Privacy Policy
Last updated: 2026-09-12
Hang (— pending —, — pending —) is based in Belgium. This page explains what personal data we collect through this website, why, and what rights you have over it. Full company details are on our Legal Notice page. The person responsible for the data described below can be reached at hello@3display-prints.com.
What we collect
- Placing an order: your name, email, phone (if given), delivery address, and payment status (Mollie handles the actual payment — we never see or store your card details).
- Your design: the route file you upload (GPX) or link (e.g. Strava), your chosen colours/layout/text, and any photo or link you attach for the NFC tag. A GPX file is precise location data (it can reveal where a route starts/ends, often near home) -- we treat it accordingly, see "How long we keep it" below.
- An account: if you sign in, your email (from Supabase Auth) and anything you add to your profile (name, display name, shipping address, marketing preference).
- "Notify me" / custom-design requests: email (required), and phone/name/description if you provide them.
- Basic technical data: your IP address is logged server-side for rate-limiting and fraud prevention, and is recorded against the acknowledgements you tick at checkout (see Terms & Conditions of Sale).
We don't use advertising or tracking cookies. The only in-browser tracking is a cookieless, anonymous session id (stored in sessionStorage, not a cookie) used to see which steps of the design tool people use -- see Cookies.
Why we process it, and on what legal basis
- To fulfil your order (produce and ship it, handle payment, provide the legal guarantee) — performance of a contract with you.
- GPSR product-safety information & traceability — a legal obligation under the General Product Safety Regulation.
- VAT/invoicing records — a legal obligation under Belgian and EU tax law.
- To notify you at launch or respond to a custom request — your consent, given by submitting the form.
- Marketing emails/texts — only if you separately ticked that box; you can withdraw this consent at any time from your account or by emailing us.
- Rate-limiting and fraud prevention — our legitimate interest in keeping the site and checkout working correctly.
Who we share it with
We use a small number of processors to run this site. None of them may use your data for their own purposes.
| Processor | Role | Location |
|---|---|---|
| Supabase | Database, file storage, account authentication | EU (Frankfurt, Germany) |
| Vercel | Website hosting | USA (SCCs apply) |
| Resend | Sends us order/lead notification emails | USA (SCCs apply) |
| Mollie | Payment processing | EU (Netherlands) |
| Google (Sheets) | Internal order/signup spreadsheet | USA (SCCs apply) |
| OpenFreeMap | Map tiles shown in the design tool | EU |
| Amazon Web Services (S3) | Elevation data for route previews | EU/USA depending on request |
| Google (gstatic.com) | 3D-model viewer code libraries | USA (SCCs apply) |
Where a processor is outside the European Economic Area, transfers are covered by the EU Standard Contractual Clauses (SCCs). We do not sell your data.
How long we keep it
- Order records (price, VAT, product, status): kept for 7 years, as Belgian accounting law requires, then deleted or anonymised.
- GPX files (raw location data): deleted automatically 90 days after your order is delivered (or sooner, if you delete your account/ask us to).
- NFC photos/media: kept with the order record, since they're permanently reproduced on the physical product.
- Account/profile: until you delete your account.
- Abandoned checkouts (started, never paid): deleted after 30 days.
- "Notify me" / custom-design requests: until resolved or you ask us to delete them.
Your rights & how to exercise them
Under the GDPR you can ask to access, correct, export, or delete your data, restrict or object to our processing, and withdraw consent at any time.
- If you have an account: go to My account for self-service "download my data" and "delete my account".
- If you don't (a guest order, a signup, a custom request): email hello@3display-prints.com and we'll handle it directly.
You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels — gegevensbeschermingsautoriteit.be.
Cookies
This site sets one cookie: a session cookie from Supabase, used only to keep you signed in if you create an account. It's strictly necessary for that feature to work, so we don't show a cookie banner for it. We don't currently use any analytics, advertising, or tracking cookies. See Cookies for full detail; if this ever changes, we'll update this page and ask for your consent first.
Contact
Questions about this policy or your data? Email hello@3display-prints.com.