further use by deleting the profile. This section is a draft and will be reviewed by counsel before Kids & Family launches.

International transfers and security

Our providers may process data outside your country, under contractual safeguards. Access tokens and links are stored as one-way hashes, traffic is encrypted, and design files are reachable only through signed, expiring links.