1. Controller

Michael Budisch
Hauptstraße 23a
38173 Evessen
Deutschland
E-Mail: support@shapeanywhere.com

2. Hosting, server logs and WebAnalytics

ShapeAnywhere, including its database, is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When the website is accessed, IONOS processes the referrer, requested page or file, browser type and version, operating system, device type, access time and IP address. The IP address is anonymised immediately after transmission and is used only to determine the access location. IONOS states that this visitor data is retained for eight weeks.

IONOS WebAnalytics, which IONOS enables by default, measures access via log files or a pixel, does not use cookies and, according to IONOS, does not process personal visitor data. It is used exclusively for statistics and technical optimisation. Hosting logs and WebAnalytics are processed to provide ShapeAnywhere securely, reliably and according to demand. The legal basis is Art. 6(1)(f) GDPR and, where processing is required to provide a service you requested, additionally Art. 6(1)(b) GDPR.

3. Account, login and service provision

When you register, we process your display name, email address, a password value stored only as a hash, verification status and account/login timestamps. This data is required to provide a ShapeAnywhere account, permissions and cloud features. The legal basis is Art. 6(1)(b) GDPR.

The account remains stored until you delete it, unless statutory or security-related retention duties require otherwise. Expired security tokens are removed regularly.

4. Cloud projects

If you use cloud saving while signed in, the project name, project ID, timestamps, project format, compressed ShapeAnywhere geometry data and optionally a preview image are stored in the MySQL database. This processing is required to save and later load the project you requested and is based on Art. 6(1)(b) GDPR. Cloud projects are deleted with the account unless statutory retention duties require otherwise.

5. Email

For email verification, password resets and security-related system messages, we process your email address and time-limited, hashed one-time tokens. Encrypted SMTP delivery uses IONOS mail infrastructure. IONOS processes in particular the sender and recipient addresses, technical delivery data and message content to the extent required for delivery. The legal basis is Art. 6(1)(b) GDPR; security-related messages may additionally rely on Art. 6(1)(f) GDPR.

6. Cookies & LocalStorage

ShapeAnywhere currently uses no advertising, marketing or third-party tracking cookies. Technically necessary storage relies on the exemption in § 25(2) TDDDG. ShapeAnywhere asks separately before using additional LocalStorage for convenience features (theme, shortcuts, rendering options, local autosave). You can change this choice at any time under “Privacy settings”.

7. Usage statistics and security

ShapeAnywhere records a simple first-party usage statistic (for example guest/account launch and time) to understand operation and capacity. This statistic is currently stored without linking it to an account ID. Events are automatically deleted after no more than 90 days. The legal basis is Art. 6(1)(f) GDPR (operation, capacity planning and abuse prevention).

Administrative security actions are recorded in an audit log; it may contain admin ID, action, target, time and the administrator IP address. The regular retention period is 180 days.

8. Community content

When you publish a model, your display name, title, description, tags, preview image, product images and captions, print and assembly information, version notes, selected licence and project snapshots are provided according to your chosen visibility. Public publications may be indexed by search engines; unlisted publications are accessible only via their link. You also decide whether downloads and remixes are permitted. Signed-in users can save models in private collections, follow publishers and receive internal release notifications. Likes, downloads, remixes and views are evaluated for publishers by day and only in aggregate; no additional profile of individual visitors is created. Reports are processed for moderation. Publications can later be hidden or deleted, but copies already lawfully downloaded cannot be recalled. The legal basis for requested community functions and publication is Art. 6(1)(b) GDPR; moderation, reach measurement and abuse-prevention measures rely on Art. 6(1)(f) GDPR.

9. Donation links and external providers

If an external donation link is enabled, merely viewing our page does not send data to the donation provider. The provider’s own privacy information applies only after you open the external link. ShapeAnywhere currently embeds no payment or donation widgets.

10. Recipients and processors

IONOS SE is used as the service provider for hosting, database and email infrastructure. Where IONOS processes personal data on our behalf, this is governed by a data processing agreement under Art. 28 GDPR. According to IONOS, the webhosting visitor data described above is not disclosed to third parties and is not transferred to countries outside the EU. ShapeAnywhere otherwise discloses data only where required for operation, required by law or explicitly initiated by you.

Open IONOS privacy information ↗

11. Your rights

Subject to the statutory requirements, you have rights including access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority.

12. Changes to this policy

If new services such as external analytics, embedded payment providers or other non-essential storage are added, this policy will be updated and consent will be obtained before use where legally required.