Privacy notice

Who we are

Misla is the trading name of Alexandre Ashade Lassance Cunha, of Santos, Brazil, who decides what happens to the data described here and answers for it. Write to hello@mislastudio.com about anything on this page.

This notice is written to meet the Brazilian data protection law (LGPD), the EU General Data Protection Regulation and the UK GDPR, whichever applies to you.

What we collect, and where it comes from

From Patreon, when you sign in. Your Patreon account number, your name and your e-mail address, and your membership: which plan you are on, whether it is active, whether the last payment went through and when it renews. We also keep the sign-in tokens Patreon gives us, so that the site can check your plan again without asking you to sign in every time. We never see your card or your bank details.

When you use the site.

• Which models you have opened each month, which is what your allowance counts.
• Every file you build: the model, the measurements you entered, the file's name, size and fingerprint, the time, and a serial number written into the file. The serial is linked to your account in our records only — the file itself carries no name, e-mail address or account number.
• Your answer to the withdrawal question in clause 3.4: when you gave it, the version of the terms you saw, and a copy of the confirmation e-mail we sent you.
• Reviews you post: the stars, the text and the dates. A review is shown on the model page with your first name and the initial of your surname.
• If you hold a Commercial certificate: the name and country you asked us to put on it. Each time anybody checks a serial, we record the serial, the answer and the time.
• Your sign-in session: when it started and when it was last used, and a scrambled fingerprint of your browser's identification string, so that a stolen session cookie is harder to use from another browser.

Your IP address. The full address is held only in the server's memory, for a minute or an hour, to stop one address flooding the site, and it is never written down. Where we do keep a record — a file you built, your answer to the withdrawal question, a check of a certificate serial — we store a shortened form of the address the request came from, which identifies a network rather than a single device. Our own server logs record the page asked for, the result and the time — and, for a download, the account's internal number — but no IP address.

Cookies

We set exactly two cookies, both strictly necessary, so we do not ask before setting them:

There are no advertising cookies and no tracking pixels, and the site loads nothing — no scripts, fonts or images — from anybody else's server.

We do count where visitors come from, without a cookie. When you arrive through a link we placed on another site, the link carries a tag naming that site and the design or page it was on. We add one to a daily total for that tag, and if you sign in from that page, one to that day's sign-ins for the tag (and to its paid sign-ins, if your plan is a paid one). We keep those totals for two years. Nothing else goes with them: no cookie, nothing that identifies you or your device, and nothing tied to your account.

Why we use it, and on what legal basis

• To provide the subscription you asked for (performance of the contract): signing you in, checking your plan, counting your allowance, building your files, issuing a certificate, and showing your reviews.
• Because the law requires it (legal obligation): recording that you gave up the withdrawal right on purpose and sending you the confirmation, and keeping the records consumer and tax law expect of a business.
• To keep the site and the designs safe (legitimate interests): limiting requests, keeping shortened IP addresses and logs to investigate abuse, and the serial in each file, which lets us trace a file that has been passed on against the licence.
• Showing your name to anybody who checks your certificate's serial rests on your consent, which you give by asking for a certificate with that name on it. You can withdraw it at any time; withdrawing it ends the certificate, as clause 3.8 explains.

We do not sell your data, we do not show advertising, and we do not build marketing profiles.

Who else handles it

• Patreon takes the payment and handles sign-in. It does so as a separate business under its own privacy policy.
• Amazon Web Services, in the United States (us-east-1), runs the server and the database the site uses, and holds our passwords and keys in its Secrets Manager.
• Cloudflare sits in front of the site, carries the encrypted connection and keeps copies of public pages close to you. It sees the IP address and the request of everyone who visits.
• Zoho sends our e-mail, from hello@mislastudio.com.

Your data is therefore stored and processed in the United States, and passes through Cloudflare's network wherever you are. Each of these providers handles it under its own data-processing terms, which include the standard contractual clauses for transfers out of the European Union and the United Kingdom.

How long we keep it

These are the limits we work to. Deleting at them automatically is not built yet, so until it is, older records stay until we remove them — and you can ask us to remove yours at any time.

How we look after it

Every connection to the site is encrypted. The database sits on an encrypted disk on our server, readable only by the account the site runs under, and the passwords and keys the site needs are kept in Amazon's Secrets Manager rather than on that disk.

Your rights

Wherever you live, you may ask us to:

• tell you what we hold about you, and give you a copy;
• correct it;
• delete it;
• send it to you, or to somebody else, in a common machine-readable format;
• stop using it where we rely on legitimate interests, or withdraw a consent you gave.

Some records we must keep even if you ask — the withdrawal answers and certificate records, for instance, exist to prove what was agreed — and if that applies we will tell you which and why.

How to ask

E-mail hello@mislastudio.com. There is no button for this on the site yet, so we deal with every request by hand, and we answer within 15 days.

You may also complain to the data protection authority: in Brazil the ANPD, in the United Kingdom the Information Commissioner's Office, and in the European Union the authority of the country where you live or work.

Changes to this notice

When this notice changes, the new version goes up here with a new date. If a change affects how we use data we already hold, we will tell you by e-mail first.