Additional privacy notice: accounts, payments & AI

A. User accounts (sign-in by e-mail link or GitHub)

• When you sign in by e-mail, we send you a one-time sign-in link via Resend (Resend, Inc., USA; EU sending region). With GitHub sign-in we receive your e-mail address, name and profile picture URL from GitHub, Inc. (USA). Sign-in and the account database are operated by Supabase, Inc. on servers in the EU (Frankfurt).
• We store your account, your plan and subscription status, whether you used your free part, and a usage log (time, design session, token counts, cost) to enforce plan limits.
• Legal basis: Art. 6(1)(b) GDPR (providing the account and the contract). You can delete your account at any time on the Account page.

B. Premium payments (Stripe)

• Payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). Stripe receives your name, e-mail, billing address and payment details; we never see your full card or bank details. Stripe may transfer data to Stripe, Inc. (USA) based on EU Standard Contractual Clauses / the EU-U.S. Data Privacy Framework.
• We store your Stripe customer ID, subscription status and renewal date, the time you consented to an immediate start of the service, and cancellations made via “Verträge hier kündigen”.
• Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention of invoices and accounting records for up to 10 years, § 147 AO / § 257 HGB). Stripe's privacy policy: stripe.com/privacy.

1. What is processed

• The text you type into the studio and the conversation history of your current session.
• Photos you choose to attach (resized in your browser before upload).
• Your printer profile values (fit gap, material, printer name) sent with each request.
• Your IP address, which our server converts into a salted one-way hash for rate limiting, and your account ID for plan limits.

Please don't include personal information (names, addresses, faces, documents) in prompts or photos — it is not needed to design a part.

2. Purpose and legal basis

Prompts, photos and profile values are processed only to generate the 3D model you request (Art. 6(1)(b) GDPR — performance of the service you asked for). The hashed IP address is processed to enforce the free daily limit and protect the service against abuse (Art. 6(1)(f) GDPR — legitimate interest in a secure, fairly usable service).

3. Recipients

• Supabase, Inc. (servers in the EU, Frankfurt) runs our backend function that receives your request.
• OpenRouter, Inc. (USA) routes the request to the AI model.
• Anthropic, PBC (USA) provides the AI model “Claude Haiku”; it may be served through cloud infrastructure such as Google Cloud.

Transfers to the USA rely on the safeguards offered by these providers (EU Standard Contractual Clauses and/or certification under the EU-U.S. Data Privacy Framework, where applicable). See their privacy policies for how they handle API data.

4. Storage

• We do not store your prompts, photos or generated models on our servers.
• Usage records (hashed IP, account ID, design session, timestamp, token usage) are deleted automatically after 7 days at the latest.
• Your printer profile and the parts you save are kept only in your browser's local storage on your device. You can delete them at any time by clearing your browser's site data.
• 3D rendering happens entirely in your browser (OpenSCAD compiled to WebAssembly).

5. Automated generation

Models are generated automatically by an AI system and checked by an automated dimension test. No decisions with legal or similarly significant effects are made about you. AI output can be wrong — always verify dimensions and suitability yourself.

6. Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority. Contact us at lioemmerich@gmail.com.