Key Takeaways

Built for Quebec Law 25 & PIPEDA
Your Data Is Never Sold
72-Hour Breach Notification
Right to Request Deletion

Last Updated: October 3, 2026

Effective Date: October 4, 2026
Company: 3DCentral Solutions Inc.
Location: 1325 Rue Bergar, Laval, QC H7L 4Z7, Canada
Website: 3dcentral.ca

3DCentral Solutions Inc. (“3DCentral,” “we,” “us,” or “our”) is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, communicate, store, and protect your data when you visit our website, create an account, make a purchase, or request a custom design.

This policy is written to comply with Quebec’s Act respecting the protection of personal information in the private sector (as amended by Bill 64 / Law 25), the Personal Information Protection and Electronic Documents Act (PIPEDA), and Canada’s Anti-Spam Legislation (CASL).

Information We Collect

Information You Provide Directly

When you create an account, place an order, request a custom design, or contact us, we may collect:

Identity information: Full name, username, and password.
Contact information: Email address, phone number, and mailing address.
Shipping information: Delivery address and any special instructions.
Order information: Products purchased, order history, subscription status, and Commercial License details.
Custom design information: The photos you upload, your description, notes and choices, whether a photo shows someone under 18, the consents and confirmations you give us, and the concept images and 3D models we create for you. See “Custom Designs, Photos and AI Processing” below.
Communication records: Messages you send us via email or contact forms.
Newsletter preferences: Email address if you voluntarily subscribe to our newsletter.

Information Collected Automatically

When you browse our website, we automatically collect certain technical data:

Device and browser information: Browser type, operating system, screen resolution, and language preference.
Usage data: Pages visited, time spent on pages, referring URLs, and click patterns.
IP address: Used for security, fraud prevention, and approximate geographic location.

Information We Do NOT Collect

Credit card numbers: All payment processing is handled securely by Stripe. We never see, store, or have access to your full credit card details.
External tracking fonts: We use a system font stack. No Google Fonts, Adobe Fonts, or other external font CDNs are loaded, eliminating a common source of cross-site tracking.

How We Use Your Information

We use your personal information for the following purposes:

Order fulfillment: Processing your orders, calculating shipping, and delivering your 3D printed collectibles.
Custom designs: Creating, reviewing, showing you, and printing a design based on your photos and description, including with the AI tools described in “Custom Designs, Photos and AI Processing” below.
Account management: Managing your account, subscriptions (Commercial License, Mystery Box), and license access.
Customer support: Responding to inquiries, processing returns, and resolving issues.
Legal compliance: Meeting tax, accounting, and regulatory obligations.
Service improvement: Analyzing aggregate usage patterns to improve our website and product offerings.
Communications: Sending order confirmations, shipping updates, and subscription notices. Marketing emails are only sent if you have opted in.

Custom Designs, Photos and AI Processing

We offer custom designs made from your photos in two ways: Human-Assisted, where a member of our design team works on your request, and AI-Assisted, where artificial intelligence (AI) tools create a first concept and 3D model that our team then reviews. In both cases, our team may use AI tools to create concept images and 3D models.

What We Collect for a Custom Design

The photos you upload, and the description, notes and choices you give us.
Whether a photo shows someone under 18, and the consents and confirmations you give us.
The concept images and 3D models we create. These may show a likeness of the people in your photos.
Your contact, order and payment details, as for any order.

Why We Use It

We use it to create your design, review it, show it to you and print it; to answer your questions and to redo or fix your piece; to prevent abuse of our service; and to keep a record of your consents and of what you approved. We do not use your photos to recognize or identify anyone, and we do not use them for advertising. We do not use your photos or designs to train AI models.

Who Processes It

Your photos and request are stored on our website’s server (A2 Hosting, United States) and handled by our team and our design software in Quebec. Depending on the request, we may use one or more of the following AI tools. We send each tool only what it needs for its task. We never send your payment information to the AI providers.

OpenAI (OpenAI OpCo, LLC, United States). What it does: image models create concept images; language models help us analyze and describe your request. What it receives: your photos and the description of your request. What it states about your data: data sent to its API is not used to train its models unless the customer opts in to share it. It may keep the data for up to 30 days, mainly to monitor for abuse.
Google (Google LLC, United States), Gemini models. What it does: creates and refines concept images and helps us analyze your request. What it receives: your photos and the description of your request. What it states about your data: How Google may use and keep this data is governed by its Gemini API terms: for paid services, Google states that it does not use the data to improve its products and keeps it for a limited period to detect abuse. It may be processed in any country where Google or its agents have facilities.
Hyper3D Rodin (Deemos Corporation, a United States company). What it does: creates the 3D model. What it receives: images of your design, normally the concept image created from your photos, and in some cases a photo you provided. What it states about your data: Hyper3D does not disclose where it processes data, so processing may take place outside Canada and the United States. Its API policy states that this data is not used to train its models and is deleted from its active systems after 7 days.
Tripo AI (Holymolly Limited, Hong Kong). What it does: creates the 3D model. What it receives: images of your design, normally the concept image created from your photos, and in some cases a photo you provided. What it states about your data: data may be processed in the United States and other countries. Tripo states that, for paid accounts, it does not use this data to train its AI.
3DCentral in-house AI. What it does: open models, such as Microsoft TRELLIS, and local language models create or refine concept images and 3D models. What it receives: your photos, description and design images. Where: on equipment we control in Quebec, at our premises or in a data centre in the Montreal area. Your data is not sent to the publishers of these models.

The AI tools help create your design; they do not make decisions about you. A member of our team reviews every 3D model before it is shown to you. The AI providers also run automated safety checks. If one of these checks prevents us from completing your request, we will tell you, explain the main reason if you ask, and a member of our team can review the decision.

Your Consent and Your Choices

We explain this processing when you submit a custom request. By submitting your request, you consent to the processing described in this section for the purpose of creating and producing your design. If you would prefer that your photos not be sent to external AI providers, tell us before you submit your request. We will tell you whether we can complete it with our in-house tools only or without AI.

You can withdraw your consent at any time by contacting us (see “Privacy Officer” below). If you withdraw it before we start working on your design, we will cancel your request and refund any amount you paid for it. If you withdraw it later, we will stop any further processing. Copies already sent to an AI provider are deleted on that provider’s schedule, as described above.

People in Your Photos

Only upload photos you have the right to use, of people who have agreed to their photo being used for this purpose. For a child under 14, the child’s parent or legal guardian must agree. For someone aged 14 to 17, that person or their parent or legal guardian must agree. See “Children’s Privacy” below.

Payment Processing

All payments on 3dcentral.ca are processed through Stripe. When you make a purchase:

Your payment information is transmitted directly to Stripe via their secure, PCI-DSS compliant infrastructure.
3DCentral receives only a confirmation of payment, a transaction reference, and the last four digits of your card for order identification purposes.
We never store, process, or have access to your complete credit card number, CVV, or other sensitive payment credentials.

For details on how Stripe handles your data, please review Stripe’s Privacy Policy.

Cookies and Tracking Technologies

Our website uses a limited number of cookies:

Essential Cookies

WooCommerce session cookies: Track your shopping cart contents and session state. These are required for the store to function.
WordPress authentication cookies: Maintain your logged-in status if you have an account.
Cookie consent preference: Remembers the cookie choices you made.

Analytics Cookies

If you accept analytics cookies, we use Google Analytics 4 (Google LLC, United States) to understand how visitors use our website: pages viewed, device and browser type, and approximate location. Google Analytics does not load until you accept. We do not install advertising or social-media tracking pixels on our website.

What We Do NOT Use

No third-party advertising cookies.
No cross-site tracking pixels from social media platforms.
No external font services that track visitors.

We do not sell, rent, or trade your personal information to any third party.

We share your data only with the following service providers, strictly as needed to operate our business:

Stripe: Payment processing.
Shipping carriers: Name and delivery address for order fulfillment (Canada Post, UPS, or other carriers as applicable).
Email service provider: Email address for transactional messages and, if you opt in, marketing newsletters.
AI providers (OpenAI, Google, Hyper3D, Tripo AI): Only for custom designs, as described in “Custom Designs, Photos and AI Processing.”
Google (Google Analytics): Only if you accept analytics cookies.
Hosting provider: A2 Hosting, Inc. hosts our website and its data on a dedicated server in the United States (Michigan).

Each service provider receives only the information it needs to perform its service and may use it only for that purpose.

Data Retention

We keep personal information only as long as we need it for the purposes described in this policy, or as long as the law requires, and then we destroy or anonymize it. We retain your data for the following periods:

Order and transaction records: 6 years after the end of the fiscal year in which the transaction took place (about 7 years in total), as required by Canadian and Quebec tax law.
Account information: Retained while your account is active. You may request deletion at any time (see Your Rights below).
Custom design photos: Deleted 30 days after your request is closed (delivered, cancelled, refunded, or not ordered), or 14 days after it is closed if a photo shows someone under 18. Photos in drafts or unpaid requests are deleted after 7 days.
Designs we create for you (concept images and 3D models): If you order the print, kept for 24 months after your last order of that design, so we can reprint or replace it. If you do not order, deleted within 60 days after we deliver your preview or quote. You can ask us to delete them sooner.
Consent records for custom designs: 3 years after your request ends, as proof of your choices. They do not contain your photos.
Records of an automated safety block: 1 year after the decision, so that it can be reviewed.
Copies held by AI providers: As stated in “Custom Designs, Photos and AI Processing” (for example, up to 30 days at OpenAI and 7 days in Hyper3D’s active systems).
Customer support communications: Up to 3 years for quality assurance and dispute resolution.
Newsletter subscriber data: Until you unsubscribe. You may unsubscribe at any time via the link in any email.
Server logs: Up to 12 months, then automatically purged.
Google Analytics data: At most 14 months, according to our Google Analytics settings.

Your Rights Under Quebec Law 25 (Bill 64)

You have the following rights regarding your personal information:

Right of access: You may ask whether we hold personal information about you and request a copy of it.
Right of rectification: You may request correction of any inaccurate, incomplete, or equivocal personal information.
Right of deletion: You may request that we delete your personal data, subject to legal retention requirements (e.g., tax records).
Right to withdraw consent: You may withdraw your consent at any time, for example for marketing emails, analytics cookies, or custom-design processing.
Right to data portability: You may request the personal information you provided to us, including the photos you uploaded, in a structured, commonly used format.
Right to be informed: You have the right to know what data we collect, why, how it is used, who has access to it, and how long we keep it.
Automated decisions: We do not make decisions about you based exclusively on automated processing. If an automated safety check blocks a custom design request, we will tell you, explain the main reasons if you ask, and a member of our team can review the decision.
Stopping dissemination or de-indexing: In the cases provided by Quebec law, you may ask us to stop disseminating information about you or to de-index a link that gives access to it.

To exercise any of these rights, contact us at info@3dcentral.ca, by phone at 438-876-7716, or by mail (see “Privacy Officer” below). We may ask you to confirm your identity before acting on your request. Access is free; we may only charge a reasonable fee for transcribing, reproducing, or transmitting information, and we will tell you the amount first. We will reply in writing within 30 days of receiving your request, as required by law. If you are not satisfied with our reply, you may file a complaint with the Commission d’accès à l’information du Québec (CAI).

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

SSL/TLS encryption on all pages.
Secure password hashing for user accounts.
Login attempt limiting and brute-force protection.
File editor disabled in WordPress for server security.
Directory listing blocked.
Regular database backups (daily) and full server backups (weekly).
Digital files (STL library) stored outside the public web directory with direct URL access blocked.
Custom design photos and designs accessible only to the staff working on custom orders, and sent to our AI providers over encrypted (HTTPS) connections.

While we take every reasonable precaution, no method of data transmission or storage is completely secure. We cannot guarantee absolute security but are committed to industry best practices.

Subscribing to our newsletter is entirely optional. If you subscribe:

Our newsletter is used to announce new products and seasonal collection launches.
You may unsubscribe at any time by clicking the unsubscribe link at the bottom of any email.
We will never send marketing emails without your explicit consent, in compliance with CASL.

Transactional emails (order confirmations, shipping updates, subscription notices) are not marketing and will be sent regardless of newsletter preference.

Children’s Privacy

Our products are decorative collectibles and are not marketed to children. You must be 18 or older to create an account or place an order. We do not knowingly collect personal information directly from children under 14.

A custom design may be based on photos of children sent to us by a parent, a legal guardian, or another adult. We accept such photos only:

for a child under 14, with the consent of the child’s parent or legal guardian;
for someone aged 14 to 17, with the consent of that person or of their parent or legal guardian.

We keep photos that show someone under 18 for a shorter time (see Data Retention), and we never use them in our marketing.

If you are a parent or guardian and believe we hold your child’s personal information without proper consent, please contact us at info@3dcentral.ca and we will promptly delete the information.

International Data Transfers

3DCentral is based in Quebec, Canada. Our website and its data are hosted by A2 Hosting, Inc. on a dedicated server in the United States (Michigan). Our design team, our design software, and our in-house AI equipment are in Quebec.

Some of our service providers process personal information outside Quebec and Canada, mainly in the United States:

A2 Hosting, for hosting our website and its data;
Stripe, for payments;
OpenAI, Google, Hyper3D, and Tripo AI, only for custom designs;
Google Analytics, only if you accept analytics cookies.

Hyper3D does not disclose where it processes data, and Google and Tripo AI state that data may also be processed in other countries. Because our website is hosted in the United States, the personal information you provide through it is stored outside Quebec and Canada. While your information is outside Canada, it may be accessible to the courts, law enforcement, and national security authorities of those countries under their laws.

Quebec law requires us to assess the protection your information will receive before we communicate it outside Quebec, and to have a written agreement with each recipient. Where a provider offers data protection terms, such as OpenAI’s data processing addendum and Google’s data processing terms, we rely on them.

Data Breach Notification

3DCentral Solutions Inc. takes data security incidents seriously. In the event of a breach of personal information, we follow a structured response process in compliance with Quebec Law 25 (Bill 64) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

Detection and Assessment

We maintain monitoring systems and procedures to detect unauthorized access to, or disclosure of, personal information. When a potential breach is detected, our team immediately assesses the incident to determine:

The nature and scope of the personal information involved.
The cause and circumstances of the breach.
Whether the breach creates a risk of serious harm to affected individuals.
What steps can be taken to contain and mitigate the breach.

Notification Timeline

If a breach poses a risk of serious harm, we will notify affected individuals within 72 hours of becoming aware of the incident. We will also promptly notify the Commission d’accès à l’information du Québec (CAI) as required by Quebec Law 25, and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

What Our Notification Will Include

Our breach notification to affected individuals will contain:

A description of the incident and the date or estimated date it occurred.
The types of personal information involved in the breach.
A description of the measures we have taken or plan to take to reduce the risk of harm.
Steps you can take to protect yourself from potential harm.
Contact information for our Privacy Officer so you can obtain further information or assistance.

Mitigation Measures

Upon confirming a breach, we will take immediate steps to mitigate damage, which may include:

Containing the breach and securing affected systems.
Resetting passwords or revoking access credentials for affected accounts.
Engaging third-party security experts to investigate the cause and prevent recurrence.
Reviewing and strengthening security measures based on findings.
Maintaining a record of the breach and all actions taken, as required by law.

Your Right to File a Complaint

If you believe your personal information has been compromised, or if you are unsatisfied with our response to a data breach, you have the right to file a complaint with:

Commission d’accès à l’information du Québec (CAI) — the Quebec authority responsible for overseeing the protection of personal information in the private sector.
Office of the Privacy Commissioner of Canada — the federal authority responsible for PIPEDA compliance.

Contact Our Privacy Officer

For any questions or concerns about data breaches or this notification policy, please contact:

Email: info@3dcentral.ca
Phone: 438-876-7716
Mail: 3DCentral Solutions Inc., Attn: Privacy Officer, 1325 Rue Bergar, Laval, QC H7L 4Z7, Canada

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes:

The “Last Updated” date at the top of this page will be revised.
For significant changes, we will notify registered users by email.
If we want to use your personal information for a new purpose, we will ask for your consent first.

How We Manage Personal Information

Our governance practices for personal information provide for the following:

Our person in charge of the protection of personal information (see “Privacy Officer” below) approves our privacy practices.
We follow a retention schedule (summarized under Data Retention) and destroy or anonymize information we no longer need.
We assess privacy risks before launching a new information system or service and before communicating personal information outside Quebec.
Only staff who need personal information for their work can access it.
We record every confidentiality incident (any unauthorized access to, use of, or communication of personal information, or its loss) in a register that we keep for at least 5 years.
We handle privacy requests and complaints as described under Your Rights, and we reply in writing within 30 days.

Privacy Officer

In accordance with section 3.1 of Quebec’s Act respecting the protection of personal information in the private sector, the person in charge of the protection of personal information at 3DCentral Solutions Inc. is its President. For all privacy-related inquiries, requests, or complaints, please contact:

Email: info@3dcentral.ca
Phone: 438-876-7716
Mail: 3DCentral Solutions Inc., Attn: Privacy Officer (President), 1325 Rue Bergar, Laval, QC H7L 4Z7, Canada

If you are unsatisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec (CAI).