Deep 3D Print – Privacy Policy
Summary
Deep 3D Print turns your text, photos and 3D files into printable 3D models. To do that, we process the content you give us, your account data and some technical data about how you use the app.
- We do not sell your data and we do not show ads in the App. We use Meta’s advertising tools to measure and improve our ad campaigns, only if you consent (section 5).
- Your photos, prompts and files are sent to third-party AI providers (via fal.ai) only to generate the result you ask for. See section 4.
- Product analytics and advertising measurement are off until you consent. They are separate choices and you can withdraw either at any time.
- You can delete your account and data directly in the App (Profile → Delete account).
- Our backend and database are hosted in the European Union. Some providers process data in the United States and possibly other countries (section 7).
This policy applies to the Deep 3D Print app for iOS and, where available, Android, and to related services (together, the “App”).
1. Data Controller
The data controller is OVER THE TAP S.R.L., an Italian innovative startup (“Over the Tap”, “we”, “us”).
| Registered office | Viale Campania 33, 20133 Milano (MI), Italy |
| VAT and tax code | IT 14769570962 |
| REA | MI-2806579 |
| Share capital | € 10,980.00 fully paid |
| Privacy contact | hello@overthetap.it |
| Certified email (PEC) | overthetap@pec.it |
We have not appointed a Data Protection Officer, as we are not required to. For any privacy question or request, write to hello@overthetap.it.
2. Data we process
| Category | What it includes | Source |
|---|---|---|
| Account data | User ID, email address, name, sign-in provider (Apple, Google or email). With Sign in with Apple you may use a private relay email | You, Apple, Google |
| Your content | Text prompts, photos, images, 3D files you upload (GLB, STL, 3MF, OBJ, up to 64 MB), generated images and 3D models and their versions | You, generated by the App |
| Assistant data | Questions you ask the print assistant, photos you attach, the answers you receive, your feedback on them (thumbs up or down), the conversation history, and your saved printers and filaments (“My Lab”) | You, generated by the App |
| Onboarding answers | Optional: printing experience and interests. You can skip these steps | You |
| Purchase data | Subscription status, purchase and receipt history, credit balance and credit usage. We never see your card details | Apple, Google, RevenueCat |
| Usage and device data | App events linked to your user ID, device and app identifiers, device model, OS version, app version, approximate location (country or city) derived from your IP address | Automatically, with consent where required (section 5) |
| Advertising data | Only with consent: advertising identifier (IDFA/AAID, on iOS only if you allow tracking), install, sign-up and purchase events, IP address, hashed email | Automatically (section 5) |
| Crash and error data | Crash reports, stack traces, your user ID, device model and OS version | Automatically |
| Support communications | Emails you send us and our replies | You |
Photos may show people. Do not upload photos of other people without their consent, and do not upload images that reveal sensitive information (for example health, religion or sexual orientation). We do not use your photos to identify people and we do not create biometric templates.
Permissions. The App asks for access to the camera and photo library only so you can create models or diagnose prints. We do not access your precise location, contacts or microphone. You can revoke permissions in your device settings.
3. Why we process your data, legal bases and services used
Each purpose below has its own legal basis under the GDPR (Art. 6). Providers act as our processors under data processing agreements, unless stated otherwise.
| Purpose | Legal basis | Services (provider, place of processing) |
|---|---|---|
| Sign-in and account management | Performance of the contract | Firebase Authentication (Google, EU/US); Sign in with Apple (Apple); Google Sign-In (Google) |
| Storing your library, models, lab and conversations | Performance of the contract | Cloud Firestore (Google, EU multi-region); Cloud Storage for Firebase (Google, EU) |
| Running the backend, processing jobs and editing models | Performance of the contract | Cloud Functions and Cloud Tasks (Google, Belgium – europe-west1) |
| Generating images and 3D models and answering assistant questions | Performance of the contract | fal.ai (Features & Labels Inc., USA) and the third-party AI model providers it uses (section 4) |
| Subscriptions, credits and purchases | Performance of the contract; legal obligation for tax records | RevenueCat (RevenueCat Inc., USA); Apple App Store (Apple, independent controller); Google Play Billing (Google, independent controller) |
| Remote configuration: prices in credits, available engines and onboarding variants | Performance of the contract | PostHog feature flags (PostHog Inc., EU – eu.i.posthog.com) |
| Product analytics, error tracking and A/B tests | Consent | PostHog (PostHog Inc., EU – eu.i.posthog.com) |
| Measuring and optimising our ads (conversions, attribution, audiences) | Consent; on iOS also your permission in the tracking prompt | Meta SDK, Meta Pixel and Conversions API (Meta Platforms Ireland Ltd. and Meta Platforms Inc., USA). Meta is joint controller for collecting and transmitting the data, and independent controller for its own further use |
| Crash reporting to keep the App stable | Legitimate interest | Firebase Crashlytics (Google, USA) |
| Personalising onboarding and understanding who uses the App | Consent (the questions are optional) | Answers stored in Cloud Firestore; onboarding events in PostHog |
| Customer support and service communications | Performance of the contract | |
| Preventing abuse and fraud, defending legal claims | Legitimate interest | Internal logs, including the cost of each generation job |
| Complying with tax, accounting and legal requests | Legal obligation | — |
Where we rely on legitimate interest, we have balanced it against your rights. You can object at any time (section 10).
No automated decisions with legal effects. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Mandatory data. Account data and the content you submit are needed to provide the App. Onboarding answers and analytics consent are optional.
4. AI processing and your content
When you start a generation, edit a model or ask the assistant, we send only the data needed for that request to fal.ai, which runs the AI model you selected or the one the App uses for that feature.
| Feature | Type of AI provider | Data sent |
|---|---|---|
| Text previews and photo redraw | Image generation models | Prompt, photo |
| Image to 3D | 3D generation engines | Image |
| Print assistant, including photo analysis and web search | Large language model, through a model routing service | Your question, attached photos, the last 6 messages of the conversation, your saved printers and filaments |
Model edits (repair, colour reduction, colour changes, textures) are processed on our own servers in the EU and are not sent to AI providers.
Some engines are run by fal.ai itself. Others are run by their developers through their own APIs (“partner engines”): for these, fal.ai transfers your request to the developer, which processes it to return the result. Before you confirm a generation, the App shows the name and developer of the engine. The engines we offer change over time, and the App always shows the current ones.
What providers may do with your data. fal.ai acts as our processor under a data processing agreement and may process your data only on our instructions and to provide its service. Under fal.ai’s terms, this agreement also covers partner engines accessed through fal.ai, except engines that fal.ai marks as “Pending Enterprise Ready”, which we do not use. fal.ai does not use your content to train its products, and may use anonymised or aggregated data derived from use of its service to improve and develop its products and models. fal.ai keeps the files it generates for at least 7 days, and may keep request data until our agreement with it ends (section 8).
AI-generated results. Images and 3D models are generated by AI and may be inaccurate. The assistant’s answers, including those based on web search, may contain errors and are for guidance only.
Third-party slicers and sharing. If you choose to open a model in a slicer (Bambu Studio, OrcaSlicer, Snapmaker Orca, Anycubic Slicer Next) or share it, the App creates a direct download link to that file or passes the file to your device’s share sheet. From then on, the file is handled under that software’s own terms and privacy policy.
5. Analytics, crash reports and consent
Product analytics (PostHog) are off by default. They start only if you accept, during onboarding or later in Profile › Privacy, where you can also withdraw consent at any time; withdrawal does not affect processing carried out before it. With consent we collect app events linked to your user ID, error context (with email addresses removed), device and app identifiers and approximate location derived from your IP address. We never send your files, photos or prompts to PostHog. Session replay is not enabled.
Remote configuration. Even without analytics consent, the App reads remote configuration flags, linked to an anonymous app identifier or to your user ID. They set prices in credits, the engines available and onboarding variants, and are needed to show you correct prices and a working App.
Crash reports (Firebase Crashlytics). On iOS and Android production builds, the App sends crash reports to keep the App working, based on our legitimate interest. They contain your user ID, a device identifier, the stack trace, device model and OS version, and do not include your content. You can object as described in section 10.
Advertising measurement (Meta). We advertise the App on Meta platforms (Facebook, Instagram). Only if you give this separate consent, we send Meta events such as installs, sign-ups and purchases, together with device or advertising identifiers, IP address and, for matching, a hashed (encrypted one-way) version of your email. Meta uses them to tell us which ads work and to show our ads to people likely to be interested. On iOS, events linked to advertising identifiers are sent only if you also allow tracking in Apple’s prompt. Meta is joint controller with us for collecting and sending this data, and processes it afterwards as an independent controller under its own privacy policy. You can withdraw consent at any time in Profile › Privacy, or deny tracking in iOS settings. We never send Meta your photos, prompts, files or conversations.
Our websites. On our websites we use technical cookies and, only if you accept them in the cookie banner, analytics and advertising cookies, including the Meta Pixel. You can change your choice at any time from the banner settings.
6. Payments and subscriptions
In-app purchases are processed by Apple (App Store) or Google (Google Play), which act as independent controllers under their own privacy policies. We do not receive or store your payment card details.
RevenueCat receives your user ID and purchase receipts from the store so it can confirm your subscription, manage your credit balance and send us purchase events. If we later offer payments on the web, they will be processed by RevenueCat Web Billing and Stripe, and we will update this policy before enabling them.
7. International data transfers
Our database, file storage, backend and product analytics are located in the EU. Some providers process data outside the European Economic Area:
| Provider | Country | Safeguard |
|---|---|---|
| Google (Crashlytics, sign-in) | USA | EU-US Data Privacy Framework and Standard Contractual Clauses |
| fal.ai, including partner engines accessed through it (section 4) | USA; developers of partner engines may process data in other countries, which may include China | Standard Contractual Clauses (controller to processor) in fal.ai’s data processing agreement. Under these clauses fal.ai may pass your data on to its providers outside the EEA only under the conditions of Clause 8.8, and it remains liable for them |
| RevenueCat | USA | Standard Contractual Clauses (controller to processor), included in its data processing agreement |
| Meta | USA | EU-US Data Privacy Framework and Standard Contractual Clauses |
Rule for AI engines. We only use AI engines through fal.ai and only engines covered by fal.ai’s data processing agreement.
You can ask us for a copy of the relevant safeguards at hello@overthetap.it.
8. How long we keep your data
| Data | Retention |
|---|---|
| Generation requests (jobs) and their temporary files | Deleted automatically after 90 days |
| Files generated by fal.ai | At least 7 days on fal.ai’s storage; other request data may be kept by fal.ai until our agreement with it ends |
| Models, versions, uploaded files, lab data and assistant conversations | Until you delete them or delete your account |
| Account data and credit balance | Until you delete your account |
| Product analytics (PostHog) | Up to 7 years, or until you delete your account |
| Advertising measurement data sent to Meta | Under Meta’s own retention policy |
| Crash reports (Crashlytics) | Up to 90 days |
| Purchase and transaction records | As long as required by tax and accounting law, up to 10 years |
| Support emails | Up to 24 months after your request is closed |
| Data needed to defend legal claims | Until the claim is time-barred |
When a retention period ends, we delete the data or make it anonymous. Backups are overwritten on their normal cycle.
9. Deleting your account and data
You can delete your account at any time in Profile → Delete account. Deletion:
- removes your profile, models, versions, uploaded files, assistant photos and conversations, lab data and jobs from our database and storage;
- deletes your data from RevenueCat and PostHog;
- revokes your Sign in with Apple token, if you used it, and deletes your sign-in account.
Deletion is permanent and any remaining credits are lost. It does not cancel an active subscription: cancel it in your App Store or Google Play settings. Apple and Google keep their own transaction records under their policies, and we keep the records required by law (section 8).
You can also delete single models and files in the App, or ask us to delete your data by writing to hello@overthetap.it.
10. Your rights
Under the GDPR you have the right to:
- access your data and get a copy;
- rectify inaccurate data;
- erase your data;
- restrict processing;
- receive your data in a structured, machine-readable format and have it transferred to another controller (portability);
- object to processing based on legitimate interest, including crash reporting;
- withdraw consent at any time, without affecting processing carried out before withdrawal;
- lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it); you can also contact the authority of the country where you live or work.
To exercise your rights, write to hello@overthetap.it. Requests are free. We reply within one month, extendable by two months for complex requests, and we may ask you to confirm your identity.
11. Information for users in the United States
We do not sell your personal information for money. If you consent to advertising measurement, we share app events and device identifiers with Meta to measure and target our ads, which some state laws treat as “sharing” for cross-context behavioral advertising. You can opt out at any time by withdrawing that consent in Profile › Privacy or denying tracking in iOS settings. We do not use or disclose sensitive personal information to infer characteristics about you.
The categories of personal information we collect, their sources, purposes and recipients are described in sections 2 to 4. Depending on your state of residence (for example California), you may have the right to know what we collect, to access, correct or delete it, and not to be discriminated against for exercising these rights. To make a request, write to hello@overthetap.it. You may use an authorized agent; we will verify the request before acting on it.
12. Minimum age
The App is intended for users aged 18 or older (or the age of majority where they live, if higher). We do not knowingly collect data from minors. If we learn that a user is a minor, we will delete the account and its data. If you believe a minor has given us personal data, write to hello@overthetap.it.
13. Security and data breaches
Data is encrypted in transit and at rest by our infrastructure providers. Access to your data is limited by security rules to your own account, and only authorised team members can access it for support or maintenance. No system is completely secure.
If a breach affects your personal data, we will notify the supervisory authority within 72 hours where required. If the breach is likely to result in a high risk to you, we will also inform you without undue delay.
14. Changes and contact
We may update this policy when the App or the law changes. We will publish the new version with its effective date and, for material changes, notify you in the App before they apply. If a change concerns processing based on consent, we will ask for your consent again. Previous versions are available on request.
Questions or requests: hello@overthetap.it · OVER THE TAP S.R.L., Viale Campania 33, 20133 Milano, Italy.
Effective date: 24 October 2026