Privacy Policy
Last updated 13 October 2026
Draft for the public beta. Have it reviewed by a lawyer before launch.
This policy explains how BuonaLabs UG (haftungsbeschränkt) (“Enfigure”, “we”), Maria-Goeppert-Straße 3, 23562 Lübeck, Germany, handles personal data on the Enfigure website and account area. The Enfigure desktop app runs on your computer and does not send us your 3D files.
1. What we collect
| Data | Why | Source |
|---|---|---|
| Email address | Create and secure your account, send receipts and service messages | You |
| Name or display name | Show it in your account | You or your sign-in provider |
| Sign-in provider identifiers (Google, GitHub or Discord ids) | Let you sign in with those providers | Your provider |
| Billing records (plan, dates, amounts, payment status, customer id) | Charge you, issue invoices, handle refunds | Our payment processor |
| Device list: device name, platform, app version and a device public key, sent by the app when you sign in | Limit each account to 3 devices, let you sign devices out, and keep your account secure | The app on your device |
| Download logs (which build you downloaded, when) | Deliver builds, prevent abuse | Our servers |
| Waitlist email | Send you launch or beta news if you joined the waitlist | You |
| Site analytics (pages viewed, referrer, country-level data, device type) | Understand how the site is used | Self-hosted analytics |
| Technical data (IP address, browser) in server logs | Security and reliability | Your browser |
We do not store full card numbers. Your payment processor does.
Our analytics are self-hosted and do not use cookies. See the Cookie Policy.
2. What we do not collect
- Your 3D models, characters, garments, textures or projects. Enfigure runs on your computer and your files are not uploaded.
- The contents of your exports.
- Your payment card number.
3. How we use data
- To provide the service: accounts, plans, downloads, device sign-in and support.
- To bill you and meet tax and accounting rules.
- To keep the service secure and prevent abuse.
- To improve the website with aggregate analytics.
- To email you service messages. We send marketing email only if you joined the waitlist or opted in, and you can unsubscribe at any time.
Where the GDPR applies, our legal bases are: performing our contract with you, our legitimate interests (security, product improvement), compliance with legal obligations, and your consent where we ask for it.
4. Who processes your data
We use these processors. They act on our instructions.
| Processor | Purpose |
|---|---|
| Convex | Database and authentication |
| Cloudflare R2 | File delivery for downloads and model packs |
| Polar (Polar Software Inc.) | Merchant of record: checkout, payments, sales tax and VAT, invoices and refunds |
| Resend | Transactional and waitlist email |
| Google, GitHub, Discord | Sign-in, if you choose them |
We do not sell your personal data. Data may be processed in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.
5. Retention
- Account data: kept while your account is active, and deleted when you delete your account, except what we must keep by law.
- Device list: kept while the device is signed in to your account, and removed when you sign it out or delete your account.
- Billing records: kept as long as tax and accounting law requires (typically [7] years).
- Download logs: kept for [12] months.
- Waitlist email: kept until you unsubscribe or we close the waitlist.
- Analytics: kept in aggregate form.
6. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or CCPA/CPRA), you may have the right to:
- access the personal data we hold about you;
- correct it;
- delete it;
- receive a copy in a portable format;
- object to or restrict some processing;
- withdraw consent at any time;
- not be discriminated against for using your rights;
- opt out of the sale or sharing of personal data. We do not sell or share it.
To use your rights, delete your account in Settings in the account area, or write to [email protected]. We reply within the time required by law (generally within one month). You can also complain to your local data protection authority.
7. Security
We use encryption in transit and access controls. No system is perfectly secure. Tell us at [email protected] if you find a problem.
8. Children
Enfigure is not for people under 18. We do not knowingly collect data from children.
9. Changes
We will post changes here with a new date and tell you of material changes by email or in the app.
10. Contact
BuonaLabs UG (haftungsbeschränkt) Maria-Goeppert-Straße 3, 23562 Lübeck, Germany [email protected]