Privacy Policy

Effective: 27 April 2026  ·  Last updated: 28 April 2026

1. Who we are

Brethof AI ("we", "us", "our") operates brethofai.com, a digital store for 3D-printable models. This Privacy Policy explains what personal data we collect when you visit the site or buy a model, and what we do with it.

We are based in Poland. This Policy is written to comply with the EU General Data Protection Regulation (GDPR) and Polish data protection law.

2. What data we collect

2.1 When you create an account

• Your email address (used to log in and to send order receipts)
• Your display name (optional, shown only to you)
• A bcrypt hash of your password (we never store the password itself)
• Email-verification and password-reset codes (auto-deleted after use or expiry)

2.2 When you make a purchase

• Your billing details and card data are entered directly on Stripe — they never touch our servers. We receive only an order confirmation, the amount, and a Stripe customer ID.
• What you bought, when, and which licence (Personal or Commercial)
• Download history (timestamp + file format) so we can give you lifetime access

2.3 When you visit the site

• Standard server logs from our hosting provider (IP address, request path, timestamp, user agent). Used for security and debugging, kept for up to 30 days.
• Privacy-respecting analytics (self-hosted Umami) — no cookies, no cross-site tracking, no fingerprinting. We see aggregate page-view counts and referrers, never individual visitors.
• One technical cookie (the JWT in httponly form) only if you log in. It expires after 72 hours.

3. Why we use it (legal basis under GDPR)

• Contract — to process your order, deliver the files, and provide your account. (Art. 6(1)(b))
• Legal obligation — to keep tax-required invoice records for as long as Polish tax law requires (currently 5 years). (Art. 6(1)(c))
• Legitimate interest — for security logs and aggregate analytics, balanced against your privacy interest. (Art. 6(1)(f))

We do not rely on consent for marketing because we do not send marketing emails. If we ever do, it will be opt-in only.

4. Who we share it with

We share data only with the third parties needed to run the service:

• Stripe (Stripe Payments Europe Ltd, Ireland) — payment processor. Stripe Privacy Policy
• Cloudflare (Cloudflare Inc., USA) — CDN and DDoS protection for our static assets. Cloudflare Privacy Policy
• Hostinger (Hostinger International Ltd, Lithuania) — hosting of the API and database
• Hostinger SMTP — for sending transactional email (verification codes, receipts)

Each of these processors has appropriate Data Processing Agreements (DPAs) and provides GDPR-compliant transfers. Stripe and Cloudflare both rely on Standard Contractual Clauses for transfers outside the EEA.

We do not sell your data, share it with advertisers, or use it for behavioural profiling.

5. Where your data is stored

Account and order data is stored in a PostgreSQL database hosted in the EU (Hostinger's European data centres). Files you purchase are served from Cloudflare R2 with EU edge caching. Backups are encrypted at rest.

6. How long we keep it

• Account data — for as long as your account exists. Delete the account and we delete the personal data within 30 days.
• Orders / invoices — 5 years after the order, as required by Polish tax law. After that, anonymised and aggregated for statistics only.
• Server logs — 30 days, then deleted.
• Email-verification codes — until you use them or 24 hours, whichever comes first.

7. Your rights under GDPR

You have the right to:

• Access — ask for a copy of the data we hold about you
• Rectification — correct anything inaccurate
• Erasure ("right to be forgotten") — ask us to delete your data, subject to legal-retention requirements
• Portability — receive your data in a machine-readable format
• Restriction — ask us to pause processing while a dispute is resolved
• Objection — object to any processing based on legitimate interest
• Withdraw consent — for any processing that requires it

To exercise any of these rights, email [email protected]. We respond within 30 days.

You also have the right to lodge a complaint with the Polish data protection authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

8. Cookies

We use a single technical cookie:

• brethof_session — the JWT session token. Set on login. HttpOnly, Secure, SameSite=Lax. Expires after 72 hours.

We use localStorage to remember your shopping cart between visits. It stays on your device, never sent to us until you check out.

We do not use any third-party tracking cookies, advertising pixels, or fingerprinting. There is no "Accept all cookies" banner because there is nothing optional to accept.

9. Children

Our store is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this Policy

If we change this Policy, we update the "Last updated" date above. For material changes (new processors, new data categories), we email registered users at least 14 days before the change takes effect.

11. Contact

Privacy questions, data requests, or complaints: [email protected]. We answer within 5 business days for general queries and 30 days for formal GDPR requests.