At Stencil Lab, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, share, and protect your data when you use our web application.
1. Information We Collect
1.1 Account Information
- Email Address: Used for account creation, login, and communication
- Password: Encrypted and securely stored (we never store plain-text passwords)
- Account Preferences: Settings, display preferences, notification preferences
1.2 User-Generated Content
- Uploaded Images: Photos you upload for stencil conversion
- Generated Stencil Files: Output files (SVG, DXF, PDF, PNG) created by our service
- Project Metadata: Project names, layer counts, color settings
1.3 Usage Data
- Device Information: Browser type, operating system, screen resolution
- Usage Analytics: Pages visited, features used, session duration
- IP Address: For security, fraud prevention, and geographic analytics
- Cookies: Essential cookies for authentication and preferences (see Section 9)
1.4 Payment Information
- Billing Details: Processed by Stripe (we do not store full credit card numbers)
- Transaction History: Invoice records, subscription status, refund requests
1.5 Physical Orders and Delivery
- Delivery Details: Recipient name, shipping address, and contact details you provide for a physical order
- Order Details: The stencil ordered, delivery instructions, and shipment tracking information
2. How We Use Your Information
We use your data for the following purposes:
2.1 Service Delivery
- Process uploaded images and generate stencil files
- Store and retrieve your projects
- Authenticate your account and maintain session security
- Process payments and manage subscriptions
- Produce, dispatch, track, and support physical stencil orders
2.2 Service Improvement
- Analyze usage patterns to improve features
- Identify and fix technical issues
- Develop new features based on user needs
2.3 Communication
- Send service-related notifications (account changes, subscription updates)
- Provide customer support
- Send optional marketing emails (you can opt-out anytime)
2.4 Legal Compliance
- Comply with legal obligations (tax reporting, DMCA requests)
- Prevent fraud and abuse
- Enforce our Terms of Service
3. Data Sharing and Third Parties
We share your data only with trusted service providers under strict agreements:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication, Database, Storage | Email, uploaded images, stencil files and customer-support messages |
| Vercel | Web Hosting | IP address, usage logs |
| Stripe | Payment Processing | Email, billing information |
| Resend | Deliver service emails and contact-form enquiries | Email addresses, names and the relevant message or order information |
| Cloudflare Turnstile | Protect forms from spam and automated abuse | IP address and browser verification data |
| Fulfilment and delivery partners | Produce and deliver physical orders, and provide tracking | Recipient name, delivery address, contact details where needed, and relevant order details |
We do not sell your personal information to third parties.
4. Data Security
We implement industry-standard security measures:
- Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
- Authentication: Secure password hashing (bcrypt), optional two-factor authentication
- Access Controls: Role-based permissions, audit logs
- Breach Notification: Within 72 hours of discovery (GDPR requirement)
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account Information | Until account deletion + 30 days |
| Uploaded Images & Stencils | Until deletion by user or account closure |
| Payment Records | 7 years (tax compliance) |
| Usage Logs | 90 days |
6. Your Rights
Depending on your location, you have the following rights:
6.1 GDPR Rights (EU/UK Users)
- Right to Access: Request a copy of your personal data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Portability: Receive your data in a structured, machine-readable format
- Right to Rectification: Correct inaccurate data
- Right to Object: Object to processing for direct marketing
- Right to Restriction: Limit how we use your data
6.2 CCPA Rights (California Users)
- Right to Know: What personal information we collect and how it's used
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: Opt-out of sale of personal information (we don't sell data)
- Right to Non-Discrimination: Equal service regardless of privacy choices
6.3 Exercising Your Rights
To exercise any of these rights, email us at [email protected] with:
- Your registered email address
- Description of your request
- Proof of identity (for security purposes)
We will respond within:
- GDPR: 30 days
- CCPA: 45 days
7. Children's Privacy
Stencil Lab is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, contact us immediately at [email protected].
8. International Data Transfers
Your data may be transferred to and stored in countries outside your jurisdiction. We ensure adequate protection through:
- Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
- Data Processing Agreements (DPAs): With all service providers
- EU Data Residency: Option available for enterprise customers
9. Cookies and Tracking
Essential cookies support sign-in, security and the features you request. Optional analytics and advertising tools start only after you accept optional cookies. Rejecting them does not prevent you from using Stencil Lab. You can change your choice at any time using the Cookie settings button.
We use PostHog for product analytics and session replay, and the Google tag for Google Ads conversion measurement and remarketing. Google Analytics is not currently configured on this site. If we add it, we will update this policy and include it in the optional-cookie choice before it starts collecting data.
| Cookie Type | Purpose | Can You Opt-Out? |
|---|---|---|
| Essential | Authentication, security, session management | No (required for service) |
| Analytics | Usage statistics, feature popularity | Yes (Cookie settings; off until accepted) |
| Preferences | Save your settings (theme, language) | Yes (clears on logout) |
Google Ads cookies and related identifiers are used only with your permission for advertising measurement and remarketing. These are optional and can also be rejected or withdrawn using Cookie settings. You can manage stored cookies in your browser as well. Blocking essential sign-in cookies may prevent account features from working.
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via:
- Email notification (30 days before effective date)
- Prominent notice on our website
- Updated "Last Updated" date at the top of this page
11. Contact Us
For questions about this Privacy Policy or data protection concerns:
- Email: [email protected]
- Data Protection Officer: [email protected]
- Response Time: Within 2-3 business days
Company Information
Stencil Lab is a trading name of Tomwellywells Ltd, company no. 14558429, registered office Building 3 North London Business Park, Oakleigh Road South, London N11 1GN. Tomwellywells Ltd is the controller of your personal data. You can also contact us by phone on +44 7734 924346.
12. Supervisory Authority
If you are located in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
This policy explains how we use your information. Optional cookies require a separate choice; continuing to browse does not give consent.