laserpuzzle Open the app

Polski: Polityka prywatności

laserpuzzle.app Privacy Policy

Effective from: 07-10-2026 Version: 1.0

Capitalised terms (such as Service, Account, Pro, Pro Generator) have the meaning given in the laserpuzzle.app Terms of Service.

1. In short

  1. The App runs in your browser. The files you choose (3D models) and the designs you generate are never sent to us. We cannot see them and do not store them.
  2. Without an Account you give us no personal data. Visit statistics are anonymous and use no cookies.
  3. If you create an Account or buy Pro, we process your email address and your Pro status. Payment is handled by Paddle, which is the seller and a separate controller of payment data.

2. Controller

  1. The controller is Tomasz Kustrzyński, a sole trader operating as Tomasz Kustrzyński, tax ID (NIP): 8981954860 ("we").
  2. Contact for data protection matters: [email protected].
  3. We have not appointed a data protection officer.

3. What we process, why, on what basis and for how long

When Data Purpose Legal basis (GDPR) Retention
Every visit IP address, time of request, browser type, requested URL (server logs at Cloudflare) delivering the site, security, abuse prevention Art. 6(1)(f), legitimate interest in running and securing the Service per Cloudflare's log retention, at most 7 days
Visit statistics aggregated, anonymous visit information (page, referrer, country, device type, performance) via Cloudflare Web Analytics, without cookies and without identifying anyone understanding use and performance of the Service Art. 6(1)(f), legitimate interest in improving the Service aggregated, per Cloudflare's retention
Account email address, sign-in session identifiers and dates (up to 3 devices), Account creation and sign-in dates creating and running the Account, sign-in Art. 6(1)(b), performance of the Account Agreement until the Account is deleted; sessions expire after 30 days of inactivity
Sign-in links email address, SHA-256 hash of the IP address, time the link was sent and used sending one-time sign-in links, limiting how many are sent (abuse prevention) Art. 6(1)(b), contract; Art. 6(1)(f), security of the Service 24 hours
Pro email address, Paddle customer and subscription identifiers, Pro option, payment status and dates, country giving access to Pro Generators, handling refunds Art. 6(1)(b), performance of the contract while Pro is active, then until claims are time-barred
Accounting for Paddle payouts data in Paddle's payout reports needed to record revenue tax and accounting records Art. 6(1)(c), legal obligation (tax law) 5 years from the end of the year in which the tax payment deadline passed
Emails and complaints email address, message content, other data you include replying, handling complaints Art. 6(1)(b) (complaints) and (f) (other correspondence) until the matter is closed, then until claims are time-barred
Legal claims data needed for the matter establishing, exercising or defending claims Art. 6(1)(f) until claims are time-barred
Waitlist / newsletter email address news about the Pro launch and updates Art. 6(1)(a), consent until consent is withdrawn
Sign in with Google email address and Google account identifier sign-in Art. 6(1)(b) as for the Account

4. Paddle

  1. Pro is sold by Paddle.com Market Limited as merchant of record. Paddle collects and processes the data needed for payment, invoicing, tax and fraud prevention as a separate controller under its own privacy policy: https://www.paddle.com/legal/privacy.
  2. We never receive or store card details.

5. Recipients

We share data with processors acting on our behalf, only to provide the Services:

  1. Cloudflare, Inc.: hosting, Account database, email forwarding, visit statistics;
  2. Resend, Inc.: sending sign-in links and notifications;
  3. 7PM Księgowość Sp. z o.o.: tax records;
  4. Google: Sign in with Google.

Paddle (see section 4) and, where the law requires, public authorities are separate controllers.

6. Transfers outside the European Economic Area

  1. Cloudflare, Inc. is based in the United States. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and standard contractual clauses.
  2. Resend, Inc. is based in the United States. Transfers rely on standard contractual clauses or the EU-U.S. Data Privacy Framework.
  3. Paddle is based in the United Kingdom. Transfers rely on the European Commission's adequacy decision for the United Kingdom.
  4. You can get a copy of the safeguards by contacting us.

7. Cookies and browser storage

  1. The Service uses no tracking or advertising cookies and shows no cookie banner, because it only uses what is strictly necessary for the service you ask for.
  2. When you sign in, the Service sets a session cookie (HttpOnly, Secure) to keep you signed in. It expires after 30 days of inactivity or when you sign out.
  3. The App saves your settings (last generator, parameters, panel layout) in your browser's storage (localStorage), on your device only. They are never sent to us. You can remove them by clearing the site's data in your browser.
  4. The App keeps the files you choose (such as 3D models) in your browser's storage (IndexedDB), on your device only, so they are still there when you come back. They are never sent to us. Remove one with "Forget it" under the file field, or all of them by clearing the site's data in your browser.
  5. Your browser caches the App's engine files so later starts are faster.

8. Your rights

  1. You have the right to:
    1. access your data and get a copy;
    2. have it corrected;
    3. have it erased;
    4. restrict processing;
    5. data portability for data processed under a contract or consent;
    6. object to processing based on legitimate interest;
    7. withdraw consent at any time, without affecting processing before the withdrawal.
  2. To use your rights, email [email protected]. You can delete your Account yourself in the Account settings.
  3. You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl), or to the supervisory authority where you live.

9. Providing data

Using the App and the Standard Generators requires no personal data. Your email address is optional, but needed for an Account and for Pro.

10. Automated decisions

We make no decisions with legal or similarly significant effects based solely on automated processing, and do no profiling.

11. Changes

We tell Account holders about significant changes by email and other Users by a notice in the Service.