Privacy Policy

Who is responsible

Fantasy Lab 3D, a 3D printing studio in Almaty, Republic of Kazakhstan, is responsible for the processing described here. Contact for all privacy questions: timurunaspekov@gmail.com.

What we collect

• Analytics, only with your consent: Google Analytics 4 records pages viewed, approximate location (country and city derived from the IP address, which Google does not store), device and browser type, referring site and clicks on buttons such as "Request a quote". It sets the cookies listed below.
• Anonymous statistics without cookies: Vercel Web Analytics counts page views using a short-lived hash that cannot identify you and is discarded within 24 hours. No cookies, no cross-site tracking.
• Messages you send us by e-mail or Instagram: your name or username, contact details, the message, and any files, photos or links you attach. We use them only to answer you and to fulfil your order.
• Technical logs: our hosting provider Vercel processes IP addresses and request data for security and to deliver the site.

We do not use advertising cookies, remarketing, fingerprinting or social media tracking pixels.

Cookies and local storage

Google Analytics loads only after you click "Allow analytics". You can change your choice at any time with the "Cookie settings" link in the footer; withdrawing consent deletes the analytics cookies.

Why we process data and on what basis

• Improving the site and understanding which articles are useful: your consent (you can withdraw it at any time).
• Answering enquiries and fulfilling orders: steps taken at your request before or under a contract.
• Keeping the site secure and available: our legitimate interest in operating a safe website.

For visitors in Kazakhstan, processing follows the Law of the Republic of Kazakhstan "On Personal Data and Their Protection". For visitors in the European Economic Area and the United Kingdom, the bases above correspond to Article 6(1)(a), (b) and (f) GDPR.

Who receives data

• Google LLC / Google Ireland Ltd: Google Analytics (only with consent).
• Vercel Inc.: hosting and anonymous statistics.
• Meta Platforms (Instagram): only if you contact us through Instagram.
• Delivery services: name, phone and address, only when you order delivery.

These providers may process data outside Kazakhstan, including in the United States and the European Union. Google and Vercel use standard contractual safeguards for international transfers. We do not sell or rent personal data to anyone.

How long we keep data

• Google Analytics event data: no longer than 14 months, then deleted automatically.
• Vercel anonymous statistics: aggregated, without personal identifiers.
• Messages and order details: as long as needed to complete the order and handle questions about it, and as long as tax and accounting law requires.

Instagram integration

Our application uses the Instagram Graph API to receive and answer messages sent to our studio account. We access only the data needed to reply: your Instagram username, profile name and the content of messages you send us. This data is stored securely and is never sold or shared with third parties for marketing.

Data deletion

You can revoke our application's access to your Instagram data at any time in Instagram: Settings > Apps and websites.

To delete messages, files or any other data we hold about you, e-mail timurunaspekov@gmail.com with the subject "Data deletion". We confirm deletion within 30 days. To delete analytics data tied to your browser, use "Cookie settings" in the footer and clear your browser cookies.

Your rights

• Know what data we hold about you and receive a copy.
• Have inaccurate data corrected.
• Have your data deleted.
• Withdraw consent to analytics at any time, without affecting earlier processing.
• Object to processing based on legitimate interest.
• Complain to a supervisory authority: in Kazakhstan, the authorised body for personal data protection; in the EEA or UK, your local data protection authority.

To use any of these rights, write to timurunaspekov@gmail.com. We answer within 30 days.

Children

The website is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has sent us personal data, contact us and we will delete it.

Security

The site is served only over HTTPS with strict security headers. We keep the amount of data we hold to a minimum and restrict access to it.

Changes to this policy

If we change this policy, we update the date at the top of this page. Significant changes are announced on the website.