Privacy Policy

Last updated: 27 October 2026

This policy explains what personal information 3D Crystals collects, why, who we share it with, how long we keep it and your rights.

Who we are

3D Crystals is a trading name of TUTTO PRINT LTD, a company registered in England and Wales under company number 12506789. Our registered office is at Tutto Print, 49 Palace Gardens, Enfield, England, EN2 6SN.

We are the controller of the personal information described in this policy. For any privacy question or request, email us at info@3dcrystals.co.uk or write to us at the address above.

What we collect and why

When you order

We collect your name, billing and delivery address, email address, phone number, what you order, and any notes you add.

We use this to process, make and deliver your order and to deal with any questions about it (to perform our contract with you), and to keep accounting records (a legal obligation).

Your photo and design

When you design a crystal, you upload a photo. The background is removed automatically in your own browser, using an open-source AI model (MODNet). Your photo is not sent to any outside AI service for this.

When you add a design to your basket, we store:

• your original photo, exactly as you uploaded it;
• the prepared photo that we engrave;
• the preview; and
• your design settings, such as the product, size, background choice, any text and your gift note.

We keep these privately on our server. They are not on public web pages, only our staff can see them, and we only use them to make your order (to perform our contract with you).

If a design never becomes an order, we delete it after 3 days.

If your photo shows other people, please make sure they are happy for you to use it.

Payments

Card payments are handled by Stripe. We never see or store your full card details.

When you contact us

If you email or write to us, we keep the details you give us so we can help you and follow up.

Marketing emails

We only send you marketing emails if you have opted in to receive them. If you do, we rely on your consent, and you can withdraw it at any time.

Website security

Our website and hosting provider record technical information such as IP addresses and browser details to protect the website against attacks and misuse (our legitimate interest in keeping the site and your data secure).

Website analytics and advertising (only if you accept cookies)

If you click Accept in our cookie banner, we use Google Analytics and Google Ads. Google Analytics records how our website is used: the pages viewed, the type of device and browser, the approximate location (town or region) and how the visit started, for example from a Google search or one of our Google ads. Google Ads records whether a visit from one of our ads led to an order.

We use this to improve our website and to see which adverts are worth paying for (legal basis: your consent). If you do not accept, we do not use them. See Cookies below.

Who we share it with

We only share what each provider needs to do its job:

• Stripe, which processes card payments and helps prevent fraud.
• Hostinger, which hosts our website.
• Google (Google Ireland Limited and Google LLC), for website analytics and advertising measurement, only if you accept those cookies. For advertising measurement Google also acts as a separate controller: see how Google uses information from sites that use its services.
• Delivery companies, which receive your name and delivery address so they can deliver your order.
• Professional advisers and authorities, such as our accountants, HMRC or the police, where this is required by law.

We do not share your photo with anyone outside our business except our website host, which stores it for us.

We do not sell your personal information.

International transfers

Some providers, such as Stripe and Google, may process information in the United States. Where information leaves the UK, we rely on recognised safeguards, such as the UK–US data bridge, UK adequacy regulations or the UK International Data Transfer Addendum.

How long we keep it

• Designs that never become an order (your photos, preview and design settings): deleted after 3 days.
• Designs that are part of an order (your original photo, prepared photo, preview and design settings): kept for 12 months after you place your order, so we can remake your crystal if it arrives damaged, then deleted automatically.
• Orders and invoices: 6 years after the end of the financial year they relate to, as required for tax purposes.
• Emails and letters you send us: for as long as we need them to deal with your question or order.
• Marketing emails: until you unsubscribe.
• Website security logs: for short periods, then deleted.
• Website analytics (Google Analytics), only if you accept: visit-level data is kept for no more than 14 months, then deleted by Google. Summary reports with no personal details may be kept longer.

Cookies

Cookies are small files that a website stores in your browser.

Cookies our website needs to work (always on):

• Basket and session cookies (such as wp_woocommerce_session_* and woocommerce_cart_hash) remember what is in your basket.
• Payment security cookies from Stripe may be set when you pay, to help prevent fraud.
• Your cookie choice is remembered, so we do not ask you on every page.

Analytics and advertising cookies (only if you click Accept):

• Google Analytics cookies (such as _ga and _ga_*) count visits and show how people use our website. They last up to 2 years.
• Google Ads cookies (such as _gcl_au) tell us whether a visit from one of our Google ads led to an order. They last up to 90 days.

Google may also set cookies on its own websites (such as google.com and doubleclick.net) and keep similar information in your browser’s local storage.

If you click Reject, none of these analytics or advertising cookies are set and nothing is sent to Google. You can change your mind at any time from Cookie settings at the bottom of every page. If you withdraw your consent, we stop using Google’s tools and delete the cookies they placed on our website. Cookies on Google’s own websites can be cleared in your browser settings.

Your rights

Under UK data protection law (the UK GDPR), you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong
• ask us to delete your information
• ask us to limit how we use it, or object to how we use it
• ask for your information in a portable format
• withdraw your consent at any time, for example by rejecting cookies or unsubscribing

To make a request, email us at info@3dcrystals.co.uk. We will reply within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.