Privacy Policy

Last updated: [DATE — set on publication]

1. Who This Policy Covers

This Privacy Policy explains how Shanga Labs ("Shanga Labs", "we", "us") collects, uses, shares, and protects personal data when you use the Shanga Labs digital manufacturing platform (the "Platform"): browsing the site, creating an account, uploading a design file, requesting a quotation, placing an order, booking an engineering consultation, or using the Creative Lab AI generation feature.

We are a manufacturing service, not a marketplace or a repository of third-party design files — see Section 2 of our Terms & Conditions.

2. Information We Collect

• Account information: name, email address, and phone number (if you provide one).
• Order and design data: the design file you upload (STL/3MF/STEP/OBJ), technical metadata extracted from it (dimensions, weight/print-time estimates, material and quality selections), thumbnails we generate from the file, your rights confirmation and any source URL you provide, and your order and quotation history.
• Payment information: payment is processed by our payment provider, Minisend. We do not collect or store your card, mobile-money PIN, or wallet credentials — Minisend handles that directly and we only receive confirmation of payment status and amount.
• Consultation booking data (if you book an engineering consultation): your name, contact details, and the meeting time, via our Google Calendar integration.
• Support communications: anything you send us when contacting support.
• Usage data: basic technical data needed to operate the Platform (e.g. request logs for security and debugging). As of this writing, we do not run third-party analytics, advertising, or session-replay tracking on the Platform — if that changes, we will update this section and request consent where the law requires it.

3. How We Use Information

We use personal data to: create and maintain your account; analyze uploaded files and generate quotations; route orders through engineering review and, once approved, into production; process payments; communicate order and consultation status; provide customer support; enforce our Terms & Conditions and Acceptable Use Policy; and meet our legal, accounting, and tax obligations.

4. Automated Processing & AI Features

We use AI models as part of the Platform, and we tell you here rather than leaving it implicit:

• Material and print-settings recommendation: we use Anthropic's Claude to suggest the closest in-stock material variant and print settings for an uploaded file. This recommendation never results in a charge on its own — under our Terms, no order can be paid for until a human engineer has reviewed and approved it (see Section 4 of our Terms & Conditions). We do not make automated decisions that produce legal or similarly significant effects about you without human review.
• AI-generated 3D models (Creative Lab): if you use our Creative Lab feature, your text prompt or reference image is sent to Meshy, a third-party AI model, to generate a 3D model. The output is AI-generated and is clearly labelled as such in the product; you should review it before ordering, and you remain responsible under our Acceptable Use Policy for what you ask the model to generate and for any rights needed in a reference image you upload.

5. File Retention & Deletion

Uploaded design files are temporary. They are retained only for the retention period shown to you at the time of upload (an operational setting we can adjust; it is not hardcoded into this policy so that it always matches what you were actually told) and are then permanently deleted from our active systems. After deletion, we keep the file's hash, technical metadata, thumbnails, print settings, and your order history — never the design file itself — for accounting, warranty, dispute, and legal-compliance purposes. See Section 10 of our Terms & Conditions.

You can ask us to delete your files earlier by contacting support, subject to any active order and our legal retention obligations.

6. Sharing With Service Providers

We share personal data only with the service providers who help us run the Platform, under contract, and only to the extent needed to provide the Services:

• Supabase — database, authentication, and file storage hosting.
• Resend — sending transactional order, quotation, and consultation emails.
• Anthropic (Claude) — material and print-settings recommendation (Section 4).
• Meshy — AI 3D model generation for Creative Lab (Section 4).
• Printago — routing approved orders into our print production queue.
• Minisend — payment processing.

We do not sell personal data, and we do not share it for third-party advertising.

7. Cookies & Tracking

We do not currently use third-party analytics, advertising, or session-replay cookies on the Platform. We use only the technical cookies needed to keep you signed in and to remember your session. If we add any tracking technology that requires consent under applicable law, we will update this Policy and add a consent mechanism before doing so.

8. Your Rights

If you are in Kenya, the Data Protection Act, 2019 gives you the right to access, correct, delete, or object to the processing of your personal data, to data portability, and to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). If you are located elsewhere (including the EU/UK), we will honor equivalent data subject rights requests on the same basis. To exercise any of these rights, contact us using the details in Section 14.

9. Children

The Platform is a general-audience manufacturing service and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

10. Security

We rely on our infrastructure providers' built-in security controls — encryption in transit and at rest, and database-level access rules (row-level security) that restrict who can read or write which records — and apply our own access controls on top. No system is perfectly secure, and we cannot guarantee absolute security.

11. International Data Transfers

Because the service providers listed in Section 6 operate infrastructure outside Kenya, personal data may be processed in other countries. Where required, we rely on those providers' own compliance mechanisms and contractual safeguards for cross-border transfer.

12. Data Breach Notification

If a breach affecting your personal data occurs, we will notify affected users and, where required by the Data Protection Act, 2019, the ODPC, without undue delay.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or by email, and the "Last updated" date above will reflect the latest revision.

14. Contact

Questions about this Privacy Policy, or requests to exercise your data rights, may be directed to prints@shangalabs.com, or to Shanga Labs at [REGISTERED BUSINESS ADDRESS — TODO before publication].

---

This draft is a working document built from the data practices and vendors actually implemented in the Platform as of this writing. It must be reviewed and localized by qualified Kenyan legal counsel — and the bracketed placeholders above filled in — before publication.