LEGAL
Terms & Privacy
These agreements govern use of the Platform. They are written to allocate risk clearly between the company, buyers, and makers. They are not a substitute for advice from your own counsel.
Privacy Policy
Effective date: October 16, 2026
Last updated: 2026-10-17
Document version: 2026-10-16.1
Operator: LeonardShopping L.L.C., a Texas limited liability company, d/b/a Print3d Hive
Current status (effective 2026-10-16). While physical ordering is paused, we don't collect shipping addresses or share order details with makers. The rest of this policy still applies.
This Privacy Policy explains how LeonardShopping L.L.C. (“Company,” “we,” “us”) collects, uses, shares, and protects information in connection with the Print3d Hive Platform (the “Service”). It works together with our Terms of Service.
If you do not agree with this Policy, do not use the Service.
1. Who we are
Controller / business: LeonardShopping L.L.C. (Texas), operating under the Print3d Hive trade name (Colorado DBA).
Contact channels for privacy requests will be published on the Platform (About / legal pages) and may be updated from time to time.
2. Scope
This Policy covers information processed through our websites, apps, APIs, and related services we control. It does not cover third-party sites or services (makers’ own sites, carriers, OAuth providers, payment processors) except as they process data on our behalf or receive data as independent controllers.
3. Information we collect
3.1 You provide
- Account data: email (if you choose email signup), password hashes (not plaintext passwords), recovery key hashes, public handle / public hash, profile bio, avatars/banners, optional display fields.
- OAuth profile data: when you use Google, GitHub, X, or similar: provider subject ID, and, depending on provider, display name, username, avatar URL, and sometimes email. We key OAuth identity by provider + stable subject ID, not by email alone.
- Marketplace data: listings, designs/files, offers, orders, messages related to orders (if enabled), shipping addresses and contact details for fulfillment, preferences.
- Communications: support messages, reports, feedback.
- Legal acceptance records: when you accept Terms/Privacy: timestamp, document version, method (e.g., signup, login, OAuth), and technical metadata (IP address and User-Agent when available) for compliance and dispute evidence.
3.2 Collected automatically
- Downloads: which file, when, that you ticked the download Terms box and which Terms version you accepted, and a scrambled code made from your IP address (a keyed hash). We don't store the IP address itself, but we can check whether a known IP address matches a record, for example in an abuse or license dispute.
- Device and log data: IP address, User-Agent, approximate location derived from IP, timestamps, request paths, referrers, error logs.
- Cookies and similar tech: essential cookies (sign-in session, security, your cookie choice) and, only if you accept optional cookies, the first-party analytics identifiers described in §6A. See the cookie table in §6.
- Usage data (analytics): only if you accept optional cookies and your browser is not sending Do Not Track or Global Privacy Control. Details are in §6A.
3.3 From third parties
- OAuth providers (Google, GitHub, X, etc.).
- Payment processors (e.g., Stripe): payment status, last4/brand where provided, dispute/chargeback data (not full PAN if using hosted fields).
- Shipping / maps / geocoding providers when you use address tools.
- Fraud and security signals from infrastructure providers.
3.4 Sensitive data
We do not intentionally collect government ID numbers or precise health data. Location used for shipping or approximate “world” features should be limited to what you provide or what is needed for the feature. Do not upload content you are not willing to store on our systems.
3.5 Surveys and build reports ("How did it go?")
Answering is always optional. You can skip any question, choose "Not now," or turn off prompts for a listing.
If you're signed in. About 48 hours after you download a project, we may show you a short "How did it go?" card on the site. If you answer, we store your answers with your account: whether you made it, a star rating, any issues you tick, and anything you add in the longer version (method, machine, material and settings, print and build time, what you'd change, tips, and whether you'd recommend it). We also note whether the answer came through an AI agent or app you connected. We use your answers to show creators what worked and what didn't, to calculate the public numbers on listings, and to keep the numbers fair (for example, answers from new or linked accounts count for less, and sudden waves of answers are held for review). Creators see totals and moderated tips, not who said what. We only share your answer with the creator, and let them message you about it, if you tick the box that allows it.
Tips and photos. If you add a tip, it may appear on the listing after moderation, without your name. If you add a photo, it becomes a public "Made it" post under your public handle, after moderation, and we remove location and camera data (EXIF) from it first.
You can remove a Make at any time. It's hidden right away.
Email follow-up (optional). We email you about your builds only if you tick "Ask me how my builds went." That box is unticked unless you tick it. If you do, we send at most one email per project, never reminder chains. You can turn it off any time in Settings or with the unsubscribe link in any of these emails, and we stop right away. We keep a record of when you opted in or out.
If you're not signed in (guests). If you come back on the same browser within 30 days, the listing may show a "Made this? Tell us how it went" link. Guest answers are anonymous. We store only the answers themselves, the listing and version, and the date. We do not store your IP address, any account ID or any email with them. To stop the same browser from answering twice, we store a scrambled one-way code made from your browser's hive_gdev cookie (see §6) next to the answer and delete that code after 30 days. After that the answer can't be linked to any browser or person. We never email guests about surveys.
We don't show survey prompts to anyone we know to be under 13, and we never pay or reward anyone for answers.
4. How we use information
We use information to:
- Provide, secure, and maintain the Service (accounts, sessions, marketplace, files, payments);
- Process orders and communicate about them;
- Prevent fraud, abuse, spam, and security incidents;
- Comply with law, enforce Terms, and establish, exercise, or defend legal claims (including storing acceptance records);
- Improve features, UX, reliability, and performance;
- Communicate service-related notices; send optional product updates if you opt in where required;
- Analyze aggregated or de-identified trends.
- Count downloads, saves, likes and builds, and run optional build surveys, so creators and makers can see what works (see §3.2, §3.5 and "Public counts on listings" in §5).
Legal bases (where GDPR/UK GDPR-style bases apply): contract performance; legitimate interests (security, improvement, marketplace integrity) balanced against your rights; consent (where required, e.g., certain cookies/marketing); legal obligation.
5. How we share information
We do not sell your personal data, and we do not use or share it for targeted advertising (ads chosen from your activity across other companies' sites or apps). We don't use third-party ad pixels or third-party analytics. If that ever changes, we will update this Policy first, ask for your consent where the law requires it, and give you a way to opt out.
We share information with:
5.1 Service providers / processors under contracts: hosting, storage, email, error monitoring, payment processing (Stripe, see §5.8), shipping labels and tracking, maps/geocoding, and security. Our analytics runs on our own servers. We don't send analytics data to an outside analytics company. Download records and survey answers are stored on our own servers. The only outside companies that handle them are our hosting and storage providers, and our email provider for survey emails you opted in to, all acting for us under contract. We don't give them to creators, makers or anyone else, except the public totals below and as required by law (§5.5).
5.2 Other users as part of the product: public handles, public profiles, public listings, public designs you publish, content you mark public. Privacy-preserving defaults do not make public posts private.
5.3 Makers / buyers as needed to fulfill orders (shipping name/address, order details, contact info required for delivery or meetup coordination).
5.4 OAuth and payment partners as needed to authenticate or process payments.
5.5 Legal and safety: if we believe disclosure is required by law, subpoena, court order, or to protect rights, safety, and integrity of the Service, users, or the public.
5.6 Business transfers: merger, acquisition, financing, or sale of assets. Information may transfer under appropriate confidentiality, with notice where required.
5.7 With your direction: when you use integrations or export tools.
5.8 Payments by Stripe. Payments are processed by Stripe on Stripe-hosted checkout pages. You enter your card or other payment details with Stripe, not with us. We receive payment status and limited details, like card brand and last four digits. We never receive your full card number. Stripe may collect personal data, including through cookies and similar technologies on its checkout pages, such as transaction data and information about the device you use. Stripe uses it to provide and improve its services, including fraud detection, loss prevention and authentication. Stripe handles that data under its own privacy policy: https://stripe.com/privacy. Our analytics never runs on Stripe's pages and never sees card or payment details.
Payouts to makers. Makers are paid through Stripe Connect. When a maker sets up payouts, we send Stripe three things: the email address on their Print3d Hive account, their country, and an internal shop number (not their name or handle). Stripe then collects the identity, tax and bank details it needs directly from the maker, under Stripe's own privacy policy (https://stripe.com/privacy) and the Stripe Connected Account Agreement. We keep only the Stripe account ID and whether payouts are verified. We never receive full bank account or ID numbers.
5.10 Public counts on listings. Listings, and the same data in our API, may show totals such as downloads, saves, likes, forks, "Made it" posts, a success rate, common issues and typical build time. These are counts only. They never show who downloaded, saved, liked or answered. Survey-based numbers (success rate, issues, build time and similar breakdowns) are shown only once at least 5 answers exist, so no one can be singled out. Large download totals may be rounded (for example "1.2k").
6. Cookies and similar technologies
We use:
- Essential cookies: login session, CSRF/OAuth state, legal acknowledgment, security.
- Preferences: theme, dismissed onboarding.
- Analytics (optional, off by default): see §6A. Analytics runs only if you choose "Allow optional cookies" and your browser is not sending Do Not Track (DNT) or Global Privacy Control (GPC). Choosing "Later" or closing the banner means essential cookies only.
You can change your choice at any time under Cookie settings in the footer. When you withdraw consent, we stop analytics and delete the analytics identifiers on your device. Blocking essential cookies may break sign-in and checkout.
Cookies and storage we use:
| Name | Type | Set by | Purpose | Lifetime | Category |
|---|---|---|---|---|---|
hive_session | Cookie (signed) | Print3d Hive (first-party) | Keeps you signed in | 30 days, or until you sign out | Essential |
hive_csrf | Cookie | First-party | Blocks forged form submissions | 4 hours | Essential |
hive_oauth | Cookie | First-party | Protects sign-in with Google or another provider | 10 minutes | Essential |
hive_legal | Cookie | First-party | Records that you agreed to the Terms and Privacy Policy before creating an account | 30 days | Essential |
hive_gdev | Cookie (signed) | First-party | Random ID for a signed-out browser. Enforces guest download limits and stops the same browser from answering a guest survey twice. Contains no name, email or IP. | 365 days | Essential (security and abuse prevention) |
hive_dl_affirm | Cookie (signed) | First-party | Remembers that you ticked the download checkbox for the current Terms version | Browser session | Essential |
hive_cookies | Cookie | First-party | Remembers your optional-cookie choice (yes or Later) so we don't ask on every visit | 400 days | Essential |
hive_near | Cookie | First-party | Remembers the area you chose for "near me" so Explore shows nearby makers | 180 days. Set only when you use near me. | Preference (functional) |
hive_admin_session | Cookie | First-party | Staff sign-in only. Never set for shoppers or makers. | 14 days | Essential (staff) |
| Theme / onboarding flags | localStorage | First-party | Your display preferences | Until you clear them | Preference (functional) |
hive_vid | Cookie or localStorage | First-party (Print3d Hive only) | Random visitor ID that counts repeat visits and groups one browser's analytics events. It contains no name, email or IP. | Up to 13 months from when it was set. Deleted when you withdraw consent or when DNT/GPC is detected. | Non-essential (analytics). Set only after "Allow optional cookies," and only with DNT and GPC both off. |
hive_sid | sessionStorage | First-party | Groups events within one visit (resets after 30 min idle) | Browser session | Non-essential (analytics). Same gate as hive_vid. |
journey_id, UTM tags | sessionStorage | First-party | Notes which campaign link brought you here and groups one shopping visit | Browser session | Non-essential (analytics). Same gate. |
| Stripe cookies | Cookie | Stripe (third party), on Stripe's checkout pages only | Payment, fraud prevention, authentication | Set by Stripe; see https://stripe.com/privacy and Stripe's cookie policy | Strictly necessary for payment (Stripe controls these) |
6A. Analytics (first-party, optional)
What it is. We measure how people use Print3d Hive so we can fix broken pages and improve shopping. We run this ourselves, on our own servers. There are no third-party analytics tools, no ad pixels (no Meta, Google or similar tags), no session recording or replay, and no keystroke or form capture. We don't try to identify you from your device's characteristics ("fingerprinting").
When it runs. Only if you choose "Allow optional cookies" and your browser is not sending Do Not Track or Global Privacy Control. If you choose "Later," decline, or send DNT or GPC, we send no analytics events from your browser and set no analytics identifier.
What we record when it runs:
- the page path you visit (without the part after "?"), the page title, and the site that sent you (the domain only, such as "duckduckgo.com");
- campaign tags in a link you followed (utm_source, utm_medium and similar);
- shopping-page actions such as viewing a listing, changing a filter or sort, or leaving a page, with the item or listing ID involved;
- for searches: only the length of the search and a short scrambled code, never the words you typed;
- device type (phone, tablet or desktop), browser family, a rough screen-size band, and your browser's language and time-zone setting;
- error codes when a page breaks (no personal content);
- the random IDs
hive_vidandhive_sid(see the cookie table), and the time.
What we don't record: your IP address (we use it for a moment to filter out bots, then discard it; it's never stored with analytics), your precise location, your name, email, phone, street address, messages, or anything you type into forms. On the shipping-address, checkout and payment steps we only note that you reached a step (for example, "opened shipping address"). We record nothing you enter or click there, and we never see card details.
Linking to your account. Analytics events from your browser are not linked to your Print3d Hive account.
Why (purpose). To keep the site working, find errors, measure which pages and listings help people find and buy what they need, and separate real visitors from bots. We don't use analytics to make decisions about you, set your prices, or show you ads.
How long. Raw analytics events are deleted automatically 90 days after they're recorded. After that we keep only totals (for example, "1,240 page views on Oct 3") that can't be linked to any person or browser. The hive_vid identifier on your device expires within 13 months.
Who can see it. Only Print3d Hive staff with analytics access. We don't give analytics data to makers, other users, or outside companies, except as required by law (§5.5).
Older analytics. From July 4 to October 9, 2026, an older version of our site analytics collected page views and similar events, such as clicks, from visitors to our site. That included some visitors who had not accepted optional cookies, which is not what this policy said at the time. For signed-in visitors it could link those events to their account, and it recorded the browser's user agent (a short description of your browser and device). We turned it off on October 9, 2026 and deleted all of that data on October 9, 2026. Remaining copies in our encrypted backups are automatically removed by October 23, 2026.
Order, payment and security records are not analytics. When you place an order, pay, or get a refund, or when a maker accepts, makes or ships your order, we keep records of those steps. We do the same for security and fraud-prevention events (sign-in attempts, rate limits, payment failures, errors). We need these records to sell to you, pay makers, prevent fraud, handle disputes, and meet tax and accounting law, so we keep them whether or not you accept optional cookies or send DNT or GPC. They're kept as described in §7. If you've opted out of analytics (by not accepting, or with DNT or GPC), we do not link these records to your browsing history, and we never use them for advertising or profiling.
7. Retention
We retain information as long as needed for the purposes above, including:
- Account data while the account is active and for a reasonable period after deletion requests or inactivity (backups, legal holds, fraud prevention);
- Order and payment records as required by tax, accounting, and payment-network rules (often multiple years);
- Legal acceptance logs for the duration needed to evidence consent and resolve disputes (often for the life of the account plus a multi-year limitation period);
- Analytics events: deleted 90 days after collection. Totals that can't identify anyone may be kept longer.
- File download records (§3.2): kept 2 years from the download, then deleted automatically. Download totals that can't identify anyone may be kept longer.
- Survey answers (§3.5): signed-in answers are kept while your account exists and are deleted or anonymized when you delete your account. Guest answers are anonymous from the start; the duplicate-check code stored with them is deleted after 30 days.
- Survey email opt-in records: kept while you're opted in and for 3 years after you opt out, so we can show we had permission and honor your choice.
- Server and security logs (web access logs and rate-limit records, which contain IP addresses): web access logs are kept 100 days, code-hosting logs 90 days, mail-server logs about 4 weeks, and system logs 100 days. App container logs are capped by size and the oldest entries are overwritten first. We keep logs longer only when they're needed to investigate a specific security incident, fraud or legal claim.
- Order and payment records: the IP address and browser type recorded with an order are kept for 4 years after the order closes. Order stubs anonymized after that point are kept for 7 years. Money records (payments, refunds, payouts, tax) are kept for 7 years.
When you delete your account we remove or anonymize your profile. We keep order, payment, tax, payout and agreement records for 7 years, and full shipping addresses until 180 days after delivery, because the law and dispute handling require it. After that we delete or anonymize them. When you accept our Terms or other agreements we record the date, the version you accepted, your IP address and browser type as proof of agreement. We delete the IP address and browser details 4 years after your account closes.
When we delete or anonymize, residual copies may remain in backups for a limited time.
8. Security
We implement reasonable administrative, technical, and organizational measures (access controls, hashed credentials, signed cookies, transport encryption where configured). No method of transmission or storage is 100% secure. You use the Service at your own risk regarding residual security risk. Notify us promptly of suspected account compromise.
9. Your choices and rights
Depending on your location, you may have rights to:
- Access, correct, or delete personal information;
- Export a copy;
- Object to or restrict certain processing;
- Withdraw consent where processing is consent-based;
- Appeal a denial (certain U.S. states);
- Lodge a complaint with a supervisory authority (EEA/UK).
9A. Your privacy rights (including Colorado)
Categories we process: identifiers (account ID, email, handle, the random analytics IDs); commercial information (orders, payments, shipping); internet activity (analytics events, only with your consent); approximate location (shipping address and ZIP you give us; browser time zone); user content (listings, designs, messages); legal acceptance records; file download records (§3.2); optional survey answers (§3.5). Purposes are listed in §4 and §6A. We share personal data only with the recipients in §5, by category: service providers (hosting, email, payment, shipping, maps, security), the maker who fulfils your order (name, shipping address and order details), and authorities where the law requires.
We don't sell personal data, we don't process it for targeted advertising, and we don't profile you in ways that produce legal or similarly significant effects.
Your rights. Depending on where you live (including Colorado), you can ask us to: confirm whether we process your personal data and get access to it; correct it; delete it; get a copy in a portable, machine-readable format; and opt out of sale, targeted advertising and profiling. We don't do any of those three today, but you can still record your opt-out. Some records must be kept even after a deletion request (order, tax and fraud records; see §7). We'll tell you which, and why.
How to ask. Email privacy@print3dhive.com or legal@print3dhive.com from the email on your account, or include your public handle. This includes requests to see or delete your download records and survey answers. Because guest answers aren't linked to anyone, we can't find or return them for a specific person. We may ask you to confirm your identity. Authorized agents must show written permission. The first request in any 12 months is free.
When we'll answer. Within 45 days. If we need more time, we'll tell you why within those 45 days and may take up to 45 more.
Appeals. If we decline your request, our reply will say why and how to appeal. To appeal, reply to that email or write to privacy@print3dhive.com with "Appeal" in the subject. We'll answer within 45 days, or tell you within those 45 days if we need up to 60 more, and explain our decision in writing. If you're not satisfied, you can contact the Colorado Attorney General at https://coag.gov/file-complaint/ (or your own state's attorney general).
Global Privacy Control and Do Not Track. We honor both automatically. If your browser sends a GPC signal (Sec-GPC: 1) or DNT (DNT: 1), we treat it as your opt-out of sale and targeted advertising (we do neither anyway), and as a choice to turn off all optional analytics for that browser. If you're signed in when we receive GPC, we also apply the opt-out to your account. We keep honoring it until you change your choice. GPC is the universal opt-out mechanism recognized by the Colorado Attorney General.
Account self-service: profile and some data can be edited in-product. Deletion requests may be limited where we must retain data for law, security, or outstanding orders.
Marketing: opt out of non-essential marketing emails via unsubscribe links (transactional mail may continue).
10. Children
The Service is not directed to children under 13 (or 16 in some regions). We do not knowingly collect personal information from children. If you believe a child provided data, contact us to delete it.
11. International transfers
We may process data in the United States and other countries where we or our processors operate. Those countries may have different data-protection laws than your home country. Where required, we use appropriate transfer mechanisms (e.g., standard contractual clauses).
12. Pseudonymity and legal process
Public handles are designed to reduce casual identification. We may still hold email, OAuth IDs, IPs, payment records, and shipping data that can identify you. We may disclose information in response to valid legal process. Marketing statements about privacy do not limit lawful process or this Policy.
13. Automated decision-making
We may use automated systems for fraud prevention, ranking, spam detection, and recommendations. These are not intended to produce legal effects solely by automated means without human involvement where law requires human review.
14. Changes to this Policy
We may update this Policy by posting a new version and document version string. Material changes may require renewed acceptance. The “Effective date” and “Document version” at the top state the current version.
Changes on 2026-10-17: added file download records (2-year retention), optional build surveys and survey emails (opt-in only), public counts on listings, two download cookies, and a way to remove a Make, which hides it right away.
15. Relationship to Terms; liability
This Policy is informational and contractual as incorporated by the Terms. Disclaimers and limitations of liability in the Terms apply to privacy-related claims to the maximum extent permitted by law, except where privacy statutes prohibit limitation.
16. Contact
Privacy requests and questions: privacy@print3dhive.com, or the contact form at print3dhive.com. Operator: LeonardShopping L.L.C. d/b/a Print3d Hive.
BY USING THE SERVICE OR ACCEPTING OUR TERMS, YOU ACKNOWLEDGE THIS PRIVACY POLICY.
Questions? See the About page contact channels.