Privacy Policy

Last updated: October 2026

1. Information We Collect

FabFront collects and processes information required to deliver a professional operating system for custom manufacturing shops and their end buyers:

  • Shop Operator Accounts: Names, business email addresses, company names, physical shop addresses, and billing credentials provided during tenant onboarding or subscription management.
  • Customer & Order Data: Customer contact names, email addresses, phone numbers, shipping addresses, order specifications, and communications exchanged via the customer project portal.
  • 3D CAD Models & Technical Assets: User-uploaded geometries (STL, STEP, OBJ, 3MF, and slice G-code files) and associated technical specifications required to calculate volumetric pricing and execute fabrication.
  • Authentication & Security Tokens: Cryptographically verified Firebase Authentication session tokens and Google OAuth identity records.
  • Automated Bot Defense: Cloudflare Turnstile verification telemetry collected at public intake points to prevent automated abuse without tracking cross-site user identities.

2. Third-Party Sub-Processors

To maintain high availability, secure payment flows, and edge computing speed, FabFront integrates with trusted enterprise infrastructure sub-processors:

  • Cloudflare (Edge Workers, D1 SQLite, R2 Storage): Provides global edge application runtime hosting, distributed relational database storage, and private encrypted object storage for 3D model files.
  • Google Firebase Authentication: Manages secure user identity validation, password encryption, and multi-factor authentication.
  • Stripe & Stripe Connect: Handles end-to-end card payment processing, merchant onboarding, sales settlement, automated platform application fees, and subscription billing. FabFront never stores raw credit card numbers.
  • EasyPost: Calculates real-time carrier shipping rates, performs address verification, and issues printable carrier shipping labels.
  • Resend: Delivers transactional email notifications, quote review links, and customer order status alerts.

3. Multi-Tenant Data Isolation

FabFront enforces strict, zero-trust multi-tenant data architecture at the database and storage layers. Every customer profile, CAD geometry, quote request, and financial invoice is partitioned strictly by Tenant Organization ID. Customer data submitted to a specific shop is accessible exclusively by that shop’s verified operators and never leaks across tenant boundaries. We do not aggregate, harvest, train AI models upon, or sell your proprietary customer lists or CAD geometries to third parties or competing manufacturers.

4. Data Retention & Self-Serve Deletion

We retain operational data for as long as a tenant shop maintains an active account. Shop operators may execute complete, automated tenant offboarding at any time via Settings → Danger Zone, which immediately purges active D1 database records, deletes associated R2 storage buckets, and disconnects custom subdomains. Encrypted system recovery snapshots expire after a rolling 30-day disaster-recovery retention cycle. End customers who have placed orders with a shop may request deletion of their personal records by contacting the respective shop operator or emailing [email protected].

5. Contact Us

For privacy inquiries, data export requests, or regulatory compliance questions, please contact our Data Protection team at [email protected].