3DM SOLUTIONS · PAKISTAN
Privacy policy.
How we handle your account, cutting plans and recovery emails.
Last updated:
1. Who operates this service
3DM Solutions, Pakistan, operates 3DM Glass Optimizer and this information site at glass.samsinsights.com. Our privacy contact is murtazahaiderint@gmail.com.
This policy covers this website and the separate application hosted at https://3dm-glass-optimizer.3dm-glass.prod.page. This information site has no registration, login or cutting-plan processing. We do not claim that Google, Cloudflare, Turso or Blitz endorses the product.
2. Information we collect
- Registration and account details
- Contact name, business name and at least one contact method: phone/WhatsApp number or email address. Optional details, where supplied, can include city and business type. We record the privacy acknowledgement, the separate optional marketing choice, account creation time and verification status. Registration itself does not verify the supplied contact methods.
- Cutting jobs and quotations
- Pane and stock-sheet dimensions, quantities, material and thickness settings, kerf, job details, generated layouts, validated edits and revisions, leftovers, cutting statistics and quotation/pricing settings. Optional job fields can contain customer names or contact details entered by the account holder. Only supply information you are entitled to share and avoid sensitive personal data.
- Trial and security records
- The three-credit grant, successful optimization debits, saved-job identifiers, retry identifiers, session and expiry records, authentication token hashes, request-rate counters and security/audit events. Contact-derived keyed or hashed markers help identify repeated trials and prevent abuse.
- Requests and correspondence
- Demonstration requests, selected topics, notes, privacy requests, retention-review information and correspondence you choose to send us. Phone-recovery reviews record a staff reference; that reference should not contain verification secrets or unnecessary personal details.
Public attachment uploads are disabled in the planned cloud configuration until suitable persistent storage is available. This static site accepts no uploads or form submissions.
3. Why we use the information
We use account details to create and protect the account, identify the business workspace and provide requested service communications. We use job inputs to calculate, validate, save, revise, quote, print and export cutting plans. We keep a server-controlled credit ledger to enforce exactly three successful new complimentary optimizations and prevent duplicate charges or grants.
We use security information to enforce authorization, investigate abuse and protect customer records. We use demonstration and privacy-request information to respond to the request. Registration does not authorize unsolicited marketing: optional marketing consent is separate, unchecked by default and can be withdrawn.
4. Google user data and Gmail recovery
Purpose and permission. The prepared recovery integration uses the Gmail API over HTTPS to send requested account-recovery emails from murtazahaiderint@gmail.com. Only the operator of that sending mailbox authorizes the Google OAuth permission https://www.googleapis.com/auth/gmail.send. Customers do not sign in with Google or grant access to their own Google accounts.
Data accessed, used and shared. The server uses the sending account’s OAuth authorization, a refresh token and short-lived access tokens to send messages. Google receives the sending and recipient email addresses and the recovery email content, including its one-time recovery link. Google returns a send result and message identifier; we retain delivery status, timing and provider-message metadata to diagnose delivery. The recovery email does not include cutting-plan contents, quotation data or trial balances.
No mailbox-reading permission. The application does not request permission to read inboxes, search or download existing messages, access contacts or calendars, or modify mailbox contents. It uses Google access only for the disclosed recovery-sending purpose. It does not sell Google user data, use it for advertising, share it with data brokers, or use it to train AI or machine-learning models.
Limited Use. We follow the Google API Services User Data Policy, including its Limited Use requirements. Access and any sharing are limited to providing the disclosed recovery service, necessary security or legal obligations and the protections described in that policy. We do not use Google authorization for unrelated marketing or other secondary purposes.
Credential protection and control. OAuth client credentials and the refresh token belong only in encrypted server-side settings on Blitz. They are not included in frontend files, this website or customer exports. Access tokens are held in server memory. The sender can revoke authorization in Google Account connections; revocation prevents further sending until the owner reauthorizes. Customers can request account deletion or contact us without granting Google access.
Gmail may keep copies of sent recovery messages in the sender’s account, and recipient mail systems process and retain delivered messages under their own policies. The authorized mailbox owner can access that mailbox, including sent messages; the application itself does not read them. Do not forward a live recovery email or share its link.
5. How recovery protects existing accounts
Email recovery, when enabled, sends only to the address already registered on the account. A link is single-use and expires after a short period, normally 15 minutes. The application stores a hash of the live recovery token, not the raw link. Successful confirmation invalidates outstanding email links and earlier sessions before issuing a new session. Recovery restores the original saved plans and credit balance; it never resets the trial or grants extra credits.
Phone-only accounts cannot receive email recovery. New phone-only registrations receive a private recovery key. The application stores only its hash. Using or rotating a key invalidates the previous key. If an account holder has no usable session or recovery key, staff must verify control of the existing registered phone before issuing replacement access. A name or claimed phone number alone is insufficient. If ownership cannot be verified, we cannot disclose saved business data or restore access.
6. Storage, hosting and service providers
| Provider | Role and information involved |
|---|---|
| Cloudflare Pages | Hosts this static information site. Cloudflare processes connection details such as IP address, browser/request information and security signals to deliver and protect the pages. No customer database or Gmail credentials are supplied to Pages. |
| Blitz.cloud | Hosts the separate Node.js optimizer application and its server-side runtime configuration. Customer requests are processed there; application sessions and business records persist in Turso rather than relying on the container’s local files. |
| Turso | Stores application records: registration, saved plans and revisions, credit ledger, sessions, authentication hashes, consent and administrative/security records. |
| Google / Gmail | Processes OAuth authorization and requested recovery emails as described above. It does not receive saved cutting-plan contents through our recovery integration. |
Providers may process information outside Pakistan or your own country. We do not promise a particular storage region or that all processing takes place in one country. Provider privacy notices are available from Cloudflare, Blitz, Turso and Google.
Authorized staff may access records as necessary to support accounts, administer trials, respond to requests or investigate security issues. We may disclose relevant information when required by applicable law. We do not sell customer information or make saved plans publicly accessible.
8. Retention and deletion
Account details and saved plans are retained to operate the workspace and let account holders return to previous jobs. There is no automatic deletion of an entire account when a session expires or the three credits are exhausted. Expired authentication records are subject to technical cleanup; expiry blocks use of an expired link or session even before cleanup runs.
Account holders can request reviewed deletion or retention. Staff verify identity, ownership and any active retention hold before completing deletion. Completed deletion removes active contact and cutting-plan content and revokes access. Minimal pseudonymous credit, audit and keyed contact-suppression records remain where necessary to preserve trial integrity, prevent repeat grants and meet security or legal needs. These records are not used to rebuild deleted cutting plans.
Backups and provider-held copies may retain earlier information until their applicable retention periods expire. A restore must reapply completed privacy deletions and security revocations. Messages already sent to Gmail or a recipient’s mailbox are not erased by deleting the application account; contact us about sender-held copies, and manage recipient copies through your own email provider. A request may be limited where retaining specific information is necessary for legal or security obligations.
9. Your choices and privacy requests
When customer access is open, signed-in account controls allow account-data export, withdrawal of optional marketing consent, and requests for reviewed deletion or retention. You can also ask about access, correction, deletion or other rights available under applicable law by emailing murtazahaiderint@gmail.com. We verify identity before disclosing or changing private account data.
Do not email passwords, Google OAuth credentials, active recovery links, private recovery keys or unnecessary sensitive information. Withdrawing marketing consent does not remove access to valid saved plans or change trial credits. Revoking the sending mailbox’s Google authorization stops Gmail-based recovery but does not create a new trial or erase the database.
10. Security and policy changes
We use server-side authorization, validated requests, secure sessions, transactional accounting and expiring recovery tokens to protect the service. No system can guarantee absolute security. The information site contains no database credentials and cannot access application records.
We will update this policy if the service or its data practices change and revise the date above. Material changes to Google-data use require updated disclosures and any consent required by Google or applicable law before the new use begins.