Privacy policy

Last updated 2 November 2026

The short version

Your models, images, text, QR codes and project files stay in your browser. They are uploaded only if you are signed in and choose to save a project to your account.
If you sign in, we store your email address, your credit balance, your purchases, a log of your exports and any projects you save to your account.
Payments are handled by Stripe. We never see your card details.
We use no advertising, no tracking cookies and no cross-site tracking. Our page statistics and error reports are cookie-free.

Who is responsible

The controller for your personal data is Eric Soriano, Rambla Catalunya 96, 08008 Barcelona, Spain. Contact: [email protected].

Designing (no account)

Wrapp3D runs in your browser. Models you upload, artwork, text, QR codes and textures are processed on your device. Saved projects (.wrap.json) and exported 3MF files are created on your device and downloaded directly to it. We do not receive them.

To recover your work after a refresh or crash, the studio keeps your latest design in your browser's own storage (IndexedDB) on this device. It never leaves the device, and you can remove it by clearing this site's data in your browser.

Accounts and export credits

Signing in is only needed to buy and spend export credits and to save projects to your account. You sign in with a link or code sent to your email address; there is no password. For this we store, with our database and authentication provider Supabase:

Your email address and account records kept by the sign-in system (such as when you signed in, and the IP address and browser used for sign-in requests, for security).
Your credit balance.
Your purchases: the Stripe Checkout session reference, the number of credits, the amount paid, the currency and the date.
Your export log: the date of each export, the name of the model as shown in the studio (for example your file name or “Studio vase”), whether a credit was charged, and a fingerprint (SHA-256 hash) of the exported file. The fingerprint lets you download the same file again for free within 24 hours; the design cannot be reconstructed from it.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Sign-in emails are sent by Supabase. Supabase hosts this data in the EU (Ireland).

To keep you signed in, your browser stores a sign-in session in its local storage for this site. It is not a cookie, is not used for tracking, and is removed when you sign out.

Projects you save to your account

When you are signed in and choose Save to my projects, we store that project with Supabase so you can reopen it on any device: the full project file (your model, images, text, QR codes, textures and settings, compressed) in private storage, plus a list entry with the project name, the model name, the file size, a small preview image and the dates it was created and changed. Only your account can read these files; we do not look at them except when you ask us to for support or when the law requires it. You can keep up to 50 projects. Projects are uploaded only when you save them there; nothing is uploaded automatically.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Deleting a project in My projects removes its file and list entry.

Payments

Credit packs are paid through Stripe Checkout, which opens on Stripe's own pages. Stripe processes your payment details and email address as an independent controller under its own privacy policy. We receive confirmation of the payment, the amount and a session reference, never your card details. Purchase records are kept for six years because Spanish commercial and tax law requires it (Art. 6(1)(c) GDPR).

Page statistics and error reports

When enabled, we use:

Cloudflare Web Analytics to count page views, referrers, countries and page load times. It sets no cookies, stores nothing on your device and does not track you across sites or visits. See Cloudflare's privacy policy.
Sentry to receive reports when the app hits an error, for example a failed export or checkout. A report contains the error message, where in our code it happened, the page address, and your browser and operating system. It never contains your designs or models, and email addresses are removed in your browser before a report is sent. We have configured Sentry not to store IP addresses. See Sentry's privacy policy.

Legal basis: our legitimate interest in a working, reliable service (Art. 6(1)(f) GDPR). Neither tool uses cookies, so no consent banner is shown.

Hosting and libraries

The site is served by Cloudflare. Where accounts are available, the sign-in library (supabase-js) is loaded from the jsDelivr CDN when the page opens. Like any web server, these providers process your IP address to deliver the files and protect against abuse.

Transfers outside the EU/EEA

Some of these providers (Cloudflare, Stripe, Sentry, Supabase, jsDelivr) are based in, or may process data in, the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

How long we keep data

Account data, your balance, your export log and your saved projects are kept while you have an account (a project until you delete it). If you ask us to delete your account, we delete it, including all saved projects, within 30 days, except purchase records we must keep by law. Error reports are deleted after 90 days.

Your rights

You can ask for access to, correction or deletion of your data, restriction of or objection to its processing, and a copy in a portable format. Email [email protected] from the address you sign in with. You may also complain to a data protection authority, in Spain the Agencia Española de Protección de Datos (aepd.es).

Changes

We will update this page when what we collect changes, and change the date at the top.