Fabricate Privacy Policy

Effective date: 2026-05-05 Version: 4 Jurisdiction: United Kingdom (UK GDPR + Data Protection Act 2018)

1. Who we are and our role

Fabricate is operated by HELIXDREAMSCO LTD (Company Number 17158644), a private limited company registered at 26 Watermint Quay, Craven Walk, London, N16 6DD, United Kingdom.

For the personal data described in this policy, HELIXDREAMSCO LTD is the data controller, except where this policy expressly states that another organisation (such as Stripe Identity) acts as a separate or independent controller for a specific operation.

We are registered with the UK Information Commissioner's Office under registration ZC135824.

For any data-protection query — including access, rectification, erasure, portability, restriction, objection, or complaint — contact privacy@helixdreams.co.

We are not currently required to appoint a Data Protection Officer (DPO) under Article 37 of the UK GDPR. The privacy@ inbox is monitored as our designated data-protection contact.

2. Scope of this policy

This policy explains how we handle personal data of:

• Creators — people who upload files and post 3D-printing jobs.
• Makers — people who own 3D printers and accept those jobs.
• Visitors — anyone who lands on a Fabricate page without signing in.

It does not cover the privacy practices of third-party sites linked from Fabricate, or the practices of the other party to a job once data has been shared with them under clause 8 below — though we do impose contractual minimisation duties on both sides (see clause 8 and our Terms §13).

3. What we collect

We do not knowingly collect any special-category personal data under Article 9 of the UK GDPR (health, race, religion, biometric data for unique identification, etc.). The Stripe Identity flow involves biometric processing for authentication, but this is conducted by Stripe as a separate independent controller — we do not receive the biometric raw data and do not perform identification ourselves.

4. Lawful bases under UK GDPR

We process your personal data on the following lawful bases (Article 6 UK GDPR):

You have the right to object to any processing based on legitimate interests; see clause 11.

5. Stripe Identity — controller relationship

When you go through identity verification at /maker/verification, you are redirected to a Stripe-hosted page. For that flow, Stripe Payments Europe Ltd ("Stripe") acts as an independent data controller, not as our processor. The privacy policy you accept on Stripe's hosted page is theirs, not ours.

What flows back to us via webhook is only the verified outcome — verification status (verified / requires_input / canceled), the document type accepted, the verified legal name, the verified date of birth, and the verified address. We never receive:

• the photograph or video of you taken during the selfie/liveness step;
• a scan or copy of your passport / driving licence;
• the biometric template Stripe uses internally;
• raw OCR output.

If you want a copy of, or to erase, the underlying biometric data, you must contact Stripe directly — we cannot action it.

6. Cookies and similar technologies

We use the minimum cookies necessary for the platform to work:

We do not use:

• advertising cookies,
• third-party behavioural-tracking cookies,
• session-replay tools,
• fingerprinting libraries beyond what Stripe needs internally for fraud-scoring its own payment flows.

UK PECR (the Privacy and Electronic Communications Regulations 2003) requires consent for non-essential cookies; we don't set any, so we don't show a cookie banner. If we ever introduce non-essential cookies (e.g. for marketing), we will add a UK-compliant consent banner before doing so.

7. Pickup-address minimisation rule

Pickup is the most data-sensitive moment in the marketplace, because each party briefly needs the other's location. We therefore enforce strict minimisation:

• The Maker's pickup address (postcode + any optional pickup notes) is shared only with the Creator who has had their bid accepted on the specific job, and only at the point a pickup token is minted.
• The Creator's name and any optional shipping postcode are shared with the Maker similarly limited to the duration of that single job.
• Both parties accept (under our Terms §13) that they will not store, save, copy, share, or further process the other party's address or contact details after the transaction is complete.

This implements Article 5(1)(c) UK GDPR (data minimisation) and Article 5(1)(e) (storage limitation) at the inter-party level.

If a Maker uses Creator data for harassment, marketing, or any unauthorised purpose — or vice versa — Fabricate may suspend or close the offending account, retain evidence to defend the affected party, and pass the matter to the ICO where appropriate.

8. Who we share data with

We share personal data only as set out below. We do not sell data, do not share data with advertisers, and do not participate in any data-broker programme.

9. International transfers

We pin our primary application workloads (Cloud Run, Cloud SQL, Secret Manager) to EU/UK regions wherever the provider supports it. We have not enabled any provider feature that automatically replicates data to non-UK/EU regions.

If the UK government revokes adequacy or alters the cross-border transfer framework, we will update this section and rely on the SCCs as our default mechanism.

10. Retention

We retain personal data for as long as it serves a lawful purpose, applying the strictest of: contract performance, legal obligation, statutory limitation period for claims (six years in England under the Limitation Act 1980), or legitimate interests balanced against your rights.

You can ask us to delete data sooner where we no longer have a lawful basis (see clause 11 — Right to erasure).

11. Your rights under UK GDPR

You have the following rights with respect to personal data we hold about you:

• Right of access (Art. 15) — a copy of the personal data we hold about you, plus the metadata required by the Article (purposes, recipients, retention, your rights).
• Right to rectification (Art. 16) — correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — deletion where we no longer have a lawful basis. Note that data we are obliged to retain (e.g. tax records, dispute defence within the limitation period) may be retained even after an erasure request, with all other processing stopped.
• Right to restriction (Art. 18) — pause processing while a dispute about accuracy or basis is resolved.
• Right to data portability (Art. 20) — a copy in a structured, commonly used, machine-readable format (JSON or CSV) for data we hold under a contract or consent basis.
• Right to object (Art. 21) — object to processing based on legitimate interests, including profiling.
• Right to withdraw consent at any time, where we rely on consent.
• Right not to be subject to automated decisions with legal or similarly significant effect (Art. 22) — we do not currently make any such decisions; if we ever introduce them (e.g. fraud-scoring with legal effect), we will document the safeguards.

How to exercise these rights: email privacy@helixdreams.co with a clear description of the right you want to exercise. We respond within one calendar month (Article 12(3)), extendable by two further months for complex requests.

We may need to verify your identity before responding — typically by confirming the email matches a Fabricate account or by asking for an in-app confirmation token. We use the minimum information needed for that check.

There is no fee, except where the request is manifestly unfounded or excessive (Article 12(5)), in which case we may charge a reasonable fee or refuse — and we'll tell you why.

If you're not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

12. Children

The platform is not for use by anyone under 18. By using Fabricate you confirm you are 18 or older. If we become aware that a user is under 18, we will close the account and delete personal data we are not legally required to retain.

13. Security

We protect data using:

• TLS 1.2+ in transit on all customer-facing endpoints;
• at-rest encryption on hosted databases (Cloud SQL) and object storage (Cloud Storage), using provider-managed keys;
• secrets (API keys, database passwords, OAuth client secrets, webhook signing secrets) stored in Google Secret Manager with versioning, audit logging, and IAM-scoped access;
• JWT-based session tokens with rotation on legal-document re-acceptance and on suspicious activity;
• Stripe Identity for KYC so we never handle passport / driving-licence images directly;
• Workload Identity Federation for our deploy pipeline (no long-lived JSON service-account keys).

No system is impenetrable. You should not rely on the platform to store files or data you cannot afford to lose.

14. Breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms (Article 33 UK GDPR), we will notify the Information Commissioner's Office within 72 hours of becoming aware. Where the risk to you is high, we will notify you directly without undue delay (Article 34) — by email to your account address and via in-app notification. Our breach-response process is reviewed annually.

15. Account closure and data deletion

You may close your Fabricate account at any time by emailing support@helixdreams.co.

On closure:

• your profile becomes inactive immediately;
• pending disputes, payouts, refunds, and legal holds are completed before deletion;
• data we are legally obliged to retain (tax records, identity-verification metadata, dispute records) is retained for the periods listed in clause 10;
• everything else is deleted within 30 days of closure where practicable.

Once the legally-mandated retention periods expire, the remaining data is deleted automatically.

16. Marketing

We do not currently send marketing email, run mailing lists, or use third-party marketing tools. The transactional emails you receive (bid placed, bid accepted, pickup ready, etc.) are sent under contract performance and cannot be opted out of without rendering the platform unusable.

If we ever introduce optional marketing communications, they will be opt-in only, and you will be able to withdraw consent at any time via a one-click link in the email or via your /account/notifications preferences page.

17. Changes to this policy

We may update this policy. When we do — for any change that materially affects your rights or our processing — we'll bump the version number at the top, post the new text at /privacy, and require you to re-accept on your next visit before continuing to use the platform. Minor editorial corrections (typos, broken links) may be made without a re-acceptance trip.

The full version history is available on request via privacy@helixdreams.co.

18. Contact

• All data-protection queries, subject-access requests, complaints: privacy@helixdreams.co
• General support: support@helixdreams.co
• ICO complaints: ico.org.uk · 0303 123 1113