Privacy Policy

1. Data controller

The data controller for personal data processing is:

Paolo Spada
Email: [email protected]
Website: stimalo.com

2. Data we collect

Stimalo collects the following data:

2.1 Data you provide

• Account registration: email address, name (optional), password (stored as irreversible hash)
• Profile data (optional): business name, VAT number, address, certified email, e-invoicing code — provided voluntarily by users to personalize quote PDFs
• Usage data: configured printers, materials, quotes, jobs, clients — all data entered by the user in the management tool

2.2 Data collected automatically

• Technical cookies: required for site functionality (login session). No consent required.
• Live chat support (Chatwoot self-hosted): we use Chatwoot, an open-source live chat platform, self-hosted on our own servers. When you open the chat widget, technical cookies and local storage are used to maintain your conversation session. If you're logged in, your name and email are passed to identify you in the conversation. Chat data (messages, contacts, conversation logs) stays on our servers and is never shared with Chatwoot Inc. or third parties. Legal basis: legitimate interest (art. 6.1.f GDPR) for support functionality.
• Matomo Analytics (cookieless, no consent): we use Matomo, a self-hosted web analytics platform on our own servers. Matomo is configured in cookieless mode — it doesn't store cookies on your device, doesn't track you across sessions and doesn't identify you personally. It only collects aggregated, anonymous data (pages visited, device type, country). This processing falls under legitimate interest (art. 6.1.f GDPR) as recognized by France's CNIL. Data stays on our servers and is not shared with third parties.
• Google Analytics (consent required): anonymized navigation data (pages visited, session duration, device, approximate geographic origin). No personally identifiable data is collected via Analytics. This service uses third-party profiling cookies and is activated only after your explicit consent.
• Google Analytics — server-side events (consent required): in addition to cookie tracking, Stimalo sends Google Analytics certain conversion events directly from our server via Google's Measurement Protocol, e.g.: registration completed, first quote, Pro subscription activation, subscription cancellation. These events are transmitted only with your analytics consent via the cookie banner and contain only a pseudonymous identifier (the same GA client ID used by cookies) and event technical parameters (e.g. transaction amount, currency). No directly identifying data (email, name, address) is ever transmitted.
• Cloudflare: the site is protected by Cloudflare, which may collect access logs (IP address, user agent) for security and DDoS protection. Cloudflare acts as data processor. Cloudflare privacy policy

3. Purposes of processing

• Service delivery: managing your account, storing your data (printers, quotes, jobs), generating PDFs — legal basis: contract performance (art. 6.1.b GDPR)
• Security: anti-bot protection (Cloudflare Turnstile), email OTP verification — legal basis: legitimate interest (art. 6.1.f GDPR)
• Statistical analysis: understanding site usage via Google Analytics to improve the service — legal basis: consent (art. 6.1.a GDPR)
• Service communications: OTP emails for account verification and password reset, welcome emails — via Resend.com — legal basis: contract performance
• AI-powered features (Pro only, on-demand): some Pro features (invoice scanning, automatic descriptions, anomaly classification) use Groq Inc. (USA) AI services. Only the data you explicitly submit for the AI request is sent. Personal identifiers are stripped before transmission when possible. Groq does not retain or train its models on your data. Legal basis: contract performance for Pro users (art. 6.1.b GDPR).
• Marketing and promotional emails: occasional emails about new features, product updates, tips. Always opt-out via the unsubscribe link in every email or from your profile. Legal basis: legitimate interest (art. 6.1.f GDPR), with right to object at any time.
• Aggregate market analysis: Stimalo collects operational data (printer models used, material types, print hours, average quote values) and processes them in completely anonymous and aggregated form, decoupled from user identity, to generate statistical reports, industry analysis and market trends. Such aggregated, anonymous data may be shared with commercial partners or third parties. Single users cannot be identified from this data — legal basis: legitimate interest (art. 6.1.f GDPR)

4. Data retention

• Account data: retained until the user deletes the account, or until automatic deletion for inactivity (see below)
• Inactive accounts: verified accounts that don't log in for 365 consecutive days are deleted automatically, with email notice 30 days before deletion. Users can prevent deletion simply by logging in. Accounts with unverified email are deleted 30 days after registration
• Navigation data (Google Analytics): retained for 14 months (GA4 default), then automatically deleted
• OTP codes: expire after 10 minutes and are invalidated after use
• Security logs (Cloudflare): per Cloudflare's policy

5. Data sharing and processors

Your personal data is never sold or shared with third parties for commercial purposes. Data is accessible only to the following technical processors, necessary for service operation. All processors listed below are bound by contractual data processing terms (DPA / Standard Contractual Clauses where applicable):

Processor	Country	Purpose	Legal basis transfer
Cloudflare Inc.	USA	CDN, DDoS protection, DNS, reverse proxy	EU-US DPF + SCC
Resend Inc.	USA	Transactional & marketing emails (OTP, notifications)	SCC
Google LLC	USA	Analytics (consent only)	EU-US DPF
Stripe Inc.	USA / Ireland	Payment processing for Pro subscriptions	EU-US DPF + SCC
Groq Inc.	USA	AI inference for Pro features (invoice scanning, descriptions)	SCC

Data transfer to the USA is covered by the EU-US Data Privacy Framework for certified services and by Standard Contractual Clauses (SCC) as fallback. Adequacy decision and transfer impact assessment have been considered.

Self-hosted services (no third-party processor): Matomo Analytics and Chatwoot Live Chat run on our own servers. Their respective vendors (Matomo, Chatwoot Inc.) do not have access to the data processed through these services. Data never leaves our infrastructure.

5.1 Aggregated and anonymous data

Stimalo may generate and share with third parties (printer manufacturers, material suppliers, commercial partners) statistical reports based on completely anonymous and aggregated data, e.g.: most used printer models, popular materials, average print times, quote price ranges. This data contains no personal information and cannot be used to identify individual users in any way.

6. Your rights (GDPR)

You have the right to:

• Access: know what data we hold about you
• Rectification: correct incorrect data from your profile
• Erasure: delete your account and all associated data from the Profile page
• Portability: download all your data in JSON format from the Profile page
• Withdraw consent: revoke Analytics cookie consent at any time by clicking "Manage cookies" in the footer
• Objection and restriction: contact us at [email protected]
• Lodge a complaint: you may file a complaint with the Italian Data Protection Authority (Garante) or with the supervisory authority of your country of residence within the EU

To exercise these rights you can use the integrated functions in your profile or contact us via email. We will respond within 30 days.

7. Cookie

Stimalo uses 4 categories of cookies. You can change your choice anytime by clicking Manage cookie preferences here or in the site footer.

7.1 Strictly necessary cookies (no consent required)

These cookies are required for the site to function: login, session security, your consent choice. They cannot be disabled.

Name	Purpose	Duration
session	Flask login session, CSRF protection	Browser session
remember_token	"Remember me" persistent login	30 days
cc_consent	Stores your cookie choice (4 categories)	1 year

7.2 Functional cookies (consent required)

Remember your preferences and enable the support chat widget.

Name	Purpose	Duration
lang	Language preference (IT/EN)	1 year
cw_conversation	Chatwoot live chat session (only if you open the chat widget)	1 year

7.3 Statistics / Analytics cookies (consent required)

Anonymous usage data. Help us understand how Stimalo is used and improve it. Matomo is self-hosted, cookieless, IP-anonymized and (per EU CNIL guidance) does not require explicit consent; we list it here for transparency. The other items require explicit consent.

Name	Service	Purpose	Duration
_ga, _ga_*	Google Analytics 4	Distinguish unique users, traffic analysis	2 years
stimalo_utm	First-touch attribution	UTM marketing source/medium/campaign for analytics	30 days
stimalo_vid	Internal AdsLanding (server-side)	Unique landing-page visitor dedup (UUID, no PII)	90 days
none (server-only)	Matomo (self-hosted)	Cookieless, IP-anonymized analytics	—

7.4 Marketing cookies (consent required)

Measure the effectiveness of advertising campaigns on Meta (Facebook/Instagram) and Google Ads. We never sell personal data; CCPA opt-out is honored.

Name	Service	Purpose	Duration
_fbp	Meta Pixel	Facebook/Instagram ads conversion measurement	90 days
_gcl_*	Google Ads	Google Ads conversion tracking	90 days

7.5 Consent record (audit log)

Every time you make a choice in the cookie banner we save a record (timestamp, IP hash truncated to 32 chars, abridged user agent, chosen categories) to demonstrate, in case of audit, when and what you consented to. Retained for 24 months (GDPR Art. 7.1 burden of proof).

8. Marketplace "Find a Maker"

Requesters' data

When a user requests a quote through the marketplace, we collect name and email to forward the request to the selected maker. Legal basis: pre-contractual measures (art. 6.1.b GDPR). Data is shared exclusively with the contacted maker.

Reviews

Published reviews show the name provided by the reviewer. Publication occurs with the user's explicit consent at submission.

Maker profiles

Makers who activate marketplace visibility consent to publication of: name or business name, city, province, service categories. Visibility can be deactivated at any time from the profile.

Erasure

Requesters may ask for erasure of their data by contacting [email protected].

8.1 3D files uploaded by users

Stimalo gives separate protection commitments for 3D files (G-code, 3MF, STL, OBJ, STEP) depending on context, documented in detail in the Stimalo Protocol:

• Personal files (cost calculator): G-code and 3MF files you upload to pre-populate the calculator (time, weight, materials) are processed in memory and never saved on the server disk. They disappear immediately after parsing. Only metadata for parser debugging (file size hash, extension, parse outcome) is logged — never the file content.
• Marketplace files (client→maker): STL/3MF/OBJ/STEP files uploaded by clients to request a quote from a specific Italian maker are stored temporarily and accessible only to the maker the client chose. Auto-deletion occurs 7 days after the related job is marked "completed" or 60 days after request creation if never closed — whichever comes first. Both client and maker can trigger immediate manual deletion via the "Delete file now" button in the request page.
• No AI training: 3D files are never used to train AI models, neither ours nor those of our processors (Groq Inc. confirms in writing they don't retain or train on data sent via their API).
• No backups: 3D files are excluded from server backups. When deleted, they disappear from the system and there is no recovery path — by design.
• NDA: for companies needing formal documentation of confidentiality (industrial parts, IP-sensitive prototypes), a bilateral Non-Disclosure Agreement is available on request at [email protected].

9. International users (non-EU residents)

Stimalo serves users worldwide. Although the data controller is based in Italy and primarily complies with the EU GDPR, we recognize and respect the privacy rights granted by other jurisdictions. The rights described below are extended to all users globally, regardless of their location.

California residents (CCPA / CPRA)

If you reside in California, USA, you have the right to: know what personal information we collect, delete it, correct it, opt-out of the "sale" or "sharing" of personal information (we don't sell or share it for cross-context advertising), and not be discriminated against for exercising your rights. We do not sell personal information for monetary compensation. Contact [email protected] to exercise these rights.

Do Not Sell or Share My Personal Information
Click here to opt out of any "sharing" of personal information for cross-context advertising (Meta Pixel, Google Ads), as defined by the CPRA: Manage my privacy preferences →

Global Privacy Control (GPC): we honor the Global Privacy Control browser signal as a legally binding opt-out preference. If your browser (Firefox, Brave, DuckDuckGo, or extensions like Privacy Badger) sends the Sec-GPC: 1 header, Stimalo automatically applies "Reject all" for statistics and marketing categories on first visit — no further action required. Your choice in the banner, if any, always overrides GPC.

Brazilian residents (LGPD)

Brazilian users (Lei Geral de Proteção de Dados, LGPD) have rights aligned with GDPR: confirmation of processing, access, rectification, anonymization/deletion, portability, information about sharing, revocation of consent. Contact us at the email above.

Canadian residents (PIPEDA)

Under the Personal Information Protection and Electronic Documents Act, Canadian users have the right to access their personal information, request correction, and withdraw consent.

UK residents (UK GDPR)

UK users are covered by UK GDPR, which grants substantively the same rights as EU GDPR. The supervisory authority is the Information Commissioner's Office (ICO).

Other jurisdictions

If your country has specific data protection laws not listed above (e.g. Australia's APP, Japan's APPI, South Africa's POPIA), the rights described in this policy apply by default. Contact us if you wish to exercise specific rights under your local law.

10. Changes

This privacy policy may be updated periodically. The last update date is shown at the top of the page. In case of substantial changes, we will notify users via the site or email.

11. Contact

For any question regarding the privacy of your data:
Email: [email protected]