Privacy policy
Last updated 12 October 2026
The data controller for personal data processed by Trinketforge is:
Asen Vapordzhiev, trading as Trinketforgeul. "Dravski boy", g.k. Nadezhda 2, Sofia, Bulgaria
support@trinketforge.com
Questions and data requests: privacy@trinketforge.com.
What we collect, and why
- Your email address — to create your account and send sign-in links. Necessary to perform our contract with you.
- Your plan, credit balance and a record of each download (the model, the format, the time, and the settings you typed) — to meter your allowance, to support you if a file is lost, and to keep accurate business records. Necessary for the contract, and for our legitimate interest in running the service.
- A session cookie — to keep you signed in. See the cookie policy.
We do not use advertising or tracking cookies, we do not profile you, and we do not sell or share personal data for marketing.
What we never receive
Card details go directly to our payment provider; they never reach our servers. The 3D models you create are generated in your browser and are not uploaded to us — we record that a download happened and the settings used, not the file.
Who processes data for us
- Vercel — hosting, and server logs including IP addresses
- Neon — the database, hosted in Frankfurt, Germany
- Resend — sending sign-in emails
- Lemon Squeezy, LLC — payments, invoicing and VAT, as merchant of record
Some of these are based outside the EU. Where data leaves the EU it is transferred under the European Commission's standard contractual clauses.
How long we keep it
Account data for as long as the account exists, and for 30 days after you delete it. Records tied to a payment are kept for as long as accounting law requires. Sign-in tokens expire within 24 hours; sessions within 60 days.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its processing, or receive it in a portable form. Email privacy@trinketforge.com and we will respond within one month. If you are unhappy with the outcome you may complain to your national data protection authority — in Bulgaria, the Commission for Personal Data Protection.