Privacy policy.

We collect only what an order actually needs. There is no tracking pixel, advertising tag, or third-party analytics script anywhere on this site, so simply reading a page leaves us nothing about you beyond the ordinary server logs described below.

Account information

When you register: your name, email address, telephone number or numbers, shipping address, billing address, and a password. The password is never stored as you typed it — it is hashed with bcrypt, and no one at the shop can read it.

Order information

When you submit a part request: the 3D model file you upload (.stl, a STEP or IGES export, or a .zip holding the model and anything that goes with it), or, if you have no model yet, the part name, description, and dimensions you write instead, together with any reference photographs, sketches, or PDF drawings you attach to show us the part; the make and model of the equipment it came from and its part number, if you give them; quantity; material; print settings; your notes; and the date you need it by. As the job progresses we add the estimated or quoted price, order status, invoice number, and the carrier, service, and tracking number of the parcel your part ships in.

What happens to an uploaded file after the job is finished — that we keep it so the part can be run again, and how to have a specific one deleted — is set out in the File Retention Policy.

Estimate requests without an account

The public estimate form asks for your name, email address, and phone number, and optionally your company, alongside the part details above. We send that email address one message, with a link to confirm the request came from you; if you click it, we record when. That message carries nothing typed into the form except the address itself, and no address receives more than one of them a day.

If you use the other link in that message to tell us you did not send the request, we delete the request and everything uploaded with it — unless the shop has already started work on it, in which case a person looks at it first — and add a one-way fingerprint of the address to a do-not-email list, so the form never writes to it again. The fingerprint is not the address and cannot be turned back into one; all it can tell us is that an address typed into the form later is one we have promised not to email.

Technical information

Our hosting and storage providers keep standard server logs — IP address, browser user-agent, and the time and path of the request — which exist to keep the service running and to investigate abuse.

Billing information

Invoices are issued and paid through Square, not on this site. To raise one, we enter your name, email address, billing address, and a description of the work into Square; Square sends you the invoice and collects the payment. We record the Square invoice number against your order so both sides can refer to it, and the notice you get from us that an invoice is ready carries that number.

Your card details never reach us. You enter them with Square, on Square's own pages, and no card number is ever seen or stored by this site. We also do not ask for and do not want government identifiers, health information, or biometric data.

Each thing we collect is used for the job it was collected for:

• To manufacture your part. Your model file, print settings, and notes are what the shop works from.
• To reach you about your order. Estimates, quotes, invoices, status changes, and shipping notices go to your email address; we use your phone number if an order needs a conversation.
• To make a reprint or a revision possible. We keep your model and the settings it was printed with after the job is finished, so that asking for the same part again is a reprint rather than a fresh upload, and a change starts from the file we actually printed. The File Retention Policy covers this in full, including having a file deleted.
• To invoice you and take payment. Your name, email address, and billing address go to Square, which issues the invoice and collects on it.
• To ship it. Your name and shipping address go on the label of the parcel, and so to USPS, which carries it.
• To keep your account working and secure. Signing in, staying signed in, and protecting the account from misuse.
• To check an estimate request came from the owner of the email address on it. Anyone can type any address into a public form. The confirmation link and the do-not-email list described in section 02 exist to protect the person at that address, and are used for nothing else.
• To meet our own legal and tax obligations. Business records for completed orders.

We do not send marketing email unless you ask us to. Everything we send by default is transactional — it is about an order you placed or an account you opened.

We have never sold or shared personal information for money or for cross-context behavioural advertising, and we do not intend to. Your model files and part descriptions are treated as your confidential business information. We do not publish them, show them to other customers, or use them as portfolio work without asking you first, in writing.

Running the shop takes a short list of service providers. Each one may only handle your information to provide its service to us, and none of them may use it for their own purposes:

• Cloudflare R2 — stores the model files and reference images you upload. Larger files go from your browser straight to it, on a short-lived signed link, rather than through our own server.
• Resend — delivers transactional email such as estimates, quotes, invoices, and status updates.
• Square — issues your invoice and processes the payment. Square receives your name, email address, billing address, and the description and amount of the work. It also collects the card details we never see, and for those it answers to you directly rather than through us: what Square collects when you pay is governed by Square's own privacy notice on squareup.com.
• Our database and application hosting providers — store account and order records and serve the site.

USPS carries finished parts, and it is not one of the service providers above. It is the United States Postal Service, and it does not act for us. It receives your name and shipping address because they are printed on the parcel, and it records the parcel's movements itself. It handles that information under its own privacy policy, not ours. That includes the tracking it shows on usps.com and any notice it sends you through its own services, such as Informed Delivery. If a part ever has to go by another carrier, that carrier receives the same name and address on the same terms.

Beyond those, we disclose personal information only when the law requires it — a valid subpoena, court order, or similar legal process — or when it is necessary to establish or defend a legal claim. If a request appears overbroad or improper, we will push back on it.

This site sets three cookies, all of them strictly necessary: they keep you signed in, protect forms against cross-site request forgery, and remember the page you were heading to when sign-in interrupted you. A visitor who never signs in is never given any of them.

There are no analytics, advertising, or profiling cookies. The Cookie Policy lists each one by name, with its lifetime and exactly what it does.

• Account records — for as long as your account is open, and afterwards only as long as tax and business-record rules require.
• Order records — kept for our accounting and warranty obligations, generally seven years.
• Uploaded model files — kept while the order is live and afterwards so a part can be reprinted or a revision priced. A file you upload but never submit is deleted within about a day. Ask us and we will delete a file sooner. The File Retention Policy sets this out in full, including how to have a specific file deleted.
• Payment records — the invoice number and amount stay with the order record above. Square keeps its own record of the transaction under its own retention policy, which we do not control.
• Shipping records — the carrier, service, and tracking number stay with the order record above. USPS keeps its own record of the parcel under its own retention policy, which we do not control.
• Server logs — short-lived, per our providers' standard retention.
• The do-not-email list — kept indefinitely, because the promise each entry records, never to email that address from the estimate form again, is meant to last. An entry is a one-way fingerprint of an address and nothing else: no name, no request, no date beyond when it was added.

You can see and change your name, shipping and billing addresses, and password yourself at any time from Account settings. Beyond that, you may ask us to:

• tell you what personal information we hold about you;
• correct anything inaccurate;
• delete your account and the personal information attached to it, except records we must keep for tax or legal reasons;
• delete a specific uploaded model file;
• send you a copy of your information in a portable format.

Email info@takomoco.com and we will respond within 45 days. We will never charge you for making a request, and we will never treat you differently for having made one.

California residents

The rights above are the rights the CCPA, as amended by the CPRA, gives you: to know, to delete, to correct, to opt out of sale or sharing, and to limit the use of sensitive personal information. There is nothing to opt out of here — as stated in section 04, we do not sell or share personal information, and we do not collect sensitive personal information as that law defines it. You may use an authorised agent to make a request on your behalf.

If you are outside the United States

The shop, its servers, and its service providers are in the United States. Using the site means your information is transferred to and processed in the United States, where privacy law differs from the law where you live. If the GDPR or UK GDPR applies to you, our lawful bases are performance of a contract (making and delivering your part), legal obligation (tax and business records), your consent (the retention agreement described below), and our legitimate interest in keeping the site secure and operating. You may object, ask us to restrict processing, or complain to your local supervisory authority. The do-not-email list in section 02 rests on that last interest: it exists so our form cannot be used to send mail to someone who never asked for it.

Keeping your model after the order it came in for is finished rests on two of those: your agreement, which you give by ticking the File Retention Policy when you open an account, and our legitimate interest in being able to reprint or revise a part you come back for. Withdrawing the agreement is one email — ask us to delete the file and we will, as the list above says — and nothing we did with the file before then becomes unlawful for your having asked.

Traffic to and from the site is encrypted in transit. Passwords are stored only as bcrypt hashes. Uploaded files are held in private storage and reached through short-lived signed links rather than public URLs, and every upload is checked against its real file signature before it is attached to a request — a file that fails the check is deleted. Order and account records are reachable only by you and by shop staff who need them to do the work.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal information, we will notify you and the relevant authorities as the law requires.

This is a business-to-business manufacturing service. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to info@takomoco.com and we will delete it.

If this policy changes we will update the date at the top of the page, and for a material change — a new category of information, a new purpose, a new recipient — we will say so on the site before the change takes effect. This version is dated October 5, 2026.