Shapline

Privacy Policy

Last updated: 02/11/2026

Version dated November 2, 2026

Preamble

This Privacy Policy aims to inform Shapline visitors, users and customers about how their personal data is collected, used, stored, protected and, where applicable, disclosed to third parties.

Shapline is a platform selling digital products, including files for 3D printing, three-dimensional models, technical drawings, electronic schematics, computer programs and related documentation.

The protection of personal data is an essential part of Shapline's operations. Data processing is carried out in compliance with the General Data Protection Regulation (GDPR), the French Data Protection Act and other applicable provisions.

This policy applies to services offered under the shapline.com and shapline.fr domains.

It supplements Shapline's General Terms of Use and General Terms and Conditions of Sale.

Article 1 – Data Controller

The controller of personal data is the operator of the Shapline website, identified as follows:

Shapline
SIREN: 881 099 533
Address: 58, route des Rois, 02000 Urcel, France
Email address: contact@shapline.com
Website: https://shapline.com

For any questions concerning personal data or the exercise of rights provided for by the GDPR, users may contact Shapline at the email address given above.

Article 2 – Personal Data Collected

Shapline collects only the data necessary to operate its services, fulfill orders, manage user accounts, ensure platform security and comply with its legal obligations.

2.1. User account data

When someone creates a Shapline account, the following data may be collected:

Email address.
First and last name.
Username or display name, when requested.
Password in the form of a secure cryptographic hash, for accounts using conventional authentication.
Internal account identifier.
Creation date and information needed to manage the account.
Account status, including active, blocked or anonymized.
Technical information required for authentication and session security.

The password used for conventional sign-in is not stored in plain text.

2.2. Order and download data

When a user makes a purchase, Shapline may record:

The identity and billing contact details provided by the customer.
Billing address and country of residence or billing.
Order references.
Digital products ordered and their commercial characteristics.
Amounts, currencies, taxes and information required for invoicing.
Payment dates and statuses.
Technical transaction references provided by payment service providers.
Invoice numbers and dates.
Information necessary to provide and track downloads.

This information is used in particular to confirm purchases, issue invoices, provide purchased digital files and handle support requests.

2.3. Contact request data

When a user contacts Shapline, the information provided may include:

Their name or identifier.
Their email address.
The subject and content of their message.
Order references or technical information provided voluntarily.
Information necessary to process and follow up on their request.

The information collected is used only to handle the request, manage the customer relationship or prevent abuse.

2.4. Technical and browsing data

When using the website, certain technical information may be processed to ensure its operation and security:

IP address.
Date and time of connections or requests.
Information about the browser and device used.
Pages viewed and technical events needed for diagnostics.
Session identifiers and information required to prevent unauthorized access.

This data is processed only to the extent necessary for the operation, maintenance and protection of the platform.

Article 3 – Signing In and Registering with Google

3.1. Description of the service

Shapline offers users an optional authentication method called “Continue with Google”.

This feature uses OAuth 2.0 and OpenID Connect authentication technologies provided by Google.

It allows a user to create a Shapline account, sign in to an existing account or link their Google identity to a Shapline account, depending on the features offered on the website.

Use of this feature is not mandatory. Users may continue to sign in in the conventional way using their email address and password.

3.2. Data obtained from Google

As part of authentication, Shapline uses the identity information needed to identify the account holder, within the limits of the permissions granted and the data actually transmitted by Google.

This information includes, in particular:

The unique Google account identifier, which allows the same user to be recognized on subsequent sign-ins.
The email address associated with the Google account.
Basic identity information, such as first and last name, when transmitted and required to create a Shapline account.

The technical Google identifier is linked to the Shapline user account to enable subsequent sign-ins.

Signing in with Google does not require the user to disclose their Google account password to Shapline.

This authentication feature is not intended to access Gmail messages, personal contacts, Google Drive documents or Google Calendar events.

3.3. Use of Google data

Information obtained through Google is used exclusively for purposes related to the user account and the operation of Shapline, including:

Authenticating the user.
Creating their account when they request registration.
Recognizing their identity on subsequent sign-ins.
Linking a Google identity to an existing Shapline account.
Preventing duplicate accounts and unauthorized access attempts.
Providing secure access to the personal account area, orders and downloads.

Shapline does not use identity data obtained from Google to sell personal information, build advertising profiles or conduct marketing campaigns unrelated to the authentication purpose.

3.4. Retention and protection of Google data

Information required to link Google and Shapline is retained for as long as that link remains necessary for the account to function.

It is attached to the user account within Shapline's authentication system.

When a Shapline account is closed and anonymized, the link to the Google identity is removed from the account system.

Data required to comply with accounting obligations, where a user has made purchases, is processed separately and may be retained in accordance with legal requirements.

3.5. Sharing Google data

Data obtained through Google sign-in is neither sold nor disclosed to advertisers for targeted advertising purposes.

Its processing may involve technical service providers responsible for hosting, security and the operation of Shapline, within the limits required for their duties and applicable legal obligations.

These providers are not authorized to reuse the data for purposes unrelated to the services they provide to Shapline.

3.6. Control and revocation

Users can review the apps and services linked to their Google account in their Google account security settings.

They can revoke the authorization granted to Shapline there.

Revoking this authorization may prevent subsequent sign-ins with Google until new authorization is granted.

This revocation does not automatically delete the Shapline account or data retained by Shapline for other purposes.

To request the closure of their Shapline account, users may use the features available in their personal account area or contact Shapline.

Article 4 – Purposes and Legal Bases of Processing

Shapline processes personal data for specified purposes and on the legal bases set out in Article 6 of the GDPR.

4.1. User account management

Account creation, authentication and administration are based primarily on the need to provide the services requested by the user and to fulfill the contractual relationship.

Using Google as a sign-in method is optional and initiated by the user.

4.2. Order management

Managing the shopping cart, purchases, payments, order confirmations and downloads is based on the performance of the contract concluded with the customer.

4.3. Invoicing and accounting

Issuing, storing and managing invoices, as well as meeting tax and accounting obligations, are based on compliance with the legal obligations applicable to Shapline.

4.4. Support and customer relations

The handling of information requests, complaints and technical difficulties is based, depending on the nature of the request, on the performance of the contract or Shapline's legitimate interest in providing appropriate support.

4.5. Security and abuse prevention

Account protection, prevention of fraudulent access, detection of abusive use and download security are based on Shapline's legitimate interest in protecting its platform, customers and digital products.

4.6. Cookies and non-essential technologies

Where cookies or other trackers require prior consent, their use is based on the user's consent under the conditions laid down by applicable regulations.

Article 5 – Payments and Financial Service Providers

Shapline offers online payment solutions relying in particular on Stripe and PayPal services.

When a user selects one of these payment methods, certain information necessary for the transaction may be transmitted to the relevant provider.

This information may include, in particular:

The order reference.
The payment amount and currency.
Information needed to verify and confirm the transaction.
Certain customer contact details required for the payment service to operate or to comply with regulatory obligations.

Sensitive banking information is processed through the payment providers' secure interfaces and services.

Shapline uses the transaction confirmations and references received to record payments, generate invoices and authorize access to purchased digital products.

Stripe and PayPal may also process certain data as independent data controllers, in accordance with their respective privacy policies.

Users are invited to consult these providers' privacy policies to learn how data is processed directly in connection with their services.

Article 6 – Recipients of Personal Data

Personal data is accessible only to the extent necessary by individuals and service providers involved in Shapline's operations.

Categories of recipients may include:

Persons authorized to administer Shapline and handle customer relations.
OVHcloud, for hosting and infrastructure services used by Shapline.
Stripe and PayPal, for payment processing.
Google, as part of its authentication service when the user chooses Google sign-in.
Technical providers responsible for delivering emails, maintenance or service security.
Administrative or judicial authorities where disclosure is required by law.

Shapline does not sell its users' personal data.

Disclosures to service providers are limited to the information necessary to perform their services and are governed by applicable contractual and legal obligations.

Article 7 – International Data Transfers

Some technical or payment service providers may process personal data from countries outside the European Economic Area.

Where such transfers occur, Shapline ensures that they are based on a mechanism recognized by applicable regulations, including an adequacy decision by the European Commission or appropriate contractual safeguards.

Users may contact Shapline for further information about transfers involving their data and the applicable safeguards.

Article 8 – Cookies and Similar Technologies

8.1. Cookies necessary for operation

Shapline uses technical mechanisms necessary for the website to operate, including to:

Maintain user sessions.
Provide authentication.
Protect forms against certain attacks.
Preserve essential browsing and purchasing operations.
Ensure service security and continuity.

These mechanisms may be necessary to provide features expressly requested by the user.

8.2. Third-party services and optional trackers

Some features or external integrations, including payment services, third-party hosted content or potential audience measurement tools, may involve the use of cookies or similar technologies.

Where a tracker is not strictly necessary and requires consent under applicable regulations, it must only be used after that consent has been obtained.

Users may also manage cookies through their browser settings, subject to any consequences for the operation of certain services.

Information specific to audience measurement tools and third-party services actually enabled on Shapline must be detailed in the cookie information made available to users.

Article 9 – Data Retention Periods

Shapline retains personal data for a period proportionate to its purpose and applicable legal obligations.

9.1. User accounts

Data needed to operate an active account is retained for as long as the account is used, subject to retention obligations applicable to certain operations.

When a user requests account closure, Shapline deactivates the account and anonymizes sign-in information in accordance with its established procedures.

Certain minimal technical information concerning the existence and closure of an account may be retained for a limited period. In particular, the account management system provides for a five-year deletion deadline for the residual technical account record.

Deleting or anonymizing the account does not necessarily result in the deletion of commercial and accounting documents that must be retained by law.

9.2. Orders and invoices

Invoices and supporting accounting documents are retained for the period prescribed by applicable legislation, notably ten years from the close of the relevant financial year for accounting documents subject to French law.

Data required to substantiate a transaction may be retained during this period, even after the customer account is closed.

Other information that is no longer needed is deleted or anonymized in accordance with Shapline's retention policy.

9.3. Google-related data

Technical data linking a Shapline account to a Google identity is retained for as long as this link is needed.

Anonymization of the Shapline account results in the deletion of the corresponding OAuth links.

9.4. Contact requests

Messages and contact details provided in connection with support are retained for the time necessary to process the request, and then for a limited period when further retention is necessary to document a complaint, protect Shapline's rights or comply with a legal obligation.

9.5. Technical data

Technical information and security logs are retained for a limited period, determined by their usefulness for diagnostics, website security and incident handling.

At the end of the applicable periods, data is deleted, anonymized or appropriately archived where retention is required by law.

Article 10 – Personal Data Security

Shapline implements technical and organizational measures designed to preserve the confidentiality, integrity and availability of personal data.

These measures include, in particular:

Using HTTPS connections for communications with the website.
Protecting passwords through cryptographic hashing.
Access control mechanisms for personal and administrative areas.
Protecting forms and sensitive operations.
Limits designed to reduce abusive sign-in attempts.
Managing blocked or deactivated accounts.
Protecting digital files through authorization checks.
Revoking download permissions when required by the account's status.

Despite the precautions taken, no computer system can guarantee the complete absence of risk.

Users are encouraged to protect their credentials, not share their accounts and report any suspicious activity.

Article 11 – Account Closure, Deletion and Anonymization

Users have access to features that allow them to request the closure of their Shapline account.

When a request is accepted, Shapline takes the following steps in particular:

Deactivating the account.
Anonymizing the email address used for sign-in.
Invalidating the authentication methods associated with the account.
Removing links to Google identities.
Revoking the relevant download permissions.
Deleting personal data that is no longer needed, subject to legal obligations.

Certain operations may be postponed when a payment is being processed or requires verification.

Invoices and other legally required accounting records may be retained after account closure.

Closing the account results in loss of access to the personal account area and associated downloads.

A confirmation message may be sent to the email address used before anonymization.

Article 12 – Rights of Data Subjects

Under the GDPR, every person has the following rights, subject to the conditions laid down by law:

Right of access: obtain information about personal data being processed and, under legally prescribed conditions, receive a copy.
Right to rectification: request correction of inaccurate or incomplete data.
Right to erasure: request deletion of data where legal conditions are met.
Right to restriction: request temporary restriction of certain processing activities.
Right to object: object to certain processing based on legitimate interests, for reasons relating to their particular situation.
Right to data portability: obtain certain data, where this right applies, in a structured and commonly used format.
Right to withdraw consent: withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

These rights may be exercised by writing to:

contact@shapline.com

Users are invited to specify the purpose of their request and information allowing the relevant account to be identified.

Reasonable identity verification may be required where necessary to avoid disclosing data to an unauthorized third party.

Shapline responds to requests within the time limits prescribed by law, generally within one month, subject to legally permitted extensions and exceptions.

Some erasure requests may be restricted by legal retention obligations, particularly concerning invoicing and accounting.

Article 13 – Complaints to the CNIL

Anyone who believes that their personal data is not being processed in accordance with regulations may contact Shapline to seek a solution.

They also have the right to lodge a complaint with the competent supervisory authority.

In France, this authority is:

French Data Protection Authority (Commission nationale de l’informatique et des libertés – CNIL)

Website: https://www.cnil.fr

Exercising this right does not deprive the data subject of other remedies provided by law.

Article 14 – External Links and Services

The Shapline website may contain links to websites or services operated by third parties.

These services have their own terms of use and privacy policies.

When a user leaves Shapline to visit a third-party website or use an external service, processing carried out directly by that third party is governed by its own privacy policy and legal responsibilities.

Shapline encourages users to review these documents before sharing their personal data.

Article 15 – Changes to the Privacy Policy

Shapline may update this Privacy Policy to reflect:

Changes in regulations.
Changes to website features.
The integration or replacement of technical service providers.
Changes affecting how personal data is collected, used or retained.
Improvements in security and user protection.

In the event of a substantial change, Shapline will take appropriate steps to inform users and, where legally necessary, seek fresh consent before implementing the processing concerned.

The applicable version is the one published on the website on the date of consultation.

Article 16 – Contact

For any questions about this policy, the use of personal data, Google sign-in or the exercise of a right under the GDPR, users may contact:

Shapline
58, route des Rois
02000 Urcel, France
Email address: contact@shapline.com
Website: https://shapline.com

Last updated: November 2, 2026