Privacy Policy

In accordance with the GDPR (EU) 2016/679

1. Controller

David Bohler — HolzBau 3D
43, Kneppchen, L-8538 Hovelange, Luxembourg
E-mail: [email protected]

2. What data we collect

• Account data: username, e-mail (optional), password (encrypted), language setting
• Payment data: processed exclusively by Stripe — we do not store any card details
• Usage data: the time of your last login and a usage statistic recording which features of the app are used. We store only your account identifier, a technical name for the feature (e.g. “cutting plan”), whether the feature was used or locked behind your plan, your plan at that moment, and the time. The content of your constructions is not recorded — neither dimensions nor part names nor calculations. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR). You may object at any time in your profile; statistics already collected are then deleted.
• Purchase attempts: when you click “Subscribe”, we record the attempt: your account identifier, the plan chosen, the time and the outcome — paid, abandoned or technically failed, with the reason in case of an error. No payment data is included; that is handled solely by Stripe. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR): if a purchase fails because of an error on our side, we can only help you if we know about it. These records are deleted together with your account.
• Clicks on the home page: we count which buttons on the home page are clicked. All we store is a counter per day, button and language — no identifier, no IP address, no cookie and no time of day. There is no attribute by which an individual visitor could be recognised; no personal data arises from this. The legal basis for this anonymous counting is our legitimate interest in improving the site (Art. 6(1)(f) GDPR).
• Saved projects: if you save a project on the server, we store the model and its name in our database. This includes the entries from the project data sheet if you filled them in — among them the location of the building project. This happens only on your explicit action; nothing is uploaded automatically. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Your projects are visible only to your own account. You can delete them individually in the editor under “My projects”; deleting your account removes them entirely. If you save to a file on your own device instead, the data never leaves your computer.
• Share addresses: if you share a project via a view link, we store the e-mail addresses you unlock it for — these are usually addresses of other people (e.g. your carpenter, structural engineer, client). They are used solely to deliver the access code and to check access; they are not used for advertising and not passed on. A view link is valid for 7 days and is deleted automatically afterwards, together with the associated addresses. If you revoke the share earlier or delete the project, they are removed immediately. The shared view contains no project data sheet entries, in particular not the location. Please only enter addresses of people who agree to receive the message.
• Technical data: IP address (temporarily, for brute-force protection)
• Server logs: when the website is accessed, our hosting provider automatically logs access data (IP address, date and time, page requested, browser type). These logs serve technical operation and security and are deleted automatically after a short period.

3. Purpose of processing

• Providing the HolzBau 3D service
• Managing user accounts and subscriptions
• Sending transactional e-mails (verification, password reset, subscription confirmations)
• Protection against abuse (brute-force protection)
• Audience measurement and advertising funding (only with your consent)

4. Legal basis

Processing is based on Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(f) GDPR (legitimate interest in the security of the service) and — for analytics and advertising cookies — Art. 6(1)(a) GDPR (consent). You may withdraw consent at any time via the cookie settings.

5. Third-party services

Stripe Inc. (payment processing)
Stripe processes payment data under its own privacy policy. More information: stripe.com/privacy

Brevo (Sendinblue SAS, France) — e-mail delivery
We use Brevo for transactional e-mails (account verification, password reset, subscription confirmations, reminders). Your e-mail address and name are transmitted to Brevo. More information: brevo.com/legal/privacypolicy

Google Analytics 4 (audience measurement)
We use Google Analytics to understand how our website is used (page views, time on page, approximate origin). The IP address is processed in truncated form. The Google script is loaded together with the page. However, it starts with the default setting “consent denied” (Google Consent Mode): as long as you have not given consent, no analytics or advertising cookies are set and measurement is anonymous and without recognition. More information: policies.google.com/privacy

Google AdSense (advertising)
Advertising by Google AdSense may be displayed on the guide pages and in the Free plan. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Here too the default is “consent denied”: without your agreement no advertising cookies are set and only non-personalised advertising is delivered. Premium users see no advertising in the app.

Opting out of personalised advertising: You may opt out of Google’s use of cookies for personalised advertising at any time — independently of this website — via Google Ads Settings (g.co/adsettings). Across vendors this is possible via aboutads.info/choices and youronlinechoices.eu. More information on Google’s data processing: policies.google.com/technologies/partner-sites

Transfer to third countries: Google, Stripe and Railway process data partly in the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses.

6. Retention period

Account data is stored for as long as your account exists. After deletion of your account, all personal data is removed. Invoicing data is retained for the statutory periods. Server logs are deleted automatically after a short period.

7. Your rights (GDPR)

• Access (Art. 15) — what data we hold about you
• Rectification (Art. 16) — correction of inaccurate data
• Erasure (Art. 17) — deletion of your account and data
• Data portability (Art. 20) — export of your data
• Objection (Art. 21) — for example to the usage statistics
• Withdrawal of consent (Art. 7(3)) — consent given may be withdrawn at any time
• Complaint — you have the right to lodge a complaint with the CNPD (Commission nationale pour la protection des données, Luxembourg)

For all requests: [email protected]

8. Cookies and consent

We use a session cookie for login and a cookie for the language setting (technically necessary, no tracking).

Analytics and advertising cookies are only set after you have given consent. Technically this is implemented via Google Consent Mode: the Google scripts are loaded with the page but start with the default “consent denied” for analytics, ad storage and personalisation. Until you agree, no analytics or advertising cookie is stored.

Consent is obtained through Google’s consent management, which is displayed on the pages carrying advertising. Via the “Cookie settings” link in the footer of those pages you can call up and change your choice at any time. Pages without advertising — such as the editor — use no advertising cookies, so the choice is not offered there.

9. Data security

Passwords are stored encrypted. The connection is secured via HTTPS. Access to the database is restricted and protected.

10. Language

This is a translation provided for convenience. In case of doubt, the German version is authoritative.