Privacy Policy

Last updated: 31 August 2026

This Privacy Policy explains what Mold Studio (moldstudio.app) collects, why, how long we keep it, and your rights under the GDPR and similar laws. By using the Service you acknowledge this policy.

1. Who we are

Mold Studio is the controller for personal data described here. Contact: support@moldstudio.app.

2. What we collect

• Email address — when you create an account, purchase via Lemon Squeezy (passed to us for licence fulfilment), recover a licence key, or subscribe via our Brevo newsletter form.
• Licence / credit data — licence keys, remaining credits, Lifetime flag, and related purchase metadata needed to unlock paid features.
• Uploaded STL files and generated mold STLs — see section 3.
• Generation metadata — for example mold type/settings, file size, triangle counts, success/error codes, approximate timing, and an anonymous session or attempt ID (not the 3D mesh itself in our analytics tables).
• Product analytics events — page views, upload, generate, download, and similar funnel events tied to a browser session ID.
• Technical data — IP address and user-agent as processed by our host and analytics providers; optional device hints we log for debugging (browser, OS, coarse device memory).

3. Uploaded STL files (how we store and use them)

When you upload an STL in the app, the file is written to our application storage on the server that runs Mold Studio (currently hosted on Railway). We keep that file so the mold pipeline can read it, repair or simplify the mesh if needed, run boolean operations, and write the resulting mold STL(s) to the same storage so you can download them. Guest uploads and outputs live under guest folders; signed-in users under their account folder.

We use uploaded and generated files only to provide the Service you requested, to debug failed generations, and to improve mold quality and reliability. We do not sell your models, do not use them to train public AI models, and do not share the mesh files with advertisers or unrelated third parties.

Retention: Uploaded STLs and generated mold STLs are retained for up to 30 days after upload or generation, then deleted from our storage. If a file is clearly needed longer for an active support case you opened, we may keep it until that case is closed, then delete it. Generation metadata (without the mesh file) and anonymised analytics may be kept longer for product metrics and security.

You can ask us to delete your uploaded and generated files sooner by emailing support@moldstudio.app with enough detail to find them (approximate time, filename, licence email if any).

4. Third parties we use

• Lemon Squeezy — Merchant of Record for payments and licence fulfilment; processes purchase and billing data under their privacy policy.
• Google Analytics (GA4) — used on the app to understand traffic and product usage (measurement ID configured in the app).
• Brevo — optional newsletter / waitlist form and related cookies or storage when you open or submit that form.
• Railway — hosting for the web application, database, and file storage.
• Resend (when configured) — transactional email for licence-key recovery.

These providers process data only as needed to deliver their service to us. Payments are processed by Lemon Squeezy, our authorised reseller and Merchant of Record.

5. Cookies and similar storage

• Essential / preference: theme preference in localStorage; session identifiers for analytics and generation tracking; licence key you paste may be stored locally in your browser so you do not re-enter it.
• Google Analytics: may set cookies or use similar identifiers as described in Google’s documentation.
• Brevo: a first-party cookie may record that you dismissed the newsletter popup so it does not reappear immediately.

You can clear cookies and site data in your browser. Blocking analytics cookies may limit our ability to measure usage but will not block core mold generation.

6. Legal bases (GDPR)

Where the GDPR or UK GDPR applies, we process personal data on these bases:

• Contract / steps prior to contract — running the Service you request (upload → generate → download), fulfilling purchases and licences.
• Legitimate interests — securing the Service, debugging failures, understanding aggregate product usage, and preventing abuse, balanced against your rights.
• Consent — where required for non-essential cookies/analytics or newsletter signup (you may withdraw consent at any time).
• Legal obligation — where we must retain records for tax, accounting, or lawful requests.

7. Your rights and data deletion

Depending on where you live, you may have rights to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. To exercise these rights or request deletion of your email, licence records we control, analytics linked to a known session, or STL files still on our servers, email support@moldstudio.app. We will respond within a reasonable time (and within one month where GDPR requires). You may also lodge a complaint with your local supervisory authority.

Purchases and invoices held by Lemon Squeezy must be addressed to Lemon Squeezy as well, since they are Merchant of Record.

8. International transfers

Our host and vendors may process data in the United States, the United Kingdom, the European Union, or other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) used by those providers.

9. Children

The Service is not directed at children under 16. Do not use it if you are under that age.

10. Changes

We may update this policy; the “Last updated” date will change. Continued use after a material update constitutes acceptance of the revised policy where permitted by law.

11. Contact

Privacy and deletion requests: support@moldstudio.app.