Privacy Policy

This Privacy Policy describes how Vonnda LLC, doing business as STL Stash, collects, uses, shares, and protects information when you use the STL Stash website, web application, desktop applications, APIs, and related services (collectively, the “Service”).

Contact us:

• Privacy questions: [email protected]
• General contact: [email protected]
• Mailing address: Vonnda LLC, 475 Coloma St. Suite 285, Sausalito, CA 94965

3.1 Information You Provide Directly

Account information: Email address, password (stored hashed), display name, preferences.

Billing information: Processed by Stripe. We do not store credit card numbers. We retain transaction records for accounting and tax purposes.

User Content: 3D files (STL, 3MF), thumbnails, metadata, tags, collections, notes, checklists, reference images, and sharing configurations.

Communications: Support emails, survey responses, feature feedback.

3.2 Information Collected Automatically

IP address, browser type, OS, device type, referring URL, pages and features used, frequency of use, error reports.

3.3 Information from Third Parties

Billing status from Stripe, email delivery reports, authentication signals, anti-abuse data.

Connected storage (Dropbox): If you connect Dropbox on a Bring Your Own Storage plan, we access the files, folders, and basic account information you authorize through the Dropbox API, solely to provide the Service. See Section 7.1 for exactly what we read, write, and delete.

3.4 Information We Don't Collect

We don't collect your real name (unless volunteered), date of birth, government IDs, contacts list, precise location, or biometric data.

We use third-party services to operate STL Stash. Each is bound by contract to protect your data and may only process it on our instructions. We will update this list when we add or change subprocessors, with at least 30 days' notice for material changes.

• Stripe - payment processing and subscription billing.
• Cloud storage and hosting - storing files and running the Service (for accounts using STL Stash storage).
• Email delivery - transactional and account emails.
• Dropbox - optional connected storage for Bring Your Own Storage accounts (see below). We are independent developers on the Dropbox API; Dropbox does not sponsor or endorse STL Stash.

7.1 Connected Storage: Dropbox

If you choose a Bring Your Own Storage (BYOS) plan and connect your Dropbox account, you authorize STL Stash to access your Dropbox through the official Dropbox API using OAuth. You can review and revoke this access at any time from your Dropbox account settings (Connected apps), or by disconnecting Dropbox inside STL Stash.

Here is exactly what STL Stash does with that access:

• Read: We read the files and folders you grant access to in order to detect Prints, generate thumbnails, extract metadata, build your searchable index, and run AI organization features. Reading happens to provide these features to you.
• Write: When you upload or import files through STL Stash, or save changes that affect file organization, we write those files and folders into your Dropbox on your behalf. We do not write to your Dropbox for any purpose unrelated to operating the Service for you.
• Delete: We delete files or folders in your Dropbox only when you explicitly delete them within STL Stash. We never delete your Dropbox content automatically, in bulk, or without a direct action from you.

We do not keep a separate permanent copy of your BYOS files on our servers. Your files remain in your Dropbox under your control. We store only the metadata, thumbnails, and index we generate to make your library searchable and organized. We never sell Dropbox data, never use it to train AI models, and never share it with third parties for their own purposes. Disconnecting Dropbox stops all access immediately; your files stay exactly where they are.

International Data Transfers

If you are in the EEA, UK, or Switzerland, your data may be transferred to the United States. We rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards. Contact [email protected] for details.

No system is perfectly secure. If a security incident affects your data, we will notify you per Section 13.

Universal Rights (All Users)

EEA / UK / Swiss Residents (GDPR)

Additional rights: restriction of processing, data portability, withdrawal of consent, right to lodge a complaint with your supervisory authority.

California Residents (CCPA / CPRA)

Right to know, delete, correct, and opt out of sale. We do not sell or share personal information for advertising. Email [email protected] with “California Privacy Rights” in the subject line.

How to Make a Request

Email [email protected] from the email on your account. We respond within 30 days (45 for complex requests).

What We Use

Strictly necessary: Session/auth cookies, CSRF tokens, Stripe payment cookies.

Functional: Preferences, UI state, recently-viewed Prints.

Analytics: Aggregate usage analytics with a privacy-focused provider. IP addresses anonymized.

What We Don't Use

No advertising cookies, no cross-site tracking, no social media pixels, no remarketing tags, no third-party ad networks.

Your Choices

In jurisdictions requiring consent (EU, UK), you'll see a cookie banner. You can accept, reject non-essential, or customize. Global Privacy Control (GPC) is honored.

The Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, contact [email protected].

If a security incident affects your personal information, we will notify the relevant supervisory authority within 72 hours (where required) and notify affected users without undue delay, including what happened, what data was involved, what we're doing, and what you can do.

With subprocessors: As described in Section 7, under contract.

With users you choose: When you share Prints or Collections.

With legal authorities: When required by valid legal process. We verify requests and push back on overbroad ones.

In a business transfer: If STL Stash is acquired, your information may transfer to the acquirer, bound by this policy.

We never share for: advertising, data brokers, cross-context behavioral advertising, or anyone offering to buy it.

The Service uses AI to group files, suggest tags, and power search. These are suggestions, not decisions with legal effect. You always review and approve. We do not use automated profiling to make decisions that affect you legally.

AI Training: We do not train any AI model on your User Content. Our contracts with AI providers prohibit them from retaining your data for training.

We honor the Global Privacy Control (GPC) signal. Because we don't sell or share personal information for advertising, the practical effect is limited - but we recognize the signal.

Minor changes: we update the date. Material changes: at least 30 days' notice by email. If you disagree, you may close your account before the change takes effect.

California Residents

Categories collected in the past 12 months: identifiers (email, IP), commercial information (transactions), internet activity (usage data), and User Content. Categories sold or shared: none.

EEA / UK Residents

Data controller: Vonnda LLC, 475 Coloma St. Suite 285, Sausalito, CA 94965. You have the right to lodge a complaint with your local data protection authority.

For any privacy question, request, or complaint:

Email: [email protected]
Vonnda LLC (d/b/a STL Stash)
475 Coloma St. Suite 285
Sausalito, CA 94965
United States

We respond within 30 days (45 for complex requests).

By using the Service, you acknowledge that you have read this Privacy Policy and understand how we collect, use, share, and protect your information. If you do not agree, do not use the Service.