Privacy policy
Privacy information on the use of Vextrify in the browser and in the local desktop app, including accounts, payments, file uploads, project profiles, premium features and export workflows.
1. Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is: SMART Marketing UG Gebrüder-Meyer-Str. 6 32758 Detmold Germany Register court: Amtsgericht Lemgo (Lemgo Local Court) Commercial register: HRB 10054 Email for data protection enquiries: datenschutz@vextrify.com Website: https://vextrify.com
2. Principles of data processing
We process personal data only to the extent necessary for operating Vextrify, providing booked features, fulfilling legal obligations, ensuring the security of the service, or communicating with users. Processing is carried out in accordance with the principles of lawfulness, purpose limitation, data minimisation, transparency, storage limitation, integrity and confidentiality. Files and images are not used across the board for advertising, profiling or the training of third-party systems.
3. Categories of data
Depending on use, the following data may be processed: - Master data: name, company, billing address, email address, customer number. - Account data: login status, booked plan, licence status, device activations, roles and permissions. - Payment and contract data: selected tariff, payment status, invoice data, transaction references, tax information. - Usage data: areas accessed, technical events, error messages, export operations, limit and entitlement checks. - Project and profile data: material profiles, settings, recipes, artboards, relief parameters, export metadata. - Upload and image data: motifs, photos, SVG/PNG/PGM/STL files uploaded by the user, and working files generated from them. - Support data: messages, attachments, error descriptions and communication history. - Technical data: IP address, browser, operating system, device identifier, language setting, cookie and LocalStorage entries.
4. Purposes and legal bases
We process data in particular for the following purposes: - Provision of the online app and local desktop functions: Art. 6(1)(b) GDPR. - Account, licence and device management: Art. 6(1)(b) GDPR. - Payment processing, invoicing and accounting: Art. 6(1)(b) and (c) GDPR. - Storage of profiles, projects and user preferences: Art. 6(1)(b) GDPR; for optional convenience features, Art. 6(1)(a) or (f) GDPR. - Security, prevention of abuse, error analysis and system stability: Art. 6(1)(f) GDPR. - Support, follow-up queries and contract communication: Art. 6(1)(b) or (f) GDPR. - Cookies requiring consent, and analytics or marketing services, where activated: Art. 6(1)(a) GDPR in conjunction with the applicable provisions of the TDDDG (German Telecommunications Digital Services Data Protection Act).
5. Image, file and project processing
Vextrify processes images and production files in order to create laser files, engraving previews, profiles, artboards, vector data, QR codes, relief files and export packages. Where a workflow is executed entirely locally in the browser or in the desktop app, the files do not leave the device. In the case of server-side premium features, for example high-quality background removal or an external image enhancement activated at a later date, the file is transmitted to the respective server service only for the selected processing operation. We store uploaded files only if this is expressly triggered by the user, for example by saving a project, cloud sync, a support upload or a server-side premium workflow. Temporary processing data is deleted as soon as it is no longer needed for the respective operation, unless statutory retention obligations prevent this.
6. Local desktop app and offline use
The local Vextrify app is designed to run core image, artboard, profile and export functions on the user's device. Local projects, profiles, preview data and working files may be stored on the respective device. For licence verification, update entitlement, device activation, premium features and support, the desktop app may use an internet connection. In this context, licence keys, device identifier, app version, operating system, activation time, plan status and security-relevant log data may be processed. The local app does not contain any publicly readable payment secrets, API keys or server secrets.
7. Cookies, LocalStorage and similar technologies
Vextrify uses technically necessary storage technologies to provide language, session status, login, security functions, entitlements, local profiles and operating states. These may include cookies, LocalStorage, IndexedDB or comparable browser storage. Technically necessary storage takes place to the extent that it is required to provide the service expressly requested. Analytics, marketing or tracking technologies that are not technically necessary are used only if the user has previously given effective consent. Consent once given can be withdrawn at any time with effect for the future.
8. Payment processing
Payments are processed through hosted payment flows of external payment service providers, in particular credit card, SEPA direct debit, Sofort/bank-based methods or other payment methods offered by Stripe, as well as PayPal payments, where these payment methods are activated. Vextrify does not store complete credit card numbers, CVC codes or PayPal credentials in the client. Payment service providers process payment data on their own responsibility or as processors, in accordance with their respective privacy notices. We receive only the payment status and transaction information required for the contract, accounting, activation, fraud prevention and support.
9. Hosting, infrastructure and processors
Technical service providers may be used for the operation of the online version, API endpoints, licence verification, payment status, database, file processing, email delivery, error analysis and security functions. Contracts pursuant to Art. 28 GDPR are concluded with processors where required. Server-side API keys, payment secrets, webhook secrets, database credentials and licence signing keys are not stored in public client code but are managed exclusively server-side by means of suitable secret management mechanisms.
10. AI tools and third-party features
Some optional features may use external specialised services, for example premium background removal, high-quality image upscaling, image optimisation, email delivery, payment processing or error diagnostics. Such features are used only if the user triggers them or if they are required for the booked service. For premium image features, the selected file is generally transmitted. Processing is carried out for the specific purpose of generating the result. The browser does not receive any provider secrets. Where providers outside the EU/EEA are used, the transfer takes place only on the basis of an adequacy decision, appropriate safeguards such as EU standard contractual clauses, or another permissible legal basis.
11. Contact, support and communication
When users contact us, we process the contact details provided, the content of the enquiry, technical attachments, screenshots, project files and communication metadata in order to answer the enquiry, analyse errors or fulfil contractual obligations. Support data is stored only for as long as is necessary for handling, evidence, product improvement, contract performance or legal obligations.
12. Security and access protection
We take technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. These include in particular transport encryption, role-based access, server-side secret management, logging of security-relevant events, access restrictions and a data-minimising product architecture. Despite careful protective measures, no internet-based processing can guarantee absolute security. Users should keep their credentials secret, use strong passwords and adequately secure their local devices.
13. Retention period
We store personal data only for as long as is necessary for the respective purposes. - Account and contract data are stored for the duration of the customer relationship. - Invoice and accounting data are stored in accordance with statutory retention obligations. - Project and profile data are stored for as long as the user keeps them in the account or locally. - Temporary uploads and processing files are deleted after the operation is completed, unless storage by the user, a support case or a legal obligation applies. - Security and system logs are stored for a limited period and then deleted or anonymised.
14. Recipients and categories of recipients
Depending on use, personal data may be transmitted to the following recipients or categories of recipients: - Hosting and infrastructure service providers. - Payment service providers and banks. - Email and communication service providers. - Providers of optional premium features. - Tax advisors, accounting, legal advisors and authorities, where legally required. - Support and development service providers, where they are needed for troubleshooting or provision of the product. Data is not disclosed to third parties for their own advertising purposes.
15. Transfers to third countries
Where personal data is transferred to countries outside the European Union or the European Economic Area, we ensure that a permissible legal basis exists. This may be an adequacy decision of the European Commission, the certification of a provider under a recognised data protection framework, EU standard contractual clauses or a statutory exception. When selecting and configuring service providers, care is taken to limit data transfers and, where possible, to use EU/EEA locations.
16. Data subject rights
In accordance with the GDPR, users have in particular the following rights: - Access to the personal data processed. - Rectification of inaccurate data. - Erasure of personal data. - Restriction of processing. - Data portability. - Objection to processing based on legitimate interests. - Withdrawal of consent given, with effect for the future. - Lodging a complaint with a data protection supervisory authority. To exercise these rights, a message to datenschutz@vextrify.com is sufficient. To avoid unauthorised disclosures, we may require reasonable proof of identity.
17. Objection to direct marketing
Where personal data is processed for direct marketing, users may object to this processing at any time. After an objection, the data concerned will no longer be used for direct marketing.
18. Automated decisions
Vextrify does not use any solely automated decision-making that produces legal effects concerning users or similarly significantly affects them. Licence, limit and security checks may be carried out automatically, but serve the performance of the contract, prevention of abuse and technical provision of the service.
19. Changes to this privacy policy
We will adapt this privacy policy if features, service providers, the legal situation or internal processes change. The current version is available at https://vextrify.com/datenschutz. In the event of material changes, we will inform users in an appropriate manner.