How we handle your photos and data

Who we are

MiniME by MiniMeWonder makes custom 3D-printed figurines from customers’ photos. We are MiniMeWonder, a Portuguese-run business based in Eindhoven (Netherlands), registered with the Dutch Chamber of Commerce (KvK) as Vasco Guedes, under number 99115743, and we are responsible for the personal data described on this page. This website shows what we make and has two optional forms, the free preview request and the newsletter sign-up. Each preview gets its own page at preview.minimewonder.pt, which is where you can order your figurine and pay for it through Stripe (see “Paying on this site”). There are no accounts. You can also order in our Etsy shop, MiniMeWonder: orders, payments and messages there are handled by Etsy under Etsy’s privacy policy. For anything about your data, write to contact@minimewonder.com.

What this site collects

If you simply browse, this site doesn’t ask who you are. It is hosted on Google Firebase, which also serves its fonts and images, so loading a page involves no other company. Data leaves your device in five ways, and each is described below: the free preview form and the newsletter sign-up, if you use them; Google Analytics, which counts your visit but is not allowed to store anything on your device unless you accept; and the Meta Pixel and the OpenAI pixel, which load only if you accept.

The share buttons on the form and on the thank you page open your device’s own share menu or copy a link. We don’t see who you send it to: the link only carries a tag so we can count the visits that come from shared links, and Google Analytics counts the tap.

What is kept on your device

Besides the cookies Google Analytics, Meta and OpenAI set once you accept (described below), the site keeps these small items in your browser. Session storage lives only in the tab you are using and is gone when you close it; local storage stays until you clear this site’s data.

• minime-pixel-consent (local storage): your answer to the cookie banner, so we don’t ask again.
• minime-match (local storage), only after you accept: a random identifier for your browser and, once you send the form, the hashed email described under “The Meta Pixel” (OpenAI receives the same hash, see “The OpenAI pixel”). “Decline” deletes it.
• _fbc (cookie), only after you accept: see “The Meta Pixel” below.
• __oppref and __obref (cookies), only after you accept: see “The OpenAI pixel” below.
• minime-lang (cookie): the language you picked by hand, or in the language banner, for a year. See “The language you read in”.
• minime-currency (cookie): the currency you picked by hand, for a year. See “The currency you see”.
• minime-source (session storage): where your visit came from (for example “facebook” or “google”, and any ad or search tags in the link) and the page you landed on, so our Etsy links and your preview request can say how you found us. It says nothing about who you are.
• minime-currency-param (session storage): the currency named in the link you arrived through, if it names one, so the other pages you open in this tab show prices in it too.
• minime-submit-key (session storage): a random code for your request, so a retry on a bad connection isn’t filed twice. Removed once the request is received.
• minime-newsletter (local storage), only once you sign up: that you joined the newsletter, so the sign-up form shows that you’re in instead of asking again.
• minime-preview-sent (session storage): after you send the form, the address you sent it from, the product, the page you sent it from and a small thumbnail of your photo, so the thank you page can show them back to you. That page deletes it as soon as it has read it.

The free preview form

If you ask for a free preview, you send us the photos you choose, your email address, anything you write in the optional note (for example which figurine or keychain you have in mind) and your tick in the photo permission box. With them go the product page you sent it from, where your visit came from (for example an ad, a search engine or another site, and the page you landed on), the name and version of your browser and device (its user agent) and a hashed version of your IP address, which we use only to stop floods of requests. The request also says which currency the site showed you prices in and how it was chosen: picked by hand, set by the link you followed, from your device’s time zone, from your browser’s language, or by default. We keep both with your request, so we can quote and charge you in that currency. To keep the upload light, your photos are resized in your browser before they are sent.

Your request goes to our own service, which stores it with Google Cloud (Firebase) in Belgium: the photos in Cloud Storage, the rest in a database. We design your preview from your photo with the help of AI. For that, we use outside AI services: one reads your photos, your note and any change you ask for to work out what to make and draws the preview from your photos, and when we also make a 3D model, another turns the drawing into 3D, or the photo if there is no drawing.

Some of these services are based outside the European Economic Area. The one that draws the preview processes your photos and your note in the United States: it doesn’t use them to train its models, and it may keep them for up to 30 days to check for misuse (longer only if the law requires it). That transfer relies on the EU Standard Contractual Clauses in its data processing terms. The 3D service keeps what we send private to our account and out of its training. If you’d like to know more about these providers, or get a copy of these safeguards, write to us. If you’d rather we didn’t make a 3D model, say so in your note and nothing of yours goes to the 3D service.

We email you from our own mailbox, kept by our email provider on servers in the EU: a confirmation straight away, then your preview, then up to four reminders in the weeks after it (for example the day after you first look at it, or a last one before your photos are deleted). If you ask for a change or press a button on your preview page, we answer that too. Each reminder has an unsubscribe link; use it and the reminders stop. Your replies reach the same mailbox.

Your preview has its own page at preview.minimewonder.pt, which anyone with the link can open. The page tells us when it is opened, how long it stays open and how far down it is read, and what is tapped on it (for example the 3D model, the discount code, “Love it”, the button to order or the button to Etsy). The page itself sets no cookies. We use this to decide which reminder to send you, or none, and to see which previews lead to orders. If you pick another language there, your browser remembers it. Because you can pay on the page, it also loads Stripe’s payment script in the background a moment after it opens, so that the payment form is ready if you choose to order. From then on Stripe receives your IP address and browser details and may set its own cookies, which it uses to prevent fraud (see “Paying on this site”).

If our service can’t be reached when you press send, the form uses a backup instead: a form delivery service, which emails your request, photos included, to our mailbox.

Thirty days after you send your request, if you haven’t ordered, your photos, the drawing and the 3D model are deleted automatically from our storage. Copies that reached our mailbox, through the backup or because you replied with a photo, we delete by hand. If you order, we keep them to make your figurine. We keep the rest of the record (your email address, your note, and a log of what we sent you and what happened on your preview page) so we know who we have already written to and which of our ads bring orders. Write to contact@minimewonder.com and we delete all of it straight away, except the record of an order that the law requires us to keep (see “Paying on this site”).

Please only send photos you have the right to share. If the photo shows a child, send it only if you are their parent or guardian, or have the parent’s permission.

Paying on this site

After your free preview, you can order on your preview page and pay there, in Stripe’s payment form, which opens inside the page (Stripe Checkout). Stripe is our payment processor. The card, wallet or bank details you enter (for example Apple Pay, Google Pay, or iDEAL and Bancontact, which you confirm with your own bank) go to Stripe, not to us: we never see your full card number or your bank login. If you choose Klarna, you finish the payment with Klarna, which receives your name, address, email address and the order amount and handles them under its own privacy policy. In the same form you give the name and address the parcel goes to and a phone number for the courier; your email address is filled in from your request, and Stripe sends your receipt to it. Stripe uses your address to work out the tax in the price, and it also processes your payment data under Stripe’s privacy policy, for example to prevent fraud and to meet its own legal obligations. Once its script has loaded on your preview page, Stripe may set its own cookies, which it uses to prevent fraud and keep payments secure.

Once you have paid, Stripe tells our service, which stores the order with your request in our database: what you bought, in which size and how many, the amount and currency, any discount code you used, your email address, and the name, delivery address and phone number from the form. We use them to make and send your figurine, to answer you about your order and, if it comes to that, to refund you. The legal basis is the contract between us. We keep the order record for as long as Dutch tax law requires us to keep our accounts (seven years), even if you ask us to delete everything else.

To make your figurine, we pass its 3D model to our production and shipping partner, together with the name, delivery address and phone number needed to make and deliver your order, whichever way you ordered. The partner prints your piece and hands it to a courier, who receives the same name, address and phone number to deliver it. The customs of a few countries, such as Brazil and South Korea, require the recipient's ID number on the parcel (a CPF or a personal customs code, for example). If yours does, we ask you for it after you order and pass it to the partner and the courier for customs clearance only. The legal basis is the contract between us. Once your order has been delivered, we delete the number from our order records and our mailbox.

If you order in our Etsy shop instead, the order, the payment and any messages are handled by Etsy under Etsy’s privacy policy, and Etsy passes us the details we need to make and send your order.

The newsletter

A sign-up form on this site offers 10% off your first order if you join our newsletter. The page with your free preview makes the same offer; there you don’t type an address, and we sign up the one your preview was sent to. If you sign up, we keep your email address, the language of the page, the page you signed up on, the sentence you ticked and when, and a hashed version of your IP address, which we use only to stop floods of sign-ups. It is stored by our own service with Google Cloud (Firebase) in Belgium. The legal basis is your consent, which you give by ticking the box.

We use your address to send you news about MiniME, new designs, gift ideas and offers, and to give you the 10%: a free preview you ask for from the same address is priced with the discount, and so is one you already have and haven’t paid for yet. We may send these mails through an email service of our choosing, which then handles your address on our behalf. Every mail has an unsubscribe link. You can also write to contact@minimewonder.com and we take you off the list and delete your sign-up straight away. We never sell the list or share it with advertisers.

Google Analytics

We use Google Analytics 4, provided by Google Ireland Ltd, to see how many people visit us, how they found us, which pages they read, and how often a visit leads to a click through to our Etsy shop or a free preview request. It reports this to us as aggregated statistics: we cannot use it to identify you or single you out. Google processes the data under Google’s privacy policy, and uses your IP address to derive an approximate location without storing the address itself.

Analytics behaves differently from the pixel, and the difference is worth stating plainly. Google Analytics runs on every visit, but until you choose “Accept” it is not permitted to store anything on your device: no cookies, no identifier, nothing that could recognise you on a later visit. In that state it still sends Google a cookieless ping for each page and action, with no identifier, which Google uses to estimate overall visitor numbers. Choosing “Accept” lets it set its usual cookies (_ga and similar) so that several visits from you are counted as one person rather than several strangers. Choosing “Decline” leaves it in the no-storage state permanently. Whether or not you accept, what it sends for each page and action also includes the currency the site showed you prices in and how it was chosen (see “The currency you see”).

The Meta Pixel

We advertise on Meta platforms (Facebook and Instagram). If you choose “Accept”, this site loads the Meta Pixel, a small piece of code provided by Meta Platforms Ireland Ltd, and lets it set its cookies on this site: _fbp, which recognises your browser, and _fbc, described below. The pixel tells Meta which pages you view here, when you ask for a free preview and when you click through to our Etsy shop, along with your IP address and browser details. We use it to see which of our ads work, and Meta uses it to decide who to show them to. Meta processes this data according to Meta’s privacy policy, and may link it to your Meta account if you have one.

The pixel loads only after you choose “Accept”, in the cookie banner or, after you send the form, in the question on the thank you page. If you choose “Decline”, no pixel loads and no marketing cookies are set.

If you accept and request a free preview, in either order, the email address you sent the request from is hashed (SHA-256) in your own browser, and the hash, not the address as you typed it, is sent to Meta with the request and with the events that follow in this browser. A hash is not anonymous: Meta can match it to the email on your Meta account, and that is what it is for, so Meta can see that the request came from someone who saw our ad. An address you type into the form but never send is not used. The site also keeps a random identifier for your browser, created by us rather than by Meta, so that several events from you are counted as one person. Both are stored on your device only while your consent stands, and choosing “Decline” deletes them along with the cookies. Your photos are never sent to Meta.

If you had accepted by the time you sent your request, our own service also tells Meta directly (through Meta’s Conversions API) that you asked for a preview and, if you then order, that you bought and what the order came to, before VAT, with the products and an order reference. These events carry the same hashed email address and browser identifier, the Meta cookies as they were when you sent the form, and your browser details: never your name, your address, your phone number or your photos. If you hadn’t accepted when you sent it, nothing about your request or your order is sent to Meta. Choosing “Decline” later on this site does not reach a request you have already sent: write to us and we stop it.

Links in our Meta ads carry a click code (fbclid). If you arrive through one and accept, the _fbc cookie keeps that code for 90 days so Meta can tell which ad brought you. Until you answer the banner nothing is stored: the code only stays in the address of the pages you open here.

The OpenAI pixel (ChatGPT ads)

We also advertise in ChatGPT. If you choose “Accept”, this site also loads OpenAI’s measurement pixel, a small piece of code provided by OpenAI, the company behind ChatGPT, and lets it set two cookies on this site: __obref, which recognises your browser, and __oppref, described below. The pixel tells OpenAI which pages you view here and which products they show, and when you ask for a free preview, along with your IP address and browser details. We use it to see which of our ads in ChatGPT work, and OpenAI uses it to measure and deliver its ads. OpenAI processes this data according to OpenAI’s privacy policy, and may link it to your ChatGPT account if you have one.

It follows the same answer as the Meta Pixel: it loads only after you choose “Accept”. If you choose “Decline”, it doesn’t load, or stops if it had, and its cookies are removed.

If you accept and request a free preview, the pixel sends OpenAI the same hashed email address described under “The Meta Pixel”, never the address as you typed it. If you had accepted by the time you sent your request, our own service also tells OpenAI directly (through OpenAI’s Conversions API) that you asked for a preview, when you first open the payment form on your preview page and the amount it shows, and, if you then order, that you bought and what the order came to, before VAT, with the products. These events carry the hashed email address, the browser identifier the site keeps (also hashed), OpenAI’s two cookies as they were when you sent the form, and your browser details: never your name, your address, your phone number or your photos. If you hadn’t accepted when you sent it, nothing about your request or your order is sent to OpenAI. Choosing “Decline” later on this site does not reach a request you have already sent: write to us and we stop it.

Links in our ChatGPT ads carry a click code (oppref). If you arrive through one and accept, the __oppref cookie keeps that code for 30 days so OpenAI can tell which ad brought you. Until you answer the banner nothing is stored: the code only stays in the address of the pages you open here.

The language you read in

Every page opens in the language of its own address: this site never sends you to another language by itself. If you haven’t chosen a language here before, and your browser asks for one of our other languages in which the page you are reading also exists, a small banner offers you that version instead. Your browser’s language setting is read on your device and never sent to us.

If you pick a language yourself, in the language menu or in that banner, or close the banner, we store your answer on your device in a cookie named minime-lang, which holds the name of a language and nothing else, for a year. It is set only when you answer, it cannot be used to recognise you, and it exists so that the banner doesn’t ask you again and the site keeps the language you chose. Because it does nothing but carry out your own choice, it is not a measurement cookie and does not wait on the cookie banner. Clearing this site’s cookies removes it.

The currency you see

This site shows prices in euros and, where available, in British pounds or US dollars. To decide which, it uses the currency you picked by hand; failing that, one named in the link you followed; and failing that, the time zone your device is set to: a time zone in the United Kingdom, Jersey, Guernsey or the Isle of Man gives pounds, one in the United States or its territories gives dollars, and any other gives euros. If your device is set to a universal time zone such as UTC, or reports none, the region in your browser’s language setting decides instead (for example, British English gives pounds). This choice is made on your device, and it does not send your time zone or your language setting anywhere. Only its outcome leaves your device: the currency and which of these steps chose it (for example “pounds, from the time zone”), with your preview request and in Google Analytics, as described above.

If you pick a currency yourself, we store that choice on your device in a cookie named minime-currency, which holds the currency you picked and nothing else, for a year. It is set only when you pick a currency by hand, and it cannot be used to recognise you. Like minime-lang, it does nothing but carry out your own choice, so it is not a measurement cookie and does not wait on the banner. A currency named in a link is kept in session storage as minime-currency-param: it applies only in that tab and is gone when you close it. Clearing this site’s cookies removes the cookie.

Changing your mind

You can reopen the cookie banner at any time with the “Cookie preferences” link (also in the homepage footer) and change your answer. One answer covers all three tools. If you switch to “Decline” after accepting, the pixels stop sending events, analytics returns to storing nothing, and the cookies they had set are removed. You can also clear this site’s cookies and local storage in your browser settings, which resets your choice.

Who receives your data

We never sell your data. To run the service we share it with these kinds of providers, each receiving only what it needs for its part:

• Hosting, database and storage: Google Cloud (Firebase), which hosts this site, stores your request, your photos, your order and your newsletter sign-up in Belgium, and delivers the notifications that tell us about a new request or order.
• AI image and 3D-modelling services, which turn your photo into the preview and the 3D model: your photos, your note, any change you ask for on your preview page and the drawing (see “The free preview form”). We also use an AI service in our own back office to help us read our figures; it can see what we hold about the requests it looks up for us, including names, email addresses, notes, change requests, order details, delivery addresses and phone numbers (never your photos), and doesn’t use them to train its models.
• Email: our email provider, on servers in the EU, which carries our mails to you and your replies to us, and, only if our service can’t be reached when you send the form, the backup form delivery service.
• Payment: Stripe, our payment processor, for orders paid on this site, and Klarna if you pay with Klarna (see “Paying on this site”).
• Production and shipping: our production and shipping partner, which receives the 3D model and the name, delivery address and phone number needed to make and deliver your order, and the courier who delivers it. Where a country's customs require it, both also receive the recipient's ID number.
• Etsy, only if you order in our Etsy shop.
• Measurement: Google, through Google Analytics, and Meta and OpenAI, through their pixels and only with your consent (see “Google Analytics”, “The Meta Pixel” and “The OpenAI pixel”).

Some of these providers are based outside the European Economic Area, so your data may be processed in other countries. If you’d like to know more about them, or how your data is protected when it leaves the EEA, write to contact@minimewonder.com.

Your rights

Under the GDPR you have the right to access, correct or delete the personal data we hold about you, to object to or restrict how we use it, to receive a copy to take elsewhere, and to withdraw your consent at any time. Write to contact@minimewonder.com and we’ll handle it within 30 days. Data that Meta, OpenAI, Google or Etsy hold about you can also be managed in your account settings on those platforms. If you think we got something wrong, you can complain to a data protection authority, where you live or in the Netherlands, where we are based (the Autoriteit Persoonsgegevens).

Contact

Write to contact@minimewonder.com, or message us through our Etsy shop.