Privacy policy

2.1 Controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is Sebastian Kokel, acting under the business name sebGE Prints, Höchste Straße 18, 45883 Gelsenkirchen, Germany, email: info@layerspan.app.

We have not appointed a data protection officer; there is no obligation to do so (Art. 37 GDPR, § 38 BDSG).

2.2 Overview: what we process, for what purpose and on what basis

This website presents LayerSpan and offers the LayerSpan platform: an account, design tools for 3D printing with export, and paid memberships. Many functions of the tools work in your browser. Shadow Maker, Image to SVG and Image Upscaler, however, send your input through our server to dedicated computing services (section 2.3, "Design tools"); images used in these tools therefore do not stay only in your browser. We use no analytics, advertising or tracking services. Apart from the YouTube player, which only loads after your click (section 2.6), we embed no fonts or scripts from other providers; Stripe's payment page and customer portal open as Stripe's own pages. Only the data named in this policy is processed.

Abbreviations of the retention categories (section 2.9): A technical, short-term; B account data; C security evidence; D contract evidence; E tax and commercial-law retention.

2.3 Details

Website and hosting. The website is hosted and delivered by Vercel Inc. (USA). On every request Vercel processes the data your browser sends for technical reasons: IP address, date and time, the address requested, status code and amount of data transferred, the previously visited page (referrer), and information about browser and operating system. This data is needed to deliver the page, to keep it stable and secure, and to prevent abuse; the connection is encrypted (HTTPS). Images are delivered by Vercel in a suitable size from our own web address. The server functions of this website are set to the Frankfurt am Main region; logs and delivery over Vercel's worldwide network may also be processed outside the EU. We only look at this data in individual cases, to fix errors or prevent abuse, and do not combine it with other data.

The legal basis is our legitimate interest in providing the website securely and in working order (Art. 6(1)(f) GDPR). The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes the data on our behalf under its data processing agreement (Vercel Data Processing Addendum, version of 17 March 2026, effective since 31 March 2026), which forms part of Vercel's terms of service (Art. 28 GDPR). Where usage data and metadata arise from the use of the service and are personal data, according to that agreement Vercel processes them as a controller in its own right; Vercel's privacy notice applies to them (https://vercel.com/legal/privacy-notice). For the transfer to the USA we rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, under which Vercel Inc. is certified (Art. 45 GDPR); the data processing agreement additionally contains the European Commission's standard contractual clauses of 2021 (Art. 46(2)(c) GDPR).

The same server functions answer the requests for sign-in, the tools and purchases; in case of an error they write its type and cause to their logs, not the content of your request.

Database. We store account, session, membership, evidence, declaration and export data in a database that Neon operates for us in the Frankfurt am Main region (Germany), as processor under its data processing agreement (Art. 28 GDPR).

Account. When you register you provide your name and email address. You do not enter a password at that point: you choose it via a link that we send to your address. We store it only as a one-way hash. With this step you also confirm that the address belongs to you.

Session. When you sign in, we store the session with its expiry (7 days, renewed on use), your IP address and the full browser identifier (user agent), each in plain text. The purpose is to keep you signed in and to detect abuse. The row is removed at the latest seven days after the session has expired (section 2.9).

Abuse protection. To defend against sign-in attempts, the sign-in component counts the requests of all its endpoints (sign-in, registration, links for the password) per IP address and path; the IP is in the counter's key in plain text, and the rows are removed opportunistically. Counters for sending email, for the contact form and for cancellation and withdrawal declarations store address and IP only as a key hash. For the counters, IPv6 addresses are grouped by their /48 prefix.

Day of last use. For each account we store the day (not the time) on which you last signed in or used the platform with an existing sign-in. We need it to recognise accounts that have not been used for a long time (section 2.9). It is not displayed, not passed on to tools and is deleted with the account. The legal basis is our legitimate interest in being able to delete accounts that are no longer used (Art. 6(1)(f) GDPR). Warning and deletion of unused free accounts are not yet in operation.

Email. We send only messages that the account needs: link for confirmation and choice of the password, link for resetting, notice of a password change, a notice "you already have an account" if someone registers again with the address of an existing account, the confirmation of receipt for a cancellation or withdrawal and, after the purchase of a membership, the confirmation of the contract (below). No newsletter, no advertising. The name of your account does not appear in any account mail. Receipt and invoice come from Stripe. How the emails are sent is described in section 2.4.

Design tools. For most tools, everything you design or load (images, SVG, drawings, project files) stays in your browser; on export, your browser creates the file. Our server only checks whether your account may export and stores the event (table row no. 8). Information about the design that the browser sends along is checked by the server and not stored.

Three tools process your input outside your browser and outside this platform:

• Image to SVG (for members with Plus only) sends the picture you choose and the settings (mode, options) through our server to a conversion service that creates the SVG file. By design, neither the service nor we store the picture or the result; the export authorisation holds only a fingerprint of picture, mode and options. A picture can show people: load only pictures you are entitled to have processed.
• Shadow Maker, if you use your own picture (for members with Plus only), sends that picture (a PNG, JPEG or WebP file) together with the settings of the model (for example size, thickness, foot, threshold, smoothing) through our server to a geometry service that calculates the preview and the STL file. The preset silhouettes and the parts of the standard box send no picture, only their settings. We store neither the picture nor the settings in our database; by design, the service writes them neither to logs nor to a disk and keeps nothing after it has answered. The service sees a pseudonymous subject (made from your account or, if you are not signed in, from your network address), not your name or e-mail address. The export authorisation holds only fingerprints of the picture and of the settings, which tie the authorisation to exactly that model and can be used only once. A picture can show people: load only pictures you are entitled to have processed.
• Image Upscaler (for members with Plus only) sends the picture you choose (a PNG or JPEG file) and the options you pick (factor, sharpening, noise reduction, file format) through our server to a worker that enlarges the picture in a separate process, in memory. By design, the worker keeps neither the picture nor the result; its log holds request numbers, sizes and times, not the picture, a file name or an address. We store neither the picture nor the result in our database; camera data and the location of the picture are not carried into the result. The worker sees a pseudonymous subject made from your account, not your name or e-mail address, and our server counts requests per member and for the platform (as a hash) to limit abuse. The enlarged picture comes back through our server and is not kept there either. A picture can show people: load only pictures you are entitled to have processed.

Map Art Studio is not currently offered; it sends no data from this website. Before we open it, we will supplement this policy.

Computing services of the tools. The services for Shadow Maker, Image to SVG and Image Upscaler are operated for us by Railway (Railway Corporation, USA) as processor under a data processing agreement (Art. 28 GDPR, effective since 27 October 2026), in the EU West region in Amsterdam (Netherlands). The services are separate from each other and accept only requests that our server has signed; they receive a pseudonymous subject, not your name or email address. We decide for each tool whether it is open in production; a tool that is not open sends nothing. By their design, the services write neither images nor results to logs or to storage. The legal basis for processing an image is Art. 6(1)(b) GDPR; if an image shows other people, you are responsible for being allowed to use it.

Membership and payment. Paid memberships are bought on a page hosted by Stripe. Stripe collects your payment data; we never see or store it. At the start of a purchase we create a customer at Stripe with your email address (with a pseudonymous reference, without your name) and store its identifier together with the plan, status and periods of the subscription. We read the state of the subscription and invoices back from Stripe. Of the messages that Stripe sends us, we store only identifier, type, time and outcome, not the content. Through "Manage billing" you open Stripe's customer portal for the customer that belongs to your account. Stripe is the merchant of record for the membership (terms of use, § 1(3)) and for this processes your payment, invoicing and contact data under its own responsibility, for customers in the European Economic Area Stripe Payments Europe, Limited (Ireland); Stripe's privacy policy applies (https://stripe.com/privacy). We process the data on customer, subscription and payment status that we exchange with Stripe as controller to perform the contract (Art. 6(1)(b) GDPR) and to meet statutory record-keeping obligations (Art. 6(1)(c) GDPR).

Declarations before purchase. Before you go to the payment page, LayerSpan shows a "Review your order" page with the contract information (monthly, automatic renewal until cancellation, cancellable at any time, access until the end of the paid period, no minimum term, no fee, binding order on Stripe's secure payment page) and a selection "Country where you live". One line refers to the terms and the information on withdrawal; another says that you can find information on how your data is processed in the privacy policy. There is no box for the privacy policy; it is information, not consent. You tick two boxes: (1) you accept the Terms and Subscription Conditions (for Plus Commercial also its licence terms) and confirm that you have taken note of the information on withdrawal; (2) you declare expressly that your access is to be unlocked immediately after payment, even before the withdrawal period ends, and that you understand that proportionate compensation for value (Wertersatz) may be due upon withdrawal where the law requires it. What counts is the exact wording of the order page in the version that was shown to you and that we keep. As evidence we store account identifier, plan, time, the country you stated, the language, the version of the wording and a SHA-256 fingerprint of the exact wording. We keep the exact wording of each version and language once in a table that can only be added to, but not changed or deleted. A request with another version of the wording, or with a wording changed under the same version, is refused; nothing is then bought. With the evidence we also store which versions of the terms of use, the withdrawal information and this privacy policy (for Plus Commercial also the licence terms) were shown to you (identifier, version, language, fingerprint); we keep the wording of each version once in an archive that can only be added to.

Linking an existing subscription. If we have given you a separate code with which you link an existing subscription to your account, we store the code only as a check value (hash), its validity, the number of failed attempts and the identifier of the subscription at Stripe; after redemption, the link between subscription, customer and account with its times and a log of the operations (time, type, outcome, account identifier, no name, no address). On redemption we read the state of the subscription at Stripe. A rank connected with it is stored with its basis and the reason for any revocation; it gives no access and is not passed on to tools. If the server detects a fault in the link, our mailbox receives a notice with identifier and status, without a name and without an address. The legal basis is Art. 6(1)(b) GDPR. We keep the link itself as evidence of the contract (category D, section 2.9).

Country. You can buy a paid membership from every country and territory from which Stripe Managed Payments accepts purchases; currently excluded are China, Cuba, Iran, Kosovo, North Korea, Russia, Syria, Ascension Island and Tristan da Cunha. You state the country yourself; we need it to check that the purchase comes from a supported country. It is not derived from the IP address.

Cancellation and withdrawal without an account. What you enter on the pages "Cancel contracts here" and "Withdraw from contract" (name, contract identifier, email address; for a cancellation additionally the type, for an extraordinary cancellation the reason, and the desired termination date) we store together with the time of receipt and a reference. The reason for an extraordinary cancellation is voluntary free text (up to 1000 characters); without it the cancellation is accepted anyway. If the operator has processed a declaration, this is noted. The withdrawal is declared in two steps (details, then confirmation), the cancellation on one page; on both pages there are no further notes besides the form, and the privacy information is in the footer and on this page. We send you a confirmation of receipt and a message with the same content to our own mailbox so that the declaration is processed; both messages go via Resend. We do not store an IP address with the declaration; to protect against abuse it is briefly counted as a key hash. The declaration is not linked to an account; when an account is deleted it remains unchanged (section 2.10).

Contract confirmation. When the first payment at Stripe has been read and found paid (never merely because a purchase was started, and never on the basis of an unverified notice), we note that one confirmation is due per subscription (table 14, without address and without text) and send it through Resend to the address of your account: with the contract information, your declarations before the purchase and, as files, the versions of the legal texts under which you ordered.

Accounts without a confirmed address. The operator removes an account whose address was never confirmed with his clean-up procedure 30 days after registration if nothing else is tied to it (section 2.9).

Administrators. For accounts with administration rights we additionally store the (encrypted) authenticator secret, backup codes (as a hash or encrypted) and a log of administration operations (time, action, outcome, account identifiers, without names, addresses or free text).

2.4 Contact form and contact by email

You can write to us through the contact form on the "Contact" page or by email to info@layerspan.app. We then process your contact details and the content of your enquiry in order to answer it. The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at concluding or performing a contract, otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR).

Contact form. The form asks for your name, your email address and your message; we need all three in order to answer. When you send it, our server checks the details and sends them as an email to our mailbox, with your email address as the reply address. The message is not stored in our database and is not linked to an account; it exists only in that email. You do not receive an automatic confirmation by email. The form sets no cookie. Please do not send passwords or payment data.

Protection against abuse. So that the form cannot be abused on a large scale, our server counts how many messages per hour come from one IP address and from one email address, and how many arrive in total per day (without reference to a person). The address itself is not used for counting, only a check value that the server computes with a secret key. The counters are kept in our database (section 2.3, "Database") and apply only within their time window (one hour, the daily counter one day); after that, the server removes them on later requests, or our clean-up procedure does (section 2.9). Your IP address is not included in the email. A field that is invisible to people detects automated submissions; their content is discarded. We use no third-party service (such as a CAPTCHA) for this. The legal basis is our legitimate interest in a secure means of contact that is not abused (Art. 6(1)(f) GDPR).

Sending. The emails of the platform (about the account, about cancellation and withdrawal, from the contact form, and notices to our mailbox) are sent for us by Resend (Plus Five Five, Inc., USA) as processor under its data processing agreement (Resend Data Processing Addendum), which applies upon acceptance of Resend's terms of service (Art. 28 GDPR). For this, Resend receives the recipient address and the content of the respective email. Our sending domain sends through the Ireland region (eu-west-1); where Resend stores the data does not depend on this, and the data is transferred to Resend in the USA. For this we rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, under which Plus Five Five, Inc. is certified (Art. 45 GDPR); the data processing agreement additionally contains the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Open and click tracking is switched off for our sending domain: the email contains no tracking pixel and no redirected links. According to Resend, sent emails and the related delivery logs are kept for 30 days; Resend states that it keeps backups for seven days. Our emails contain our logo, which your email program loads from our server when you open the email; the server then sees your IP address and the time. We do not evaluate this request.

Mailbox. The info@layerspan.app mailbox is operated for us by IONOS SE, Montabaur (Germany), as processor under a data processing agreement (Art. 28 GDPR).

Retention. We delete your message (from the form or by email) and our reply at the latest six months after we have finished dealing with an ordinary enquiry. We keep them longer only where a statutory retention obligation applies (for example six years for business letters received and sent under § 147(1) nos. 2 and 3 and § 147(3) AO, if the message concerns a business transaction) or where we need them to establish, exercise or defend legal claims; in these cases we restrict the processing to that purpose.

2.5 Cookies and storage in the browser

As long as you do not sign in and do not choose a language yourself, this website sets no cookie and uses no storage in your browser when you open a page (apart from the usual cache that your browser manages itself).

If you open an English page without a language code in the address, a small script in your browser reads the ls_lang cookie and your browser's language setting in order to redirect you, where applicable, to the matching language version (German, Italian or Spanish). It stores nothing. If it redirects you, your browser loads the page again under the address of the matching language; the script sends no other data.

The legal basis for the cookies is § 25(2) no. 2 TDDDG: they are strictly necessary to keep the sign-in you requested and to show the language you chose; for the related processing, Art. 6(1)(b) GDPR (sign-in) and point (f) (language). On Stripe's payment page and in its customer portal, Stripe as operator of those pages sets its own cookies; we have no influence on this. In our current assessment a consent banner is not required, because the cookies named are strictly necessary for the service you requested.

2.6 Videos from YouTube

On the home page we show one video each for two tools in development (ModelHouse, Christmas Ornament). Until you click the still image with the play symbol (the whole area is a single "Play video" button), the page loads nothing from YouTube: you see a still image from our own server and the note that YouTube only loads when you start playback and then receives, among other things, your IP address, including in the USA.

Only with your click is the YouTube video player loaded in privacy-enhanced mode from the address www.youtube-nocookie.com, and the video starts muted; the player then loads further content from Google servers. The provider is Google Ireland Limited (Ireland); affiliated companies such as Google LLC (USA) may be involved. Google receives in particular your IP address, information about browser and device, the address of our website and the identifier of the video. YouTube may use cookies or comparable techniques (for example local storage) in the player and process the data under its own rules, including in the USA. We and Google are joint controllers for loading the player and transmitting your data to Google; Google is the sole controller for the further processing. For transfers to the USA, Google relies on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, under which Google LLC is certified. A "Watch on YouTube" link then appears below the player; if you follow it, YouTube's rules apply directly.

The legal basis is your consent, which you give for this video by clicking "Play video" (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future by reloading or leaving the page; data that YouTube has stored in your browser can be deleted in your browser's settings. More information: https://policies.google.com/privacy

2.7 Recipients

Recipients of personal data are:

• Vercel Inc. (USA) as hosting provider of this website, on our behalf, and as a controller in its own right for usage data and metadata of the service (section 2.3);
• Neon as operator of our database in Frankfurt am Main, on our behalf (section 2.3);
• Railway (Railway Corporation, USA) as operator of the computing services of Shadow Maker, Image to SVG and Image Upscaler, on our behalf, only if you use one of these tools (section 2.3);
• Resend (Plus Five Five, Inc., USA) as sending service for the emails of the platform, on our behalf (section 2.4);
• IONOS SE (Germany) as provider of our email mailbox, on our behalf, if you write to us (section 2.4);
• Stripe as merchant of record and payment service provider under its own responsibility, if you buy or manage a membership (section 2.3, "Membership and payment");
• Google Ireland Limited (Ireland) and, where applicable, Google LLC (USA), only after you play a video (section 2.6);
• authorities such as the LDI NRW only where required by law.

We do not sell data and do not use it for advertising.

2.8 Transfers to third countries

Vercel, Resend and Google are based in the USA or are connected with companies there; the basis on which data is transferred there is set out in sections 2.3, 2.4 and 2.6. Neon and Railway process the data in the EU (Frankfurt am Main and Amsterdam respectively); both providers are based in the USA, and access from third countries, for example by support or sub-processors, is possible. For such access their data processing agreements provide for the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). Stripe also transfers data to the USA under its own responsibility; Stripe, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and Stripe's privacy policy gives the details.

2.9 Storage period (operator decisions of 17 October 2026)

The following periods were set by the operator on 17 October 2026. They are ceilings for data that exist only for technical reasons and not commitments: data is removed earlier if it is no longer needed, and kept longer where we need it as evidence, where a law requires it or in the case of a specific security incident. Today none of this runs by itself: the operator removes expired data with a separate clean-up procedure started by hand; a daily clean-up is prepared but not switched on. The day of last use is already stored; the warning and deletion of unused accounts are not yet in operation.

2.10 Your rights; deletion of an account

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To exercise these rights, please contact info@layerspan.app; we reply without undue delay and in any event within one month; in the cases of Art. 12(3) sentence 2 GDPR the period may be extended, and we will inform you of this.

Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW).

How to exercise your rights. Write to info@layerspan.app or use the contact form. We verify your identity outside the platform (for example by a query to the address on record) before we release or delete data.

Deletion (a procedure, not a button). The operator deletes an account by hand on request (there is no self-service route). The procedure first checks what would happen (plan) and then makes the change:

• Without payment data: The account is deleted. With it, sessions, credentials, authenticator, activations and export records fall away.
• With payment data (customer, purchase, membership, evidence of declarations): The account remains as an anonymised shell without name, address, sign-in and sessions; the booking rows remain linked to it, because they may have to be retained under tax and commercial law (category D/E). They remain as long as statutory retention and proof obligations require (category D/E, section 2.9).
• The procedure is refused as long as the account has an administration role, a subscription at Stripe is still running (cancel there first) or a paid period has not expired, unless you expressly waive this. Deleting the account is not a cancellation of the subscription.
• Not part of the account deletion are the customer record at Stripe (with your email address) and the log of notices from Stripe (identifiers, no content); the operator deals with them separately in Stripe's dashboard, and the platform does not call Stripe for this. Copies in the operator's mailbox and at the email provider likewise lie outside the deletion.
• Expired sessions, links, abuse counters, one-time codes and export records are removed by the operator, independently of a deletion, with the clean-up procedure (section 2.9); account deletion and clean-up are different procedures.
• Declarations of cancellation and withdrawal are not linked to the account and remain unchanged when an account is deleted. They remain as evidence of the contract as long as we need them for this (category D/E, section 2.9).
• The note about the deletion contains no personal data.

2.11 Obligation to provide data, automated decisions

Without name and email address we cannot keep an account; without the information in the purchase, no membership comes into being. There are no decisions made solely by automated means that have legal effect on you, and no profiling. Whether your account may do a premium export depends on plan and payment status.

2.12 Changes

We adapt this policy when our processing changes, in particular when a further tool is added that sends content to our server. The version currently published on this page applies.