Privacy Policy

Last Updated: 29 September 2026 — GDPR Compliant.

1. Introduction

Only CAD Models (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you visit only-cad-models.com, how we use it, and what rights you have over it.

This policy is compliant with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable data protection laws. By using our website or services, you agree to the collection and use of information as described in this policy.

2. Data We Collect

We collect the following categories of data:

a) Data You Provide Directly

  • Email address — required to deliver your converted STEP file and send job status notifications.
  • Password — stored as an irreversible cryptographic hash (bcrypt). We never see your plain-text password.
  • Uploaded files (STL) — processed for conversion and then permanently deleted. See Section 4.
  • Feedback & ratings — optional star ratings or written feedback you submit about your conversion result.

b) Data Collected Automatically

  • IP address — collected by our server infrastructure for security and abuse prevention.
  • Browser & device information — user agent, browser type, operating system.
  • Usage data — pages visited, time spent on pages, referrer URL.
  • Cookies & tracking data — see Section 6 and our Cookie Policy.

c) Payment Data

Payment information is processed entirely by our third-party payment processor. We do not store credit card numbers, CVV codes, or any raw payment credentials on our servers.

3. How We Use Your Data

We use your data for the following purposes:

Purpose Data Used Legal Basis (GDPR)
Perform file conversion & deliver resultsEmail, uploaded fileContract performance
Account management & authenticationEmail, password hashContract performance
Send transactional emails (job status, download links)EmailContract performance
Process paymentsPayment processor dataContract performance
Improve our service & fix bugsUsage data, feedbackLegitimate interest
Prevent fraud & abuseIP address, usage dataLegitimate interest
Display personalised advertisementsCookies, usage dataConsent
Comply with legal obligationsAs requiredLegal obligation

4. Your Files & File Privacy

🔒 Our Core Privacy Promise

  • Your uploaded STL files are used exclusively for performing your requested conversion. Nothing else.
  • We do not use your files for AI training, machine learning datasets, or any form of model development.
  • Files are stored in an isolated, access-controlled server environment for the minimum time necessary.
  • Free files become eligible for deletion 24 hours after conversion completion. Pro files become eligible 24 hours after the first download request; undownloaded files remain while Pro is active. Once Pro ends, the free retention rule applies. Periodic cleanup removes eligible files; deletion may be delayed while the worker is busy.
  • Anyone with your unique job link can access that job's output while it is stored. Keep the link private.

5. Advertising & Third-Party Services

We use third-party advertising services — including Google AdSense — to display advertisements on our website. These services may use cookies, web beacons, and similar tracking technologies to show you personalised ads based on your interests and browsing history.

Third-party ad partners involved:

These third parties may independently collect data as described in their own privacy policies. We encourage you to review them.

Opt-out options:

6. Cookies

We use cookies and similar tracking technologies. For full details about the types of cookies we use and how to manage your preferences, please see our dedicated Cookie Policy.

7. Data Retention

  • Uploaded files & STEP output: Free: eligible for deletion 24 hours after completion. Pro: eligible 24 hours after the first download request, or under the free rule when Pro ends. Undownloaded Pro files remain while Pro is active. Failed jobs become eligible 24 hours after their recorded completion time, or upload time if no completion is recorded. Queued and processing jobs are retained until they finish. Periodic cleanup removes eligible files and may be delayed while the worker is busy.
  • Account data (email, password hash): Retained for as long as your account is active. Deleted within 30 days of a verified account deletion request.
  • Conversion job records (metadata only, no file content): Retained for up to 12 months for billing, fraud prevention, and service improvement purposes.
  • Server logs: Retained for up to 90 days for security monitoring.

8. Sharing of Data

We do not sell your personal data to any third party. We may share data only in the following limited circumstances:

  • Service providers: Cloud infrastructure (server hosting), email delivery services, payment processors — only as necessary to operate the service and under strict data processing agreements.
  • Legal obligations: If required by law, court order, or governmental authority.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, with equivalent privacy protections.
  • Advertising networks: Anonymous usage and cookie data shared with ad partners (e.g., Google AdSense) as described in Section 5.

9. Security

We implement appropriate technical and organisational security measures to protect your data, including:

  • HTTPS/TLS encryption for all data in transit.
  • Encrypted password storage using bcrypt hashing.
  • Isolated containerised server environment (Docker).
  • File storage accessed through unguessable job links; keep those links private.
  • Regular security monitoring and log review.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Your Rights (GDPR)

Under the GDPR and applicable data protection law, you have the following rights:

🔒 Right of Access

Request a copy of the personal data we hold about you.

✏️ Right to Rectification

Request correction of inaccurate or incomplete personal data.

🗑️ Right to Erasure

Request deletion of your personal data (“right to be forgotten”).

🚫 Right to Restrict Processing

Request that we limit how we process your data in certain circumstances.

📤 Right to Data Portability

Receive your personal data in a structured, machine-readable format.

✋ Right to Object

Object to processing based on legitimate interests, including direct marketing.

📝 Right to Withdraw Consent

Withdraw consent at any time where processing is based on consent (e.g., for personalised ads). Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection supervisory authority.

11. Children's Privacy

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with their personal data, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will post the updated version on this page with a revised “Last Updated” date. For significant changes, we may also notify registered users via email. We encourage you to review this policy regularly.

13. Contact Us

For any privacy-related questions, data subject requests, or concerns, please contact our Data Controller:

Only CAD Models — Data Controller

Website: only-cad-models.com

Privacy Email: [email protected]

General Support: [email protected]