Privacy Notice

Who we are

Layer & Loop Store is the trading name of Layer and Loop Store Ltd, a private limited company registered in England and Wales (company number 17500550). Layer and Loop Store Ltd is the data controller responsible for the personal information described here.

Until 1 November 2026, the business was run by Kian Low, a sole trader trading as LayerAndLoopStore, who was the controller of information collected before that date. From that date the business, including its existing customer and order records, is run by Layer and Loop Store Ltd. The company holds those records for the same purposes and retention periods described in this notice: to complete and support earlier orders (including refunds and your statutory rights), to keep the accounting records the law requires, and to run the business, which is our legitimate interest. Questions or requests about information collected before that date can be sent to the same privacy contact below.

Privacy email

[email protected]

Registered office

Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom

What this notice covers

This notice applies when you use the site, select a model, generate a quote, submit, pay for or track an order, contact us, exercise a data right or make a data-protection complaint.

Your model file

When you select an STL or 3MF, the analysis and instant estimate are calculated in your browser. The model file, its contents, geometry, preview and sliced data are not uploaded merely because you select it or obtain an estimate.

The model is uploaded in two situations only: if you choose to email yourself a quote (see Saved quotes), or when you place an order. For an order we use it to review printability, verify the price, prepare or repair it where needed, slice and manufacture the ordered quantity, quality-check the result and deal with a quality problem or authorised replacement.

We do not sell or publish customer models, reuse them for another customer, manufacture extra stock, use them in marketing or use them to train an AI system. Files are shared outside the business only where a job needs it, as described under Who receives information. Uploaded models and stored production files are deleted within 30 days after your order is dispatched, cancelled or refunded. The original filename is removed from the long-term order record at the same time. A later repeat order requires a new upload. Copies downloaded to our workshop computer or printers for production are not yet deleted on an automatic schedule, so they can be kept for longer than this. They stay on our own equipment, and we will delete them if you ask. Model files are not included in our backups.

Security check before quoting

Before you can choose a model in the instant quote, and before a custom request or a Layer & Loop Manufacturing enquiry is sent, your browser completes a Cloudflare Turnstile check. It protects our quote, upload and ordering system from automated abuse such as scripted uploads and fake orders. Cloudflare looks at technical signals from your browser and connection (such as your IP address, browser and device characteristics, and how the page is used) to tell people from bots. It does not receive your model file, your contact details or your quote.

When the check passes, our server confirms the result with Cloudflare and sets a cookie named “ll_hv” that lasts 2 hours. It contains no identifier, only signed proof that the check passed, and is sent only to our own upload, quote and order functions. The check is not used for analytics or advertising and does not depend on your cookie choices.

Cloudflare runs the check for us and, as a separate controller, also uses the signals to maintain and improve its bot detection under its own privacy terms. Our lawful basis is our legitimate interests in keeping the service secure. Because the check is needed to provide the quote and ordering service you are using securely, we treat it as strictly necessary rather than asking for cookie consent.

Saved quotes (“email me this quote”)

If you ask us to email you a quote, you are choosing to send it to yourself so you can come back to it. To do that we upload and store the model file(s) for that quote, together with your email address and the quote details (settings, quantities and price), and email you a private link to review and order it. This is a step you ask us to take before any contract; the tick box on the quote form records your request and that you understand the file and email address will be stored.

We use your email address only to send you that quote and to reply about it or the resulting order. We do not add you to a marketing list or send marketing from it. The private link is the access key to the quote, so treat it like a personal link.

A saved quote and its uploaded file(s) are held for 7 days, after which the quote, the stored email address and the uploaded model file(s) are automatically deleted. If you place an order from the quote, that order is then handled and retained under the order sections of this notice, and the quote's own copy is still removed on the same 7-day schedule.

Quotes we prepare and send you

If we price a job for you and send you a link to your quote, we record when that link is opened, how many times, whether you start the order form from it, and whether it is opened after the quote has expired. We record only those dates and times and the count, not your IP address, device, location or anything else you do on the site. We use it to know whether, and when, to follow up on the quote you asked for, which is our legitimate interest. It is kept with the quote and deleted with it. You can object at any time by emailing [email protected].

Quote journey analytics

We collect coarse first-party service statistics such as the number of quotes and stages reached, plus price, weight and print-time bands and totals by material, quality and colour. These are written directly into daily aggregates: we do not store a visitor reference, filename, exact price, contact detail or event-level record for this measurement. It is used only to understand and improve the quote service. You can object free of charge by turning off Anonymous service statistics under Cookie settings.

Separately, if you accept Analytics, we create a random reference for the current browser tab and record the timestamp, sanitised model filename, exact estimated quote value, weight/time and pricing breakdown, any discount applied, selected print settings, quantity, colour, which version of the quote screen you were shown, and the furthest quote or checkout stage reached. While your quote is open we also record which part of the quote or checkout you are on, with times (including when you switch tabs or leave the page and roughly how long you spent interacting), so we can see where people get stuck. We use it to improve pricing and ordering. Because it is linked to a browser-tab reference and can include a filename, we treat it as personal information, not anonymous data.

The filename is metadata only—it is not the model contents. The record does not include your name, email, delivery address, notes, uploaded model contents or an IP address as an analytics field. It remains in first-party analytics hosted with the service and is not sent to any third party.

The reference is stored only in session storage, is not shared between tabs and is removed when Analytics is withdrawn. Detailed records are deleted after 90 days. Avoid personal or confidential wording in a filename.

If you estimate but do not order, the quote tool does not receive your actual model, name, email or delivery address. Depending on your choices it may add only the coarse daily statistics above or retain the limited detailed journey information, alongside a cookie-choice record and limited security data.

Information we collect

Purposes and lawful bases

• Quotes and order requests: steps you ask us to take before a contract.
• Payment reminder for an order you placed but did not pay: steps you ask us to take to complete that order, and legitimate interests in following it up. One automatic reminder is sent, and we may send further reminders by hand, while the order can still be paid.
• Manufacture, communications and delivery: performance of the contract.
• Payments: contract and legitimate interests in administering payments and preventing fraud.
• Tax and accounting records: legal obligation.
• Security, the pre-quote security check and necessary rate limiting: legitimate interests in operating and protecting the service.
• Recording when a quote link we sent you is opened or an order is started from it: legitimate interests in following up a quote you requested, subject to your right to object.
• Anonymous daily quote statistics: legitimate interests in improving the service, using the PECR statistical-purposes exception and subject to your right to object.
• Detailed quote journeys, provider analytics, advertising and conversion matching: consent for the relevant category.
• Enquiries: pre-contractual steps or legitimate interests in replying.
• Rights requests and complaints: legal obligations and legitimate interests in managing and evidencing a response.
• Showing public Google reviews and their photos: legitimate interests in showing genuine customer feedback; you can ask for removal.
• Photos of prints of publicly available models on our website and social media: legitimate interests in showing our work; you are not identified, and you can object (opt out or ask for a photo to be taken down) at any time.
• Photographing or featuring your own or private designs, or photos you send us: your permission (consent), which you can withdraw at any time.

Cookies and similar technologies

This includes cookies, sessionStorage, localStorage, pixels, tags and scripts. Optional tracking is off by default. Anonymous service statistics are collected as coarse daily aggregates unless you object in Cookie settings. Analytics controls detailed first-party quote journeys and provider analytics. Advertising controls ad measurement, ad click attribution and matching. Optional functionality controls Google Places; its search text is sent to Google only after you enable it and use address lookup. Manual address entry remains available.

Rejecting optional categories does not prevent quoting or ordering. Anonymous service statistics have a separate control so you can object to those as well. You can withdraw or change any choice through Cookie settings in the footer. A change stops future processing; it does not undo already-aggregated statistics or processing that occurred while consent was active.

Advertising conversion matching

With Advertising consent, supported contact identifiers such as email and postcode may be normalised and transformed using SHA-256 for Google matching. A hash used for matching remains personal information. Providers may also receive order value, currency, timestamp, event ID and advertising interaction information. Plain contact values are not put in URLs or the matching field. Model filenames, model contents and customer notes are excluded. No matching request is made after rejection or withdrawal.

Photos and marketing

Google reviews. Reviews posted on our Google Business Profile are public. We may show them on our website and social media, including the reviewer's name, rating, review text and any photos, as they appear on Google. If you'd like your review or photo taken down from our site, email us and we will remove it promptly.

Prints of publicly available models. If a model you order is publicly available (for example on MakerWorld or Printables), we may photograph the print we made and show the photo on our website and social media, where the model's licence allows it. We never publish your model file, and never show your name, address or order details. If you'd rather we didn't, say so in your order notes, and you can ask us to take a photo down at any time; we will remove it promptly. Your own or otherwise private designs, and photos you send us, are only used with your permission, which you can withdraw at any time.

To ask for a removal, withdraw permission or object, email [email protected].

Who receives information

• OVHcloud (OVH): website, order, uploaded-model and technical data needed to host the service.
• SMTP2GO: recipient address and transactional email content.
• Stripe: payment details entered directly with Stripe; we receive payment status and transaction metadata.
• Royal Mail (through its Click & Drop service): your name, delivery address and email address, which Royal Mail uses to send tracking updates, plus the order reference, order value and parcel details needed to buy postage.
• Cloudflare: browser and connection signals for the security check before quoting (never your model, contact details or quote).
• Google: optional Places search text, and consented Analytics/Ads event data.
• Our workshop: the model and production G-code are copied to our own print-farm computer and printers to manufacture the order. These are our own systems, not a third party.
• Production contractors: for some custom, specialist or larger production orders we may use an external manufacturer to produce or finish part of the work. Where we do, we share only what that job needs, typically the production file(s), material, colour and specification, and delivery details where they dispatch it. We require the contractor to keep it confidential, use it only for your order and delete it once the job is complete. A contractor used this way acts on our behalf as our processor.

A provider or contractor may act as a processor, joint controller or independent controller depending on the service. Some providers or contractors may process data outside the UK; where they do, we rely on appropriate safeguards, and verified transfer arrangements require periodic owner review. Contact us for more information.

How long we keep information

• Uploaded models and production files stored on our website: within 30 days after your order is dispatched, cancelled or refunded. Working copies on our own workshop computer and printers are not yet deleted on an automatic schedule; we will delete them if you ask.
• Saved quotes you email yourself (quote details, email address and uploaded file): 7 days, then automatically deleted.
• Quotes we prepare and send you, with the record of when the link was opened: 30 days after the quote expires, then deleted with their files.
• Unreferenced temporary/failed uploads: 24 hours.
• Detailed quote journeys: 90 days; genuinely aggregate counters may be retained longer.
• Unpaid orders: we may cancel an order that stays unpaid, and no later than 30 days after you placed it. The model files of a cancelled order are deleted 30 days after cancellation. The cancelled order record, with your email address, is kept with our order records.
• Order, payment, tax and accounting records: up to six years; model filenames are removed with model files.
• Consent choices: reviewed/re-prompted at least every 12 months or when purposes materially change.
• General enquiries: normally 12 months after closure.
• Reviews and photos used on our site or in marketing: while they are in use; removed promptly if you ask, object or withdraw permission.
• Privacy requests and complaint records: normally 3 years after closure.
• Server/security logs and provider-side analytics/advertising data: actual rotation depends on configured provider accounts and is subject to owner verification.
• Encrypted backups of order, quote and analytics records (never model files): kept only for disaster recovery. Our server keeps about 30 days of nightly backups. The off-site copy is not yet deleted on an automatic schedule, so information deleted from our live systems can remain in an off-site backup for longer.

Your rights

Email [email protected] to:

• get a copy of the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• ask us to delete your information, where that right applies;
• restrict or object to how we use it, take a portable copy, or withdraw consent you have given;
• raise any other question or concern about your personal information.

Depending on the circumstances, these rights include access, correction, erasure, restriction, objection, portability, consent withdrawal and rights concerning solely automated significant decisions. Rights are not absolute; we will explain any applicable exemption. You have a particular right to object to processing based on legitimate interests. Requests are normally answered within one month, subject to lawful extensions.

We do not use customer information to make solely automated decisions producing legal or similarly significant effects. With Advertising consent, Google may perform measurement, audience selection or profiling under its own notices.

Data-protection complaints

Email [email protected] with the subject “Data protection complaint”. We will acknowledge a complaint within 30 days, investigate appropriately, keep you informed if it continues and communicate the outcome without undue delay.

You may also complain to the Information Commissioner's Office. Contacting us first is not a condition of contacting the ICO.

Layer & Loop Manufacturing

The managed production service (Layer & Loop Manufacturing) is operated by the same controller, Layer and Loop Store Ltd. When you use it we process the information needed to quote, produce, support and dispatch a production order.

This can include your contact and company details and billing/delivery information; the model/production files you upload and their revision metadata; production estimates, formal quotes and quote history; sample records; Approved Production Specifications; production orders and batches; payment records (card details go directly to Stripe — we receive status and transaction metadata); your communications with us; and quality-assurance records where they contain information about you. Where you have separately agreed retention for repeat or recurring manufacture, we also retain the approved production file for the agreed period.

Purposes and lawful bases. Quoting and production requests are steps taken at your request before, and then to perform, the production contract. Keeping financial and tax records is a legal obligation. Operating, securing and improving the service relies on our legitimate interests. Retaining an approved production file for future repeat runs relies on your consent, which you can withdraw. Uploaded ordinary files are deleted within 30 days after the order is dispatched, cancelled or refunded; a file you have asked us to retain for repeat production is kept for the agreed period and then deleted on request, subject to records we must lawfully keep. Order, payment and accounting records are kept for up to six years.

Fulfilment on your behalf

Direct-to-recipient fulfilment is not currently offered as a public service; it is a controlled capability that is not enabled by default. Where it is deliberately enabled and you (a business customer) supply your own end-recipient details solely so we can pack and dispatch orders on your behalf, you are normally the controller of that recipient information and we act as your processor for that fulfilment processing. That data can include the recipient's name, postal address and any contact details you supply, an order reference and tracking information, including where imported by CSV. We use it only to fulfil and dispatch on your instructions, disclose it to the delivery carrier (e.g. Royal Mail) as needed, secure it, and retain or delete it in line with the fulfilment arrangement. When the capability is enabled we put in place written data- processing terms covering this role. For our own purposes — such as running and securing the service and meeting our legal obligations — we act as controller.

Security and changes

We use reasonable technical and organisational measures, restricted manager access, unguessable file references, validation and rate limiting. No online service can promise absolute security.

We update this notice when processing, providers, retention, tracking or relevant obligations materially change. Where appropriate, we will provide additional notice of a material change.