Version 1.0, effective 11 October 2026.
We sell downloadable 3D kits. That needs an e-mail address, a payment and an invoice — and almost nothing else. This page says exactly what we hold, why, for how long, and who else sees it.
1. Who is responsible
R INVEST (societe par actions simplifiee (SAS)), 8 rue Isaac Newton, 93150 Le Blanc-Mesnil, France, RCS Bobigny 912 713 682, trading as Orbifex, is the controller of the personal data described here.
Write to support@orbifex.studio for anything on this page. A human reads it.
2. What we collect, and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| E-mail address | to send your order confirmation, your download links and your invoice | performance of the contract | while your account exists; 10 years in the invoice |
| Name, and company name and VAT number if you give them | to issue a valid invoice | legal obligation | 10 years (French accounting law) |
| Billing country | to apply the right VAT rate and to evidence it | legal obligation | 10 years |
| Order contents, amount, date | to run the sale, your downloads and your support requests | performance of the contract | 10 years |
| Account password | so you can reach your downloads | performance of the contract | while your account exists (stored hashed, never readable) |
| Download records (which file, when, how many times) | to apply the license and spot a shared link | performance of the contract and our legitimate interest in preventing abuse | 3 years |
| IP address at order and at download | to evidence your consent at checkout, to apply VAT rules, and for security | legal obligation and legitimate interest | 3 years |
| Your messages to support | to answer you, and to find the thread again if you write back | performance of the contract and legitimate interest | 3 years after the last message |
We do not collect or hold: your card number (Stripe does, we never see it), your date of birth, your postal address unless you choose to put one on your invoice, or anything about you from a third party.
We do not use your data to profile you, we take no automated decision about you, and we do not sell, rent or share your data for anyone else’s marketing. Ever.
3. Cookies and tracking
- Strictly necessary cookies only. Our shop uses WooCommerce cookies to remember your cart and keep you signed in, and WordPress cookies for your session. These are required for the store to work, so they do not need your consent — and that is why you do not get a cookie banner here.
- No analytics. No Google Analytics, no Meta pixel, no advertising tag, no heatmap, no session recording. Nothing of that kind is installed.
- No usage reporting to our software vendors. WooCommerce’s optional usage tracking is switched off (
woocommerce_allow_tracking = no, measured). - No external fonts or scripts loaded from someone else’s servers, so no third party learns that you visited us.
4. Who else processes your data
Only these, and only to do their job for us:
- Stripe Payments Europe, Ltd. (Ireland) — payment. Stripe is its own controller for fraud prevention and for what the law requires of a payment institution. It may transfer data to Stripe, Inc. in the United States under the European Commission’s standard contractual clauses. Stripe’s privacy policy: https://stripe.com/privacy
- OVH SAS (France) — hosting. The store, its database and our e-mail run on a server located in France.
Our order e-mails and invoices are produced on our own server. We use no mailing platform, no CRM, and no third-party invoicing service.
If a public authority ever makes us hand over data, we will say so unless the law forbids it.
5. Server logs
Our hosting panel keeps web access logs in a rolling window of ten files, each rotated at 10 MB. We do not read them except to investigate an incident, an outage or an abuse of a download link.
6. Your rights
Under the GDPR you may ask us to:
- see the data we hold about you, and get a copy;
- correct anything inaccurate;
- delete your data — we will, except for what invoicing law makes us keep for 10 years;
- restrict or object to a processing based on our legitimate interest;
- port your data to you or to someone else in a machine-readable file;
- withdraw consent, where we asked for it (the only case is a mailing list, if you joined one).
Write to support@orbifex.studio. We answer within one month. We will ask you to confirm that the request comes from the owner of the account — never by sending us an identity document unless there is a real doubt.
You can also complain to your national data protection authority. In France that is the CNIL (cnil.fr).
7. Your account, and deleting it
You do not need an account to buy: checkout as a guest works, and your links go to your e-mail. If you do have one, you can ask us to delete it at any time; we keep only the invoice data the law requires, and your download links stop working.
8. Children
Our kits are professional tools and our store is not aimed at children. We do not knowingly collect data about anyone under 16.
9. Security
HTTPS everywhere, with a certificate renewed automatically. Passwords are stored hashed. Kit files sit outside the public web root and are served only after your order is verified, so a download link cannot be guessed. The database and the files are backed up nightly, encrypted, with the decryption key held off the server.
10. Changes
If we change this policy we will change the date at the top, and we will tell account holders by e-mail if the change matters to them.