Privacy

We process account or guest-session details, contact information, confirmed delivery coordinates and instructions, uploaded model files, print settings, order history, support messages and limited security/diagnostic records. Paystack processes payment credentials; Tomo stores payment references and status rather than card details.

Information is used to verify your email, calculate and fulfil orders, communicate progress, prevent abuse, provide support and improve service reliability. During Tomo’s early product-development stage, customer journeys may also be recorded briefly so Tomo can diagnose confusing interactions and technical failures in the 3D viewer, slicer, map and checkout. Form fields are masked, payment pages are not recorded, and these diagnostic replays are available only to Tomo’s owner and automatically deleted after about 26 hours. The visible 3D canvas may include the model being inspected. This limited processing is carried out for Tomo’s legitimate interest in making the service reliable and usable. Visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland are not recorded by this system, and neither is any visitor whose country cannot be determined.

Tomo also measures whether advertising leads to a paid order. Google’s Consent Mode defaults advertising and analytics storage to denied; storage is enabled only when you allow anonymous journey and ad-performance measurement, and ad personalisation remains disabled.

Only the information needed for a task is shared with service providers such as payment, email, hosting, advertising measurement and delivery partners. Replay country eligibility is checked locally using IP2Location LITE data; the visitor’s address is not sent to a geolocation provider or retained as replay metadata. Paid-order measurement sends Google Ads the order value, currency and a transaction reference for duplicate prevention, but not the customer’s model, email, phone number or delivery address. A courier receives delivery details only when fulfilment reaches dispatch. Customer messages may be processed by Tomo’s support tools, with consequential actions verified by Tomo’s systems.

Models are private order resources and are not public showroom content. Diagnostic session replays expire after about 26 hours and can be deleted sooner by Tomo’s owner. Other records are retained only as long as reasonably needed for fulfilment, accounting, security, disputes and reprints. Email hello@tomo.co.ke to request access, correction or deletion where applicable.