Privacy
How we look after your photo and details
Last updated October 2026.
Who we are
Malleable makes personalised figurines from customers' photos. For any question about your data, or to use your rights below, contact us at the email address at the bottom of this page.
What we collect
When you order on this website: your name, email address, delivery address, the photo you upload, any notes you give us, your order and approval choices, and payment confirmation from Stripe (we never see or store your card details).
When you approve a preview or ask for changes, we record what you chose, the time, your IP address and your browser type, as a record of your approval.
If you order on Etsy, Etsy shares your order details with us under Etsy's own privacy policy, and you send us your photo through Etsy.
Why we use it
To make, show you and deliver the figurine you ordered, and to contact you about it (the legal basis is our contract with you).
To keep records of approvals, payments and refunds, and to meet our tax and accounting obligations (legal obligation and legitimate interests).
We don't use your photo for marketing, and we never show your figurine to anyone else, unless you give us separate permission.
The people in your photo
When you order, you confirm you have permission from everyone in the photo to have a figurine made of them. Please only send photos of people who have agreed.
Who processes it for us
We use trusted service providers to run Malleable: Stripe (payments), Supabase (secure database and file storage), Vercel (website hosting), Modal and an AI 3D-generation service (turning your photo into a 3D model), and Resend (emails). Some of them process data outside the UK; where they do, they use safeguards approved under UK data protection law. They may only use your data to provide their service to us.
How long we keep it
Your photo and 3D model files are deleted 60 days after your figurine is delivered (or after a refund).
We keep order, approval and payment records for as long as the law requires for accounting (normally 6 years).
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it (we'll delete your photo and model straight away if you ask, although we must keep payment records). You can also complain to the Information Commissioner's Office (ico.org.uk).
Cookies
The customer pages don't use advertising or tracking cookies. Your private order link works without any cookies.