Controller expertpal UG (haftungsbeschränkt) – Nettelbeckstr. 15, 40477 Düsseldorf, Germany Managing Director: Illya Konovalov – E-mail: [email protected] Scope: This privacy policy applies to replitoy.com, related sub-pages, our marketplace presence on Etsy in the scope described, and our online services and tools. Effective date: 3 October 2026.

1. Legal Bases & Principles

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) on the following legal bases:

• Art. 6(1)(b) GDPR (contract performance and pre-contractual steps): processing orders, custom manufacturing, customer communication, and support.
• Art. 6(1)(a) GDPR (consent): optional web analytics and explicit permissions for portfolio display.
• Art. 6(1)(c) GDPR (compliance with statutory obligations): statutory commercial and tax retention duties as well as mandatory consumer confirmation receipts pursuant to Section 356a BGB.
• Art. 6(1)(f) GDPR (legitimate interests): IT security, system stability, fraud prevention, and bot monitoring on public transparency endpoints.

We implement appropriate technical and organisational measures in accordance with Art. 32 GDPR. We do not perform automated decision-making or profiling producing legal effects concerning individuals (Art. 22 GDPR).

2. Storage and Access on Terminal Equipment (§ 25 TDDDG)

Pursuant to Section 25 of the German Telecommunications-Telemedia Data Protection Act (TDDDG), we distinguish between strictly necessary technical storage and storage requiring prior consent:

• Strictly Necessary Storage (§ 25(2) No. 2 TDDDG): Accessing information stored on your terminal equipment or storing information is carried out without requiring prior consent when it is strictly necessary to provide the telemedia service explicitly requested by you:
  • Shopping Cart State: Stored locally in your browser (localStorage) to persist items, quantities, and configuration options across page navigation.
  • Session & Security State: Stored to maintain secure requests and prevent unauthorized cross-site requests.
  • Consent Preference (rt_consent): Stored in a browser cookie (rt_consent) recording the consent schema version, your analytics choice (granted or declined), and the timestamp. This cookie has a storage duration of 12 months, is set with Path=/, SameSite=Lax, and Secure attributes, and contains no user identifier or personal tracking profile.
• Storage Requiring Prior Consent (§ 25(1) TDDDG): Storing or accessing cookies and device identifiers for web analytics (Google Analytics 4) is performed exclusively after you have granted explicit consent through our consent banner or settings dialog.
• On-Demand Customer Support Chat: Our customer support chat (Crisp) is not loaded when visiting our pages. No scripts or tracking technologies of the chat provider are executed until you affirmatively click the chat launcher button.
• Withdrawing Consent and Adjusting Settings: You can inspect or modify your consent choices at any time via the "Cookie settings" link in the website footer. Revoking consent immediately updates your preference, removes Google Analytics cookies from your browser, and reloads the page.

3. Web Analytics (Google Analytics 4)

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Purpose: Measurement of website traffic and aggregated performance analysis.
• Legal Basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (prior explicit consent).
• Data Processed: Page URL, document title, referrer URL, anonymized telemetry events, browser viewport dimensions, browser language setting, timestamp, and the GA4 measurement identifier G-YLCSVR8ZBD. IP addresses are truncated and anonymized by Google.
• Withdrawal: You can revoke consent at any time using the "Cookie settings" link in our footer. Revocation immediately disables the analytics scripts and triggers the deletion of _ga, _gid, _gat, and _ga_* cookies.

4. Customer Support Live Chat (Crisp)

• Provider: Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France.
• Trigger: Loaded strictly on demand when you affirmatively click the "Open support chat" button.
• Data Processed: Website identifier 0ca2aef5-bfab-4359-92ef-81e9cc591a69, selected user interface language, message text, and file attachments submitted by you during the chat session.
• Purpose & Legal Basis: Direct customer communication and processing of support inquiries pursuant to Art. 6(1)(b) GDPR.

5. Order Processing, Custom Manufacturing & Customer Visuals

• Personalised Figurine Production: To manufacture custom figurines, keychains, and voxel models, we process customer-submitted photographs, reference illustrations, text annotations, and optional logo graphics under Art. 6(1)(b) GDPR.
• Cloud Storage (DigitalOcean Spaces): Uploaded customer photos, reference files, and proof images are stored on DigitalOcean Spaces in the Frankfurt (fra1) data centre in Germany. Uploaded files are stored under unique object keys with upload timestamp metadata.
• Minors: When uploading images depicting minors, the ordering customer must ensure that parental or guardian consent has been obtained.
• Portfolio & Marketing Use:
  • Original customer photos are never published without prior explicit consent.
  • Photographs of finished manufactured products may be displayed in our portfolio in accordance with our Terms. Where individual persons are recognizable on the finished product, we obtain explicit consent prior to publication.
  • You may revoke portfolio consent at any time with effect for the future by sending an email to [email protected].

6. Payment Processing via Stripe

• Provider: Stripe Technology Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland.
• Purpose: Processing online payments through hosted checkout sessions.
• Data Transmitted from Our Server: Ordered line item titles, descriptions, amounts in euro cents, quantities, product image URLs, currency, automatic tax calculation flags, and internal configuration metadata (configId). Customer payment card details, billing address, and email address are collected directly by Stripe on the hosted checkout page and are not stored on our servers.
• Legal Basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (secure payment processing).

7. Transactional Email Delivery via Mailjet

• Provider: Mailjet SAS (Sinch), 4 rue Jules Lefebvre, 75009 Paris, France.
• Purpose: Sending essential transactional emails, including order confirmations, digital proof approval requests, Care & Restore repair acknowledgements, Voxel Crew inquiries, and statutory withdrawal receipt confirmations.
• Data Processed: Recipient name, recipient email address, subject line, template identifier, template parameters (order ID, approval link, invoice URL, receipt text, reference numbers), message body, and relevant file attachments.
• Legal Basis: Art. 6(1)(b) GDPR (contract communication) and Art. 6(1)(c) GDPR (compliance with statutory requirements under Section 356a BGB).

8. Shipping & Delivery via DHL

• Provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.
• Purpose: Generating parcel shipping labels and delivering physical shipments.
• Data Transmitted: Recipient full name, delivery address (street, house number, postal code, city, country code), package dimensions, weight, and order reference number.
• Legal Basis: Art. 6(1)(b) GDPR (fulfilment of delivery obligations).

9. Assisted Manufacturing & AI Technologies

We use specialized processing and machine-learning tools to assist in manufacturing and administrative preparation:

• Checkout Photo Inspection (Google Cloud Vertex AI / Gemini, with OpenAI Fallback): When you open the order review modal prior to checkout, the uploaded photo is analyzed using Google Cloud Gemini (or OpenAI as fallback) to detect the number of figures and accessories. Data transmitted: base64-encoded image data, MIME type, and a structured analysis prompt. Purpose & Legal Basis: verifying order parameters and preventing configuration errors prior to payment under Art. 6(1)(b) GDPR.
• Administrative Address Parsing (Google Cloud Gemini): In our administrative order backend, customer shipping address text pasted by staff is parsed into structured postal fields using Google Cloud Gemini. Data transmitted: raw address string and country code. Legal Basis: Art. 6(1)(b) GDPR.
• Administrative Sketch and Silhouette Generation (OpenAI / Google Gemini): In our administrative order management system, staff may execute image transformation tasks on customer-provided order attachments to prepare silhouettes or artistic sketch variations. Data transmitted: reference image binary data and processing prompt parameters. Legal Basis: Art. 6(1)(b) GDPR.
• Administrative 3D Model Generation (Tripo3D): For generating 3D models from orthographic perspective drawings in our administrative production pipeline, staff may transmit 2 to 4 perspective drawings to Tripo AI. Data transmitted: image bytes and MIME type of admin-selected perspective drawings (upload filename image) and generation parameters (model_version, quad, face_limit, geometry_quality). No customer name, email address, order ID, or original customer photos are sent to Tripo AI. Legal Basis: Art. 6(1)(b) GDPR.

10. Marketplace Orders (Etsy)

For orders placed via our shop on Etsy, Etsy Ireland UC (and Etsy, Inc.) acts as an independent controller. We receive customer order information (name, shipping address, ordered items) solely to fulfill the purchase contract under Art. 6(1)(b) GDPR. Product catalog synchronization is conducted via authenticated API integration.

11. Command Center Bot Tracking on Factory Transparency Endpoints

• Our website publishes factory transparency metrics at /factory/status.json and /factory. To monitor automated consumption, evaluate server capacity requirements, and protect server stability against scraping abuse, incoming HTTP requests to these endpoints are analyzed for bot and crawler signatures.
• Data Processed & Stored: Client IP address, user-agent header string, country header (cf-ipcountry or x-country), referer header, requested path, and request timestamp.
• Storage Location: Stored in our PostgreSQL database hosted on DigitalOcean in Frankfurt, Germany.
• Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in infrastructure stability, abuse prevention, and measuring transparency data usage).

12. Server Logs & Technical Infrastructure

Each visit to our web servers generates technical server log entries containing client IP address, date and time, requested resource path, HTTP status code, referrer URL, and browser user agent.

• Purpose & Legal Basis: Ensuring IT security, detecting cyberattacks, and technical troubleshooting under Art. 6(1)(f) GDPR.
• Retention: Server logs are deleted or anonymised after 7 to 30 days.

13. Customer Communication & Direct Marketing

• Direct contact via email: processed to answer your request under Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
• Existing customer communications: We may inform existing customers about similar goods or services in accordance with Section 7(3) UWG; you may object to such communication at any time without incurring costs.

14. Social Media Links

External platforms are linked using standard hyperlinks without embedded tracking pixels or social plugins. No personal data is transmitted to social media networks unless you click the respective link.

15. Withdrawal Form

If you use the electronic withdrawal function on our website, we process the information you submit through the form (such as name, email address, order or contract reference, scope of withdrawal, and submission timestamp).

• Purpose: Receipt, logging, and processing of your withdrawal declaration, as well as the immediate transmission of a confirmation of receipt on a durable medium pursuant to Section 356a BGB.
• Legal basis: Art. 6(1)(c) GDPR (compliance with statutory obligations under German civil law, in particular Section 356a BGB) and Art. 6(1)(b) GDPR (execution and reversal of the contract).
• No marketing use: Personal data collected via the withdrawal form is processed strictly for handling the withdrawal and fulfilling statutory record-keeping obligations. It is never used for advertising or marketing purposes.
• Retention period: The withdrawal declaration and associated plain text receipt are retained for the duration of statutory retention and limitation periods (generally 3 years for proof under the standard civil limitation period of Section 195 BGB, and up to 6 to 10 years where commercial or tax retention obligations under Section 257 HGB and Section 147 AO apply).

16. Retention & Deletion Periods

• Accounting, commercial, and tax records: 6 to 10 years pursuant to statutory retention mandates (§ 257 HGB, § 147 AO).
• Customer photos and personalisation media: retained during manufacturing and subsequent statutory warranty buffer periods, after which they are securely deleted, unless explicit consent for portfolio display has been granted.
• Server access logs: 7 to 30 days.
• Bot tracking logs: retained for operational analysis and capacity planning.

17. Obligation to Provide Data

Providing personal data required for concluding and fulfilling purchase orders (contact details, delivery address, manufacturing inputs) is contractually necessary. Without these details, custom figurines cannot be produced or delivered. Consenting to web analytics or optional cookies is completely voluntary.

18. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR) to your stored data,
• Rectification (Art. 16 GDPR) of inaccurate data,
• Erasure (Art. 17 GDPR) of data no longer required,
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Withdrawal of consent (Art. 7(3) GDPR) at any time with future effect.

Special Notice: Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(e) or (f) GDPR. Where data is processed for direct marketing purposes, you have the right to object at any time without giving reasons.

To exercise your rights, please contact us at: [email protected].

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), such as the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

19. Updates

We will update this policy when laws, services, or processes change. The current version is available at https://replitoy.com/privacy.