Privacy Policy

1. Introduction

xrprints is operated by Mobilefunk, based in the Netherlands. We sell personalized printed products (greeting cards, posters and custom builds) with a 3D or Augmented Reality experience. This policy explains what personal data we process, why, and what your rights are under the General Data Protection Regulation (GDPR) and Dutch law.

2. Data controller

Mobilefunk
The Netherlands
Email: info@mobilefunk.nl

3. What we collect

• Order and delivery data: the recipient's name and address, your email address, what you ordered and the amount paid. Payment is processed by Stripe; we receive a payment confirmation and the last digits of the card, never the full card number.
• Your design: the text, photos and videos you add to a product, and the composed card front. While you edit, drafts are stored only on your own device (in your browser). They reach our servers when you choose "Save and order", or when you save a card to your account.
• Account data: name, email address and password (stored hashed). If you sign in with Google or Facebook we receive your name, email address and an account identifier from them.
• Scan data: when a card is opened (scanned with a phone, via the QR code or in the 3D preview), the phone opens a web page that loads the design and the effect. The camera image is processed on the phone only, to find the printed card. It is never recorded, uploaded or stored by us. We do keep statistics about each opening (see section 8).
• Technical data: IP address, browser type and the pages you visit, in server logs and in our analytics (see section 8).
• Messages: what you send us through the contact form or by email.

4. Why we process it and on what basis

• To print, ship and deliver your order and the digital experience that belongs to it (performance of a contract).
• To send order confirmations, shipping updates and replies to your questions (contract, legitimate interest).
• To keep your saved designs so you can reorder them (contract, and your consent when you create an account).
• To keep the site secure, prevent fraud and abuse, and understand how the site is used so we can improve it (legitimate interest).
• To meet legal obligations such as tax and bookkeeping rules (legal obligation).
• Marketing emails only if you opted in; every email has an unsubscribe link (consent).

5. Who we share data with

Only parties that help us deliver the service, and only what they need:

• Print partner: receives the print file and the delivery name and address.
• Shipping carriers: receive the delivery name and address, and tracking data.
• Stripe: processes payments (Stripe's own privacy policy applies).
• Email provider (SendGrid): sends transactional emails on our behalf.
• Hosting and analytics providers: see sections 8 and 10.
• Google / Facebook: only if you choose to sign in with them.

We never sell personal data, and we never use your photos or videos for anything other than producing your product and its digital experience.

6. How long we keep it

• Orders, invoices and delivery data: 7 years (Dutch tax law).
• Designs and uploaded media of an ordered card: while the card is active (6 months after the order, longer if you extend it) and 60 more days, so you can still extend it. Drafts you have not ordered: until you delete them or your account. You can delete a card yourself in My cards at any time.
• Drafts on your device: stay in your browser until you clear them or your browser removes them.
• Account data: until you delete your account, plus a short backup period.
• Contact messages: up to 2 years.
• Server logs: up to 90 days.
• Card opening statistics: IP addresses are shortened after 90 days (the last part is removed), so they can no longer be linked to a connection. The other statistics are kept for as long as the card is active.

7. Your rights

You can ask us to access, correct, delete or export your personal data, to restrict or object to processing, and you can withdraw consent at any time. Account holders can delete their account in the account settings. For anything else, email info@mobilefunk.nl; we respond within one month. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Cookies and analytics

We use essential cookies to keep you logged in, protect forms against abuse and remember your preferences, including your cookie choice. Analytics cookies are only used with your consent, which you give or refuse in the cookie banner and can change at any time via "Cookie settings" at the bottom of every page. With consent we use Google Analytics, PostHog and Microsoft Clarity (which also records anonymised page interactions such as clicks and scrolling) to understand which pages are used and where things go wrong; IP addresses are shortened. Without consent, Google Analytics and PostHog only send anonymous measurements without cookies or other storage on your device, and Clarity is not loaded. We do not use advertising cookies.

Statistics when a card is opened. Each time the page of a card is opened, we record the date and time, the IP address, the type of device, the operating system and browser (with their versions), the screen size, the browser language and time zone, the web page that linked to it, whether the card was recognised in Augmented Reality, and how long the page stayed open. We use this to see how often and how well cards work, to improve the AR experience and to detect abuse (legitimate interest). No cookies are placed for this and the data is not combined with advertising data. Unique visitors are counted with a code that cannot be traced back to a person. Openings by our own staff, search engines and link previews are not recorded.

9. Security

Connections are encrypted with HTTPS, passwords are hashed, payment data is handled by Stripe (PCI DSS Level 1), uploads are checked for type and size, and access to order data is limited to people who need it to fulfil orders.

10. International transfers

Our servers are in the European Union. Some providers (Stripe, Google, SendGrid, PostHog, Microsoft) may process data in the United States under the EU-US Data Privacy Framework or standard contractual clauses. When you enter a delivery address, we check it with an address service: PDOK (Dutch government) for addresses in the Netherlands and Google Address Validation for other countries.

11. Children

Our products are often given to children, but our service is for adults. We do not knowingly collect personal data from anyone under 16, and there are no accounts, chats or advertising aimed at children in the scan experience.

12. Changes

We may update this policy; the date at the top shows the latest version. Material changes are announced on this page.

13. Contact

Questions about privacy? Email info@mobilefunk.nl or use the contact form.