Privacy Policy

In accordance with the GDPR (EU) 2016/679

1. Controller

David Bohler — HolzBau 3D
43, Kneppchen, L-8538 Hovelange, Luxembourg
E-mail: info@holzbau3d.app

2. What data we collect

• Account data: username, e-mail address (required — without it the account cannot be confirmed and no password can be reset), password (stored only as a hash, never in plain text), language setting and the time and number of logins
• Payment data: processed exclusively by Stripe — we do not store any card details
• Usage data: the time of your last login, the time of your last activity (updated at most every five minutes) and a usage statistic recording which features of the app are used. We store only your account identifier, a technical name for the feature (e.g. “cutting plan”), whether the feature was used or locked behind your plan, your plan at that moment, and the time. The content of your constructions is not recorded — neither dimensions nor part names nor calculations. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR). You may object at any time in your profile; statistics already collected are then deleted.
• Time spent in the planner: while you work in the planner, it reports about once a minute how many seconds you were active — counted only while its window is in the foreground and you made an input in the last minute. We store your account identifier, a random number per planner session, start and last report, the active seconds, your plan, the width of the browser window (rounded to 10 pixels), the language set and whether the notice for small screens was shown. We also record the day on which you looked at the prices with a free account (the date only) and, for a purchase attempt, from which locked feature you went to the checkout. The content of your constructions is not recorded, and no cookies are set for this. Purpose: understanding how long and how often the planner is used and where people get stuck. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR). If you object to the usage statistic in your profile, this is no longer recorded either and what was recorded is deleted. Reports and price days are deleted with your account, and at the latest after 13 months; the checkout information belongs to the purchase attempt and is deleted with it.
• Purchase attempts: when you click “Subscribe”, we record the attempt: your account identifier, the plan chosen, the time and the outcome — paid, abandoned or technically failed, with the reason in case of an error. No payment data is included; that is handled solely by Stripe. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR): if a purchase fails because of an error on our side, we can only help you if we know about it. These records are deleted together with your account.
• Clicks on the home page: we count which buttons on the home page are clicked. All we store is a counter per day, button and language — no identifier, no IP address, no cookie and no time of day. There is no attribute by which an individual visitor could be recognised; no personal data arises from this. The legal basis for this anonymous counting is our legitimate interest in improving the site (Art. 6(1)(f) GDPR).
• Saved projects: if you save a project on the server, we store the model and its name in our database. This includes the entries from the project data sheet if you filled them in — among them the location of the building project. This happens only on your explicit action; nothing is uploaded automatically. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Your projects are visible only to your own account. You can delete them individually in the editor under “My projects”; deleting your account removes them entirely. If you save to a file on your own device instead, the data never leaves your computer.
• Share addresses: if you share a project via a view link, we store the e-mail addresses you unlock it for — these are usually addresses of other people (e.g. your carpenter, structural engineer, client). They are used solely to deliver the access code and to check access; they are not used for advertising and not passed on. A view link is valid for 7 days and is deleted automatically afterwards, together with the associated addresses. If you revoke the share earlier or delete the project, they are removed immediately. The shared view contains no project data sheet entries, in particular not the location. Please only enter addresses of people who agree to receive the message.
• Feedback from the app: if you send us a message via the “Send Feedback” button, we store the subject and text, your account identifier and the time. In addition, a screenshot of the editor and the current state of your model are sent — the feedback window has two boxes for this, which are preselected. If you untick one, that item is not transmitted; before sending you see a preview of the image. The model and image may contain entries from the project data sheet, including the location. The legal basis is our legitimate interest in finding errors (Art. 6(1)(f) GDPR); feedback is deleted together with your account.
• Reasons for cancelling: if you cancel your subscription, we ask for the reason after the cancellation. Answering is voluntary — the cancellation has already taken effect when the question appears. We store the reason chosen, any free text, your account identifier and the time. The legal basis is your consent (Art. 6(1)(a) GDPR); the data is deleted together with your account.
• Business module (quotes and invoices): if you create a quote or an invoice, we store your letterhead details (company name, address, tax number, logo) as well as the names and addresses of your customers and the line items of the documents. This data concerns other people for whom you are responsible; we process it solely to let you create and keep the documents. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).
• E-mail news (newsletter): if you tick the box when signing up or in your profile to receive e-mails with news about the features and offers for HolzBau 3D Premium, we store the time of your consent, where you gave it (sign-up or profile), which version of the consent text you saw, the time of your confirmation and, where applicable, the time you withdrew it; every consent, confirmation and withdrawal is kept with its time, even if you subscribe again later. Your consent only becomes valid once you confirm it via the link in the confirmation e-mail sent to your address and there with “Yes, confirm” (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future — in your profile or via the unsubscribe link in each of these e-mails; this does not affect the lawfulness of processing up to that point. We keep the consent records as proof for as long as your account exists and delete them with the account. Without consent you only receive e-mails that belong to your account (e.g. confirmation, password, subscription). We use Brevo to send them (see section 5).
• Your business website and interest in a website: when signing up or in your profile you may voluntarily enter the address of your business website. Separately, you may tick that you are interested in a professional website for your business and that we may contact you about it by email. We store the address of your website, whether and since when you ticked the interest, where (sign-up or profile) and which version of the text you saw; every tick and every withdrawal is recorded with its time. The legal basis is your consent (Art. 6(1)(a) GDPR). Without the tick we will not contact you; the address then only appears in your profile. Only HolzBau 3D itself will contact you; we do not pass the information on. You can change or delete it in your profile at any time and withdraw your consent with effect for the future; this does not affect the lawfulness of the processing carried out until then. Everything is deleted at the latest with your account.
• Planning service: If you order the planning service, we store with the order your account, name and e-mail address, package, amount, the times of order, payment and delivery, the payment identifiers at Stripe, and the time, language and version of your consent to the start before the withdrawal period ends (as proof). In addition, we store the information you give us for the planning — in the online form or by e-mail: dimensions, heights, terrain, wishes, photos of the site, sketches and PDFs and, if you wish, one of your projects. Uploaded images are stored without location data (GPS data is removed). We process this data only to create and deliver your plan; the legal basis is the performance of the contract (Art. 6(1)(b) GDPR), and for the proof of your consent and the purchase records our legal obligations (Art. 6(1)(c) GDPR). Your photos, sketches and PDFs and the copy of your project are deleted automatically 90 days after delivery or after a cancellation; we keep the delivered plan and your information as long as the order exists, so that you can access it on your order page. If you delete your account, your information, files, the delivered plans and our notes on the order go with it; only the purchase data remains, as long as statutory retention obligations require.
• Technical data: IP address (temporarily, for brute-force protection)
• Server logs: when the website is accessed, our hosting provider automatically logs access data (IP address, date and time, page requested, browser type). These logs serve technical operation and security and are deleted automatically after a short period.

3. Purpose of processing

• Providing the HolzBau 3D service
• Managing user accounts and subscriptions
• Sending transactional e-mails (verification, password reset, subscription confirmations)
• Sending e-mails with news and offers (only with your consent)
• Protection against abuse (brute-force protection)
• Audience measurement and advertising funding (only with your consent)

4. Legal basis

Processing is based on Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(f) GDPR (legitimate interest in the security of the service) and — for analytics and advertising cookies — Art. 6(1)(a) GDPR (consent). You may withdraw consent at any time via the cookie settings. We likewise only send e-mails with news and offers with your consent (Art. 6(1)(a) GDPR); you can withdraw it in your profile or via the unsubscribe link in each of these e-mails.

5. Third-party services

Stripe Inc. (payment processing)
Stripe processes payment data under its own privacy policy. More information: stripe.com/privacy

Railway Corp. (hosting)
The app is hosted on Railway. More information: railway.app/legal/privacy

Brevo (Sendinblue SAS, France) — e-mail delivery
We use Brevo for transactional e-mails (account verification, password reset, subscription confirmations, reminders) and — if you have subscribed — for e-mails with news and offers. Your e-mail address and name are transmitted to Brevo. More information: brevo.com/legal/privacypolicy

Cloudflare Turnstile (protecting sign-up from bots)
To stop programs from creating accounts in bulk, we check sign-ups with Cloudflare Turnstile by Cloudflare, Inc. (USA). This only happens on the sign-up page. Your browser loads a script from Cloudflare for this; Cloudflare processes your IP address and technical characteristics of your browser and device to tell whether a human is filling in the form. Usually this is invisible; occasionally a small box asks for one click. When you submit the form, we ask Cloudflare whether the check was passed and transmit your IP address. We store none of this; we only count how many sign-ups were rejected per day, without reference to any person. The legal basis is our legitimate interest in the security of the service (Art. 6(1)(f) GDPR). More information: cloudflare.com/turnstile-privacy-policy

Google Analytics 4 (audience measurement)
We use Google Analytics to understand how our website is used (page views, time on page, approximate origin). The IP address is processed in truncated form. The Google script is loaded together with the page. However, it starts with the default setting “consent denied” (Google Consent Mode): as long as you have not given consent, no analytics or advertising cookies are set and measurement is anonymous and without recognition. More information: policies.google.com/privacy

Google AdSense (advertising)
Advertising by Google AdSense may be displayed on the guide pages and in the editor of the free plan. The AdSense script also loads on the home page and the pricing page, but no ads are shown there. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and other websites. When ads are served, Google and other third parties may place and read cookies in your browser or use web beacons and your IP address to collect information.

We obtain consent for advertising through Google’s consent management, which is registered in the IAB Transparency & Consent Framework. Depending on your choice, Google shows personalised or non-personalised ads. If you do not consent to information being stored on or accessed from your device, Google serves at most so-called limited ads; for these Google uses cookies or local storage only to detect fraud and invalid traffic. Premium users see no advertising in the app.

How Google uses personal data when you give consent on this website is explained by Google at business.safety.google/privacy.

Amazon Associates programme (affiliate links)
HolzBau 3D participates in the Associates programme of Amazon Europe Core S.à r.l. (Luxembourg). The planner contains affiliate links to amazon.de in the shopping cart and — in the free plan — in a line marked as an advertisement. As an Amazon Associate we earn from qualifying purchases. Nothing from Amazon is loaded when you open our pages, and we do not send any data to Amazon. Only when you click such a link does amazon.de open. The link contains our partner ID and the selected items with quantities, but no information about you or your HolzBau 3D account. Amazon may then set cookies on its own website to attribute your purchase to our partner ID; Amazon is responsible for this, and data may also be processed in the USA. More information: Amazon privacy notice and Amazon cookie notice.

Opting out of personalised advertising: You may opt out of Google’s use of cookies for personalised advertising at any time — independently of this website — via Google Ads Settings (g.co/adsettings). Across vendors this is possible via aboutads.info/choices and youronlinechoices.eu. More information on Google’s data processing: policies.google.com/technologies/partner-sites

Transfer to third countries: Google, Stripe, Railway and Cloudflare process data partly in the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses.

6. Retention period

Account data is stored for as long as your account exists. After deletion of your account, all personal data is deleted within 30 days — explicitly including projects stored on the server. Invoicing data is retained for the statutory periods. Server logs are deleted automatically after a short period.

Accounts whose email address is never confirmed after sign-up are deleted automatically, together with all associated data, once 7 days have passed since registration and the most recently requested confirmation link has expired (each link is valid for 48 hours). This does not apply to accounts that already have something attached to them (for example a purchase, a project or a message to us); the paragraph above applies to those.

If a Premium subscription ends, your projects are not deleted. If you are above the number your plan allows, all of them remain readable and downloadable as a file; only saving new versions on the server is blocked until you are below the limit again.

7. Your rights (GDPR)

• Access (Art. 15) — what data we hold about you
• Rectification (Art. 16) — correction of inaccurate data
• Erasure (Art. 17) — deletion of your account and data
• Restriction of processing (Art. 18) — you can request that processing be restricted
• Data portability (Art. 20) — export of your data
• Objection (Art. 21) — for example to the usage statistics
• Withdrawal of consent (Art. 7(3)) — consent given may be withdrawn at any time
• Complaint — you have the right to lodge a complaint with the CNPD (Commission nationale pour la protection des données, Luxembourg)

For all requests: info@holzbau3d.app

8. Cookies and consent

We use a session cookie for login and a cookie for the language setting (technically necessary, no tracking).

On the pages with the AdSense script (guides, home page, pricing page and the editor of the free plan) Google’s consent management loads. It stores your choice in a cookie on holzbau3d.app (currently “FCCDCF”), which is set on your first visit and is valid for about 13 months.

Analytics cookies and advertising cookies are only set after you have given consent. For Google Analytics this is implemented via Google Consent Mode: the script loads with the page but starts with the default “consent denied”. For advertising, your choice in Google’s consent management applies; without consent, Google uses cookies or local storage for limited ads only to detect fraud and invalid traffic (see section 5, Google AdSense).

Via the “Cookie settings” link in the footer of the guides, the home page and the pricing page you can call up and change your choice at any time. It applies to the whole website, including the editor.

9. Data security

Passwords are stored encrypted. The connection is secured via HTTPS. Payment data is never stored on our servers. Access to the database is restricted and protected.

10. Language

This is a translation provided for convenience. In case of doubt, the German version is authoritative.