Privacy Policy

FSH Labs is a small fabrication shop, not an advertising business. We collect what we need to quote your job, make it, take payment, and get it to you. We do not sell your data and there is no advertising tracker on this site. We do measure how the site is used, with PostHog; the Cookies section below says exactly what that records.

Order details. What you ordered, the file, material, options and quantity you chose, the price, your email and the contact and delivery details you give at checkout, whether you are collecting or having it shipped, and the state of the order.

Review requests. Once your order is picked up or delivered, we email you once to ask how it turned out, with a link to leave a Google review, and send at most one reminder if you don't open that link. We record whether the link was opened, nothing about what you write; reviews live on Google under its own privacy policy.

Payment details. Card data goes directly to Stripe and never reaches our servers. What comes back to us is whether the payment succeeded, and the last four digits and card brand that Stripe shows on the receipt.

Design files. The laser drawings you order from, and any artwork or images you send for a custom job. The next section is specific about when a file leaves your browser.

Account details. Only for shop products, and only if you create an account: your name, email address, an optional phone number, and a password. The password is handled by our commerce backend and is never visible to us in readable form.

Messages. The description you write on a custom-order request, and anything you send us by email.

Text messages. If you text us, or text JOIN to opt in, your mobile number and the messages you send, which we use only to reply about your inquiry, order, or account. Reply STOP at any time and we stop texting you. SMS Privacy: No mobile opt-in data will be shared with third parties for marketing or promotional purposes.

Quote requests. If you ask for a bulk or custom quote, your name, email, optional company, the quantity, an optional date and what you wrote. It is emailed to the shop so we can reply, and not stored on the site.

How you found us. If you answer the optional "How did you find us?" question, your answer, and any words you type for "Other".

How you use the site. Pages visited, clicks, how far a quote got, and a recording of the visit with form entries hidden, through PostHog. The Cookies section has the detail.

Newsletter. If you subscribe, your email address, and nothing else.

Instant quotes stay in your browser. When you drop a laser file (.dxf, .svg) on a quote page, it is read and measured in your browser to work out the price. Nothing is uploaded while you quote.

At checkout. When you check out an instant quote, the file is uploaded and stored with Vercel Blob so we can make the part, and our server recomputes the price from it.

Custom-order requests. On the custom order form, a file you attach is read in your browser to draw a preview. That preview image is sent to an AI model for a rough size and complexity estimate (see below). When you send the request, the file is uploaded and stored with Vercel Blob so we can quote and make it, and a link to it goes to our shop inbox. If the upload fails, we ask you to reply to our confirmation email with the file instead.

Shop products. When you add a configured shop product to your cart, any artwork you supplied is stored by our commerce backend as an order asset, together with the production file we generate from it. It stays attached to that order line so we can make it, re-run it if something goes wrong, and repeat it if you reorder.

Retention. A file and the order it belongs to are kept as long as needed to make, ship and support the order, including a remake or a repeat run you ask for, and to meet tax and accounting obligations. If you want your files removed sooner, ask and we will delete them - see below.

We use your files to quote, make, and support your order and for nothing else. We do not sell them, license them, publish them, or add them to our catalog. If we want to photograph a finished part for our work page, we ask you first.

When you send a custom-order request, an AI model gives the person who quotes it a head start. To do that we send it:

• the preview image of your file, drawn in your browser;
• the category, material and quantity you chose;
• the description you wrote.

It does not receive the file itself, your name, or your email. The request goes from our server to OpenRouter, which routes it to Anthropic's Claude model (Anthropic's privacy policy). OpenRouter may serve that model from Anthropic directly or from a cloud provider that hosts it. The answer is used to estimate size and complexity and to sort the request for the person who quotes it. A person reviews every custom quote before we commit to it. If you would rather a file was not processed this way, describe the job in words, send the file by email once we reply, and we will quote it by hand.

We set one first-party cookie, vendure-auth-token. It is the session token that identifies your shop cart before you sign in and your account after you do. It is HTTP-only, so page scripts cannot read it, it is restricted to this site, and it lasts a year unless you sign out.

Older visits may still carry a cart_token cookie from a previous version of the cart. It is no longer issued and clearing your cookies removes it.

Stripe sets its own cookies on its payment pages and form for fraud prevention, and Cloudflare Turnstile collects what it needs to run its check. Those are governed by their own privacy policies, linked above.

We use PostHog to understand how the site is used. It stores a random visitor ID in a first-party cookie and in your browser's local storage, and records the pages you visit, the buttons you click, whether a quote reached checkout, and a recording of the visit. Everything typed into a form is hidden from those recordings, and the files you upload are never sent to PostHog; only their type and size are. When you pay for an order, the order and your email are linked to that visitor ID so we can see which pages lead to orders. The same goes for a quote request: your name, email and company are linked to that ID, but not what you wrote. Recordings are kept for 30 days.

To know which marketing works, we also keep a note of how you first arrived, in your browser's local storage: the date, the first page you landed on, the website that linked you (its domain only), and any campaign tags or ad click IDs in that link. It goes with your order to Stripe and PostHog when you check out, or with a quote request when you send one. We also note in local storage whether you have seen a price and whether you answered or closed the "How did you find us?" question, so it is asked rarely and never again once answered. None of this is kept when your browser sends Do Not Track.

Our server also logs each page request to PostHog: the address of the page, your browser's user-agent string, the page that linked you and your IP address. That is how we tell visitors apart from search-engine and AI crawlers, which never run the analytics script.

If your browser sends a Do Not Track or Global Privacy Control signal, PostHog records nothing, from the browser or from our server. There is no advertising or social-tracking script on this site, and fonts are served from our own domain, not from a font CDN.

Transactional email - order confirmations, quotes, account verification, password resets, and status updates - comes from chaz@fshlabs.com. You cannot opt out of these while you have an open order, because they are how we run the job.

The newsletter is separate and entirely optional. Ask us and we will remove you from the list.

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete your design files, or ask us to close your account and delete it. We will do it, and we will tell you when it is done.

Two limits are worth stating plainly. We keep the records of completed orders that we are required to keep for tax and accounting purposes, and payment records live with Stripe under their own retention rules. Everything else, including your design files, we can remove.