Privacy Policy

Layforma is software that print shops use to manage their work. Two different groups of people have personal data here, and their positions are not the same.

If you run a shop — you signed up, created a workspace and pay for it — then Bilal Malass is the controller of your account data and this policy describes what we do with it.

If you are a customer of a shop — you sent a print request to a business that uses Layforma — then that shop decides what is collected about you and why. Bilal Malass only stores and processes it on the shop’s instructions. For anything about how a shop uses your data, or to ask that shop to delete it, contact the shop directly. We can still help you export or erase your own account, described in section 6.

Only what the software needs to do its job. In full:

• Your account: email address, and the name and phone number you choose to give.
• A shop’s details: name, address, city, contact email and WhatsApp number, and its settings.
• A shop’s customer records: name, email address and phone number, entered by the customer or by the shop’s staff.
• Projects: what you asked for — title, description, intended use, quantity, dimensions, material, colour, deadline and any notes.
• Files: 3D models, reference images, PDFs, design files and payment receipts you upload, together with their original file names and sizes.
• Messages between a customer and a shop. Shops also keep internal notes, which are never shown to customers.
• Quotes and payment records: line items, amounts, discounts, deposits, payment method, dates and references. These are the shop’s business records.
• An activity history: who did what and when, on each project. It cannot be edited or deleted — it is what makes a quote or a payment auditable.
• A short-lived email queue holding your address and a project reference until a notification is sent.

There is no tracking, no advertising, no profiling and no analytics product. Nothing here is sold or shared for marketing, by us or by a shop through us.

Three things are stored in your browser, none of them for tracking:

• A session cookie set when you sign in, so you stay signed in. Removing it signs you out.
• layforma_locale — the language you picked, kept for a year so you are not asked again.
• layforma-theme in local storage — whether you chose the light or dark appearance.

No third-party cookies are set, and nothing follows you to other sites.

Within a shop, that shop’s owner and staff can see its projects, customers, files and messages. No shop can see another shop’s data, and no customer can see another customer’s. That separation is enforced by the database itself rather than by the interface.

These service providers process data on our behalf:

• Supabase — Database, authentication, and file storage. Data held in [Supabase region — TO BE COMPLETED].
• Vercel — Application hosting and request logs. Data held in [Vercel region — TO BE COMPLETED].
• Resend — Sending sign-in codes and notification emails. Data held in [Resend region — TO BE COMPLETED].

Beyond those, personal data is disclosed only where the law requires it of Bilal Malass.

While a shop is using Layforma, its projects and records are kept so that it can run its business — a quote or a payment from two years ago is a business record, not clutter.

When you erase your account, your name, email address and phone number are removed from every shop that holds them, and you can no longer sign in. The orders themselves remain with the shop, along with their quotes, payments and receipts: those are the shop’s financial records, which it is generally required to keep, and they no longer carry your name. This is described here rather than promised as deletion, because it is what actually happens.

When a shop is deleted, its projects, customers, files, messages and history are removed and its uploaded files are deleted from storage.

A closed shop’s data is kept for 90 days before deletion. Backups are held for [backup retention, in days — TO BE COMPLETED] days, and data already deleted can persist in them for that period.

Two of these work immediately, from inside the product:

• Get a copy of your data. Open Your details and choose Download my data. You get a JSON file containing your profile and every project, quote, payment and message you can see.
• Erase your account. Also under Your details, with the effect described in section 5. A shop owner must delete or hand over their shop first.

To correct something, ask the shop that holds it, or write to us. For access, restriction, objection or a complaint, write to bilalmalass14@gmail.com. Depending on where you live you may also have the right to complain to a data protection authority.

Every request is checked against the database’s own access rules rather than the interface’s, so a page that hides something is not the only thing stopping it being read. Uploaded files are held in private storage and reachable only through short-lived links issued after an access check — a copied file link stops working within a minute. The site is served over HTTPS only. Sign-in uses a one-time code sent to your email address.

No system is perfectly secure. If you believe you have found a vulnerability, write to contact@bilalmalass.com and please give us a reasonable chance to fix it before publishing.

Layforma is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

If this policy changes materially, shops will be told by email before the change takes effect. The version and date are at the top of this page.

Bilal Malass, Minieh, Tripoli, North Lebanon. Privacy enquiries: bilalmalass14@gmail.com.