Privacy policy

Data controller

GLEAM (SASU), 42 Grande Rue, 01430 Saint-Martin-du-Frêne, France, publisher of the Bobitech Cloud3D service. For any question about your data: contact@gleamflow.fr.

For the data of our sellers' customers (parcel recipients), the seller is the data controller and GLEAM acts as a processor: this data is used only to manufacture and deliver the seller's order.

Data collected and purposes

Seller account: name, email address, company, address and phone number, password (stored in encrypted form) or Google sign-in, to manage the account, orders and invoicing.

Orders: order contents, uploaded 3D files and delivery address, to manufacture, ship and invoice.

Sellers' customers: recipient's name, delivery address and phone number, received from the seller or their connected store, to prepare and ship the parcel. The end customer's email address is not collected.

Connected stores (Shopify): access token, product list, and orders containing a product linked to a Bobitech part, to forward them to the workshop and report the shipment with its tracking number.

AI 3D generation: the description or photo submitted, to create the requested model.

Contact form: name, email address, contact details and message, solely to handle your request.

Technical data: server logs, generated automatically, to secure and maintain the site. No sensitive data is requested.

Legal bases

Account, order, connected store and sellers' customer data rely on the performance of the contract between us and the seller. Invoicing relies on our legal obligations. Messages rely on your consent and on our legitimate interest in answering the requests we receive. Technical data relies on our legitimate interest in securing the service.

Recipients

Your information is never sold or transferred. Only the following are involved: OVH, for hosting, on a server located in France; Stripe, for payments (card numbers never pass through our servers); Resend, for sending emails; Google, if you choose to sign in with Google; Shopify, for connected stores; Tripo, for AI 3D model generation; the carrier responsible for delivering the parcel.

For orders delivered in North America, manufacturing and shipping take place in Canada: the delivery address is sent there.

Some of these providers may process data outside the European Union. These transfers rely on the safeguards provided by the GDPR (adequacy decision or standard contractual clauses).

Retention period

Seller account and 3D files: as long as the account is active, then deleted three years after the last activity.

Orders and invoices: ten years, the period required by accounting obligations.

Sellers' customer data: for the time needed for delivery and after-sales service, then deleted no later than three years after delivery.

Connected store: until it is disconnected or the app is uninstalled, which deletes the access token.

Contact form: for the time needed to handle the request, then deleted within a maximum of three years after the last contact.

Cookies

The site uses only technical cookies strictly necessary for it to work (login session, cart, payment security). No advertising trackers, no third-party audience measurement.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, which you can exercise at contact@gleamflow.fr. You can also file a complaint with the CNIL (French data protection authority).

Security

Appropriate technical and organizational measures protect your data against unauthorized access, loss or alteration: encrypted connections (https), restricted and password-protected access to administration, store access tokens kept server side.