1. Controller

Michael Budisch
Hauptstraße 23a
38173 Evessen
Deutschland
E-Mail: support@shapeanywhere.com

2. Hosting, server logs and WebAnalytics

ShapeAnywhere, including its database, is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When the website is accessed, IONOS processes the referrer, requested page or file, browser type and version, operating system, device type, access time and IP address. The IP address is anonymised immediately after transmission and is used only to determine the access location. IONOS states that this visitor data is retained for eight weeks.

IONOS WebAnalytics, which IONOS enables by default, measures access via log files or a pixel, does not use cookies and, according to IONOS, does not process personal visitor data. It is used exclusively for statistics and technical optimisation. Hosting logs and WebAnalytics are processed to provide ShapeAnywhere securely, reliably and according to demand. The legal basis is Art. 6(1)(f) GDPR and, where processing is required to provide a service you requested, additionally Art. 6(1)(b) GDPR.

3. Account, login and service provision

When you register, we process your username, name, email address, a password value stored only as a hash, verification status and account/login timestamps. This data is required to provide a ShapeAnywhere account, permissions and cloud features. The legal basis is Art. 6(1)(b) GDPR.

The account remains stored until you delete it, unless statutory or security-related retention duties require otherwise. Expired security tokens are removed regularly.

4. Cloud projects

If you use cloud saving while signed in, the project name, project ID, timestamps, project format, compressed ShapeAnywhere geometry data and optionally a preview image are stored in the MySQL database. This processing is required to save and later load the project you requested and is based on Art. 6(1)(b) GDPR. Cloud projects are deleted with the account unless statutory retention duties require otherwise.

5. Email

For email verification, password resets and security-related system messages, we process your email address and time-limited, hashed one-time tokens. Encrypted SMTP delivery uses IONOS mail infrastructure. IONOS processes in particular the sender and recipient addresses, technical delivery data and message content to the extent required for delivery. The legal basis is Art. 6(1)(b) GDPR; security-related messages may additionally rely on Art. 6(1)(f) GDPR.

6. Cookies & LocalStorage

ShapeAnywhere currently uses no advertising, marketing or third-party tracking cookies. Technically necessary storage relies on the exemption in § 25(2) TDDDG. ShapeAnywhere asks separately before using additional LocalStorage for convenience features (theme, shortcuts, rendering options, local autosave). You can change this choice at any time under “Privacy settings”.

YouTube tutorial videos are not loaded automatically as players. A connection to YouTube/Google via youtube-nocookie.com is made only after you actively start a video on a tutorial page. This may transmit your IP address, browser and device information to Google. Google/YouTube privacy information then applies to further processing.

7. Usage statistics and security

ShapeAnywhere records a simple first-party usage statistic (for example guest/account launch and time) to understand operation and capacity. This statistic is currently stored without linking it to an account ID. Events are automatically deleted after no more than 90 days. The legal basis is Art. 6(1)(f) GDPR (operation, capacity planning and abuse prevention).

Administrative security actions are recorded in an audit log; it may contain admin ID, action, target, time and the administrator IP address. The regular retention period is 180 days.

8. Community content

When you publish a model, your public username (or, for legacy accounts without a username, the existing name until a username is chosen), title, description, tags, preview image, product images and captions, print and assembly information, version notes, selected licence and project snapshots are provided according to your chosen visibility. Public publications may be indexed by search engines; unlisted publications are accessible only via their link. You also decide whether downloads and remixes are permitted. Signed-in users can save models in private collections, follow publishers and receive internal release notifications. Likes, downloads, remixes and views are evaluated for publishers by day and only in aggregate; no additional profile of individual visitors is created. Reports are processed for moderation. Publications can later be hidden or deleted, but copies already lawfully downloaded cannot be recalled. The legal basis for requested community functions and publication is Art. 6(1)(b) GDPR; moderation, reach measurement and abuse-prevention measures rely on Art. 6(1)(f) GDPR.

9. Feedback, bug reports and feature requests

When you submit feedback, we store the feedback type, title, description and – for bug reports optionally – reproduction steps and expected behaviour. Submissions from the CAD app may include additional technical information such as app version, browser, platform, language, viewport, current page path, project name and object count only when you keep that option enabled. The CAD project file, model geometry and screenshots are not uploaded automatically. For signed-in users the submission is linked to the account so its status can be shown and the feedback is removed when the account is deleted; guest submissions are stored without an account ID. Processing is used to handle your request, analyse defects and improve the product on the basis of Art. 6(1)(b) and/or (f) GDPR.

10. ShapePoints, levels and badges

When the reward system is enabled, traceable reputation events are linked to your account. Examples include publishing community models, receiving likes, creating or receiving remixes, having Academy tutorials approved, and reporting confirmed bugs or feature suggestions that are implemented. We store the event type, point value, reference to the relevant content, timestamp and, where applicable, the status of a later-revoked action. ShapePoints, levels and badges are calculated from these records. Levels and selected badges may be shown with your public creator profile; a monthly leaderboard may display your public username and points earned during that month. Self-likes are not rewarded and repeatable actions are limited to reduce abuse. The data is removed through database relationships when your account is deleted and is included in your personal data export. Processing is based on providing the community features you use and our legitimate interest in maintaining a fair and helpful community under Art. 6(1)(b) and (f) GDPR.

11. Community Challenges

When you enter a community challenge, we store the relationship between the challenge, your account and the public community model you submit, plus an optional short entry note. Participation and a possible winner status may be shown publicly with the model and can be used for ShapePoints and challenge badges. If you withdraw your entry, it is no longer shown as an active challenge entry and the participation points event is revoked.

12. Donation links and external providers

If an external donation link is enabled, merely viewing our page does not send data to the donation provider. The provider’s own privacy information applies only after you open the external link. ShapeAnywhere currently embeds no payment or donation widgets.

13. Recipients and processors

IONOS SE is used as the service provider for hosting, database and email infrastructure. Where IONOS processes personal data on our behalf, this is governed by a data processing agreement under Art. 28 GDPR. According to IONOS, the webhosting visitor data described above is not disclosed to third parties and is not transferred to countries outside the EU. ShapeAnywhere otherwise discloses data only where required for operation, required by law or explicitly initiated by you.

Open IONOS privacy information ↗

14. Your rights

Subject to the statutory requirements, you have rights including access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority.

15. Changes to this policy

If new services such as external analytics, embedded payment providers or other non-essential storage are added, this policy will be updated and consent will be obtained before use where legally required.