Privacy Policy

This policy explains how BuonaLabs UG (haftungsbeschränkt), Maria-Goeppert-Straße 3, 23562 Lübeck, Germany (“we”), handles personal data for the Enfigure website, accounts and subscriptions. The desktop app runs on your computer and does not send us your 3D files. For customers in Germany, the German summary at the end states the same rules.

We have not appointed a data protection officer. Requests go to [email protected]. You can also complain to the supervisory authority for Schleswig-Holstein:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD) Holstenstraße 98, 24103 Kiel, Germany https://www.datenschutzzentrum.de

1. What we collect

Data	Why	Legal basis	Source
Email address, and a name if you give one	Account, receipts, service messages	Contract (Art. 6 (1) (b) GDPR)	You or your sign-in provider
Sign-in provider identifiers	Sign-in with Google, GitHub or Discord, if you choose them	Contract	That provider
Checkout declaration (the exact sentence, time, and company name if you order as a business)	Show what you agreed before payment	Contract and legal obligation	You
Billing records: plan, amounts, tax, invoice status, Stripe customer id	Charge you, invoices, tax, refunds	Contract and legal obligation (Art. 6 (1) (c) GDPR)	Stripe and our database
Device list: name, platform, app version, device public key	The 3-device limit and account security	Contract and legitimate interest in security	The app
Download logs	Deliver builds and prevent abuse	Legitimate interest	Our servers
Waitlist email	Launch or beta news, only if you join	Consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time	You
Cookieless analytics: page, referrer, country, device type	Understand how the site is used	Legitimate interest	Your browser, via Umami on our server
IP address and browser in server logs	Security and reliability	Legitimate interest	Your browser

We do not store full card numbers. Stripe does, as an independent controller for the payment and as our processor for the rest of the billing flow.

2. What we do not collect

Your 3D models, characters, garments, textures, projects or the contents of your exports. Enfigure runs on your computer.

3. Who processes data

Processor	Purpose	Place
Convex, Inc.	Database and authentication	United States
Cloudflare, Inc.	File storage (R2) and network delivery	United States and the EU
Stripe Payments Europe, Limited, and its sub-processors including Stripe, Inc.	Payments, VAT, invoices, refunds	Ireland and the United States
The SMTP server for enfigure.app	Account codes, receipts and cancellation emails	The location of that server
Google, GitHub, Discord	Sign-in, only if you choose them	Their countries
Umami, run by us	Cookieless page counts	Our server

We do not sell personal data. Where data leaves the EEA, we use the provider’s Standard Contractual Clauses or an adequacy decision.

4. Retention

• Account data is kept while the account exists and is deleted when you delete the account, except records we must keep.
• Invoices and other accounting records are kept for 8 years (§ 147 of the German Fiscal Code, as amended).
• The device list is removed when you sign the device out or delete the account.
• Download logs are deleted when you delete the account.
• Waitlist email is kept until you unsubscribe or we close the list.
• Server logs are kept for up to 30 days, longer only if we are investigating an incident.
• Analytics are stored in aggregate on our server.

5. Your rights

You can ask for access, correction, deletion, restriction, and a portable copy, and you can object to processing based on legitimate interests. You can withdraw consent at any time. You can complain to the ULD or to the authority where you live. We reply within one month. Delete the account in Settings, or write to [email protected].

6. Security and children

We use encryption in transit and access controls. Tell us at [email protected] if you find a problem. Enfigure is not for people under 18. We do not knowingly collect children’s data.

7. Changes

We will post changes here with a new date and tell you of material changes by email or in the app.

Deutsch

Verantwortliche Stelle ist die BuonaLabs UG (haftungsbeschränkt), Maria-Goeppert-Straße 3, 23562 Lübeck, [email protected]. Ein Datenschutzbeauftragter ist nicht bestellt. Beschwerden richtet die zuständige Aufsicht an das Unabhängige Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel.

Wir verarbeiten Kontodaten zur Vertragserfüllung, Rechnungs- und Steuerdaten zur rechtlichen Pflicht (Aufbewahrung 8 Jahre), Geräte- und Sicherheitsdaten aufgrund unseres berechtigten Interesses an einem sicheren Dienst, und Wartelisten-E-Mails nur mit Einwilligung. Die App lädt keine 3D-Dateien hoch. Kartendaten speichert Stripe, nicht wir. Empfänger sind Convex, Cloudflare, Stripe Payments Europe Limited, der SMTP-Server von enfigure.app sowie, wenn Sie sie wählen, Google, GitHub oder Discord. Übermittlungen in Drittländer stützen sich auf Standardvertragsklauseln. Sie haben die Rechte aus Art. 15 bis 21 und 77 DSGVO. Das Konto löschen Sie in den Einstellungen.