Privacy Policy

This is a courtesy translation. The German version is legally binding.

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Joël Marth IT Services
Senftenauerstraße 3
80689 Munich, Germany

Email: privacy@pathsweeper.com
Website: https://pathsweeper.com

A data protection officer is not legally required. For data protection inquiries, please contact the email address above.

2. Overview of Data Processing

PathSweeper is a browser-based application for swept path analysis. The following overview summarises the types of data processed and their purposes:

• Account data – email address; accepted Terms version, timestamp and language of acceptance
• Usage data – project data, uploaded files (CAD, background images), feedback messages
• Communication data – email address (newsletter, password reset)
• Consent and contract records – audit log of every Terms acceptance and (on purchase) the express waiver of the right of withdrawal, with version, timestamp, language and a pepper-hashed SHA-256 fingerprint of the IP address and user agent (see section 7a)
• Payment data – email address, project ID, locale (transmitted to the payment service provider); card / bank details are processed exclusively by the payment service provider, not by us; Stripe customer ID is stored on the account for reuse on subsequent purchases
• Invoicing data – buyer type (individual / business), company name, full billing address, VAT ID where applicable, tax scenario (§19 small-business / EU reverse charge / non-EU); retained on the account, on the project, and inside the ZUGFeRD / Factur-X invoice PDF (see section 14a)
• Technical data – IP address (stored as a SHA-256 fingerprint with a server-side pepper for the Terms consent log and the public DWG converter; transmitted in clear only in the server log files described in section 5), browser type, operating system, referrer, timestamps
• Analytics data – usage interaction events (self-hosted web analytics)

3. Legal Bases

We process personal data on the following legal bases under the GDPR:

• Consent (Art. 6(1)(a) GDPR) – newsletter subscription
• Performance of contract (Art. 6(1)(b) GDPR) – registration, provision of the application, project data, transactional emails (password reset, account confirmation), payment processing for the Projekt Pass
• Compliance with a legal obligation (Art. 6(1)(c) GDPR) – issuance and retention of invoices pursuant to § 14 UStG, § 147 AO, § 257 HGB; recording the acceptance of the Terms and the express waiver of the right of withdrawal pursuant to § 312k(6) BGB / § 356(5) BGB
• Legitimate interest (Art. 6(1)(f) GDPR) – server log files, IT security, self-hosted web analytics for product improvement, feedback processing, abuse prevention (rate limiting)

4. Security Measures

We implement technical and organisational measures to ensure an appropriate level of protection, including:

• TLS/HTTPS encryption for all connections
• Password hashing (no plaintext storage)
• Row-level security: users can only access their own project data
• IP addresses in the public DWG converter are stored only as a daily rotating hash (SHA-256)
• The IP address and user agent recorded in the Terms consent log (section 7a) are stored exclusively as a SHA-256 fingerprint using a stable server-side pepper; a database dump alone cannot be reversed to recover the original IP
• Isolated microservice architecture: CAD processing runs in its own container

5. Hosting and Server Log Files

Hosting

This website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner operates certified data centres exclusively in Germany and Finland (EU).

We have concluded a data processing agreement (DPA) with Hetzner pursuant to Art. 28 GDPR.

Server Log Files

Each time our website is accessed, the server automatically collects the following data:

• IP address of the requesting device
• Date and time of the request
• Requested URL / file name
• HTTP status code
• Amount of data transferred
• Referrer URL
• Browser type and version, operating system

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security and operational stability).

Retention period: Log files are automatically deleted after 14 days.

6. Content Delivery Network (Cloudflare)

We use the CDN and DNS services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you visit our website, your request is routed through Cloudflare servers. The following data may be processed: IP address, HTTP headers, requested URL, and timestamps.

Cloudflare may set technically necessary cookies (e.g. __cf_bm for bot detection), which serve exclusively for security purposes.

Legal basis: Art. 6(1)(f) GDPR. For cookies: § 25(2) No. 2 TDDDG (technically necessary).

Third-country transfer: Cloudflare is certified under the EU-US Data Privacy Framework. Standard contractual clauses (SCCs) have additionally been agreed.

7. Registration and User Account

Regular Account

During registration we collect:

• Email address
• Password (stored only as a hash)
• Optional: consent to receive email notifications (newsletter opt-in)
• Accepted Terms version, timestamp and language of acceptance; on subsequent upgrades (e.g. guest → regular account) the version accepted at the time of the upgrade. A tamper-evident copy of every acceptance is stored in the Terms consent log (section 7a).

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Retention: Until account deletion.

Guest Access

PathSweeper can be used without registration as a guest. In this case, we create an anonymous account on our server with an auto-generated random email (<random>@guest.pathsweeper.com) and a random password. The credentials are stored in your browser's localStorage so you can return to the same projects across reloads; the account record itself, and any projects you create, are stored in our PocketBase database. The auto-generated email cannot be traced back to a real person.

Purchasing a Projekt Pass requires a regular account. If you start a purchase as a guest, you are redirected to register first; from that point on your account is treated like any other registered account (Section 7 above).

Retention (guest): Guest accounts and their projects remain in the database until you actively delete them.

7a. Terms Consent Log

To document acceptance of our Terms (AGB) and – when buying a Projekt Pass – the express waiver of the right of withdrawal pursuant to § 356(5) BGB, we maintain a separate, tamper-evident table (consent_log) in our PocketBase database. One row is written per acceptance.

For each entry we store:

• Kind of acceptance (registration, guest-to-regular upgrade, checkout)
• User ID and – for purchases – project ID
• Accepted Terms version (date stamp of the version published at the time of acceptance)
• For purchases: whether the right-of-withdrawal waiver was given (omitted for B2B purchases without a right of withdrawal)
• Language of the displayed Terms (de / en)
• SHA-256 fingerprint of your IP address and user agent, computed with a stable server-side pepper (CONSENT_IP_SALT). The IP address and user agent themselves are not stored.
• Status (pending on creation, confirmed after payment) and, where applicable, the associated Stripe session ID
• Timestamps of creation and last update

If you later delete your account, the row remains as an anonymised record (the user ID is stored as a plain text reference rather than a linked relation) so that the legal evidentiary purpose can be fulfilled beyond the lifetime of the account.

Purpose: Fulfilment of the statutory duty to prove incorporation of the Terms into the contract (§ 305(2) BGB), the express waiver of the right of withdrawal for digital content (§ 356(5) BGB) and the order-process confirmation (§ 312k BGB).

Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation) in conjunction with the BGB provisions cited above; additionally Art. 6(1)(f) GDPR (legitimate interest in preserving evidence against misuse).

Retention:Until the contractual limitation periods expire; for purchase-related entries at least in parallel with the retention obligation for the associated invoice (10 years pursuant to § 147 AO).

8. Project Data

When you create and save projects, we process: project name, project data (swept paths, calibration, vehicle settings, measurements), a thumbnail image, and any uploaded background image.

All project data is protected by row-level security — each user can only access their own projects.

Legal basis: Art. 6(1)(b) GDPR. Retention: Until deletion by the user.

9. CAD File Processing

Users can upload CAD files (DXF, DWG, 12d XML, PDF) for geometry extraction. Processing takes place exclusively on our own servers in a dedicated container. No CAD files are shared with third parties. After successful processing, the uploaded file is deleted immediately and automatically.

Failed uploads (error diagnosis): If processing fails (for example due to a server or conversion error), we temporarily retain the affected file and its filename in order to reproduce and fix the specific cause of the error. The legal basis is our legitimate interest in the technical functionality, security and correctness of the service (Art. 6(1)(f) GDPR). This interest aligns with the interest of the affected users in having the error they encountered or reported resolved. Because the file is one the user uploaded themselves in order to use the service, and retention is short and strictly purpose-bound, no overriding interests of the data subject prevail. Retention lasts only as long as is necessary to fix the error, and at most 30 days, after which the records are deleted automatically (storage-limitation principle, Art. 5(1)(e) GDPR). You may object to this retention at any time and request early deletion (Art. 21 GDPR) via datenschutz@pathsweeper.com.

10. DWG-to-DXF Conversion (Public Tool)

We offer a public tool for converting DWG files to DXF format. No account is required.

• Uploaded file: Temporarily stored and automatically deleted after one hour.
• IP address: Not stored in plaintext. A SHA-256 hash with a daily rotating salt is used solely for rate limiting (max. 5 conversions per hour). The hash cannot be used for identification.

Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.

11. Feedback

Our feedback function allows you to report bugs, request features, or send general feedback — even without registration. We process: feedback type, your message (max. 5,000 characters), email (optional), page URL, user agent, locale, and user ID (if logged in).

Legal basis: Art. 6(1)(f) GDPR. Retention: Until processed and deleted.

12. Newsletter

You can subscribe to our newsletter by providing your email address. We additionally record the source of the signup (e.g. landing page, in-app) and the chosen language. Emails are sent via Resend (see section 13).

Double opt-in: After signup we send a confirmation email containing a one-time confirmation link. Your address is only marked as confirmed and added to the mailing list after you click that link. To this end we additionally store, until confirmation, a randomly generated confirmation token and the confirmation timestamp. Unconfirmed signups are periodically removed manually.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time via the unsubscribe link in each email or by contacting privacy@pathsweeper.com.

Retention: Until you withdraw your consent (unsubscribe); unconfirmed signups are periodically removed manually.

12a. Business Outreach to Users

In individual cases we may contact registered users directly – e.g. by email or via professional networks (LinkedIn) – where there is a clear connection between their professional role and PathSweeper. Typical occasions include cooperation and partnership enquiries, sponsoring, targeted product feedback requests, invitations to beta programmes or case studies, and individual offers (e.g. extended licences for large projects).

Only the email address already provided during registration is used, together with any publicly available professional information (e.g. name and role taken from the professional network profile).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in targeted business outreach, in developing our product, and in building cooperations with organisations relevant to our application domain).

These data are expressly notused for general newsletters or bulk marketing. Separate consent is required for that (see section 12).

Right to object: You can object to this processing at any time with effect for the future (Art. 21 GDPR) – simply by email to privacy@pathsweeper.com. After an objection, we will not contact you again on this basis.

13. Email Delivery (Resend)

We use Resend, Inc., San Francisco, USA, for sending transactional emails (password reset, account confirmation) and newsletters. Your email address is transmitted to Resend.

Third-country transfer: Standard contractual clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

14. Payment Processing (Stripe)

For payments related to the Projekt Pass we use the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe is an Irish-licensed electronic-money institution supervised by the Central Bank of Ireland.

The following data is transmitted to Stripe when you make a purchase:

• Your email address (billing / contact email)
• Amount, currency, and order reference
• Technical metadata used to link the payment to your project (project ID, locale)
• Where already on file: company name, billing address and VAT ID (pre-filled into the invoicing fields of Stripe Checkout)
• The data required for the chosen payment method (e.g. card, bank, or PayPal details) – this is collected and processed directly by Stripe. PathSweeper does not receive or store this data.

Stripe Checkout displays our Terms again for explicit confirmation during payment (consent_collection.terms_of_service). The outcome of this second confirmation is written back via our webhook to the Terms consent log (section 7a) and – where a newer Terms version was accepted – also to your user record. An already accepted newer version is never overwritten.

On your first purchase we create a customer record at Stripe and store the Stripe customer ID on your account so that subsequent purchases reuse the same record and previously entered invoicing data (address, VAT ID) is pre-filled automatically.

We also use the email address entered at checkout to send you the invoice as a PDF after a successful purchase.

Legal basis: Art. 6(1)(b) GDPR (performance of contract – payment and invoicing).

Roles: For the actual payment processing Stripe acts as an independent controller within the meaning of the GDPR (in particular to comply with anti-money-laundering, anti-fraud, and supervisory obligations). For all other processing we have concluded an Art. 28 GDPR data processing agreement.

Third-country transfer:Stripe Payments Europe Ltd. processes payment data within the EU. Stripe uses sub-processors, some of which may be located outside the EU in connection with specific payment methods (e.g. international card networks) or as part of the Stripe group (Stripe, Inc. in the USA); such transfers are safeguarded by appropriate guarantees (in particular standard contractual clauses pursuant to Art. 46(2)(c) GDPR and supplementary measures). Details are set out in Stripe's privacy policy.

Retention:Stripe stores personal data only for as long as is legally required, or — where no statutory period applies — no longer than is strictly necessary to fulfil the purposes for which the data was collected. As a financial institution, Stripe is in most cases required by applicable law to retain payment-related data (for instance for contract performance, payment processing or customer due-diligence checks) for a number of years. PathSweeper retains invoice data for 10 years pursuant to § 147 AO and § 257 HGB.

More information: Stripe's privacy policy.

14a. Invoicing (ZUGFeRD / Factur-X)

For every purchase we issue a VAT-compliant invoice as a hybrid PDF in the ZUGFeRD BASIC / Factur-X (PDF/A-3b) format. The machine-readable invoice data is additionally embedded into the PDF as XML.

For this purpose we process and store the following data on our servers (PocketBase, hosted at Hetzner):

• Buyer type: individual or business (buyerType)
• For businesses: company name, full billing address (street, postal code, city, country); for individuals: name and address as required
• Where provided: VAT identification number (USt-IdNr. / VAT ID)
• Tax scenario (taxScenario): §19 small-business, EU reverse charge, or non-EU — derived from buyer type, country and VAT ID
• Invoice number, invoice date, line items, net amount, VAT rate and amount where applicable, gross amount
• The generated invoice PDF (with embedded XML invoice data), stored in PocketBase's file storage

After purchase we send you a notification email (via Resend, see section 13) containing the invoice number, amount and a link to download your invoice from the logged-in “Invoices” area. For security reasons the invoice PDF itself is not attached to the email but remains available there at any time. We use this data exclusively to issue, send, retain, and where necessary correct the invoice.

Legal basis: Art. 6(1)(b) GDPR (performance of contract – invoicing) and Art. 6(1)(c) GDPR (compliance with a legal obligation pursuant to § 14 UStG, § 14a UStG, § 147 AO and § 257 HGB).

Retention: Invoice and accounting data, including the invoice PDF, are retained for 10 yearspursuant to § 147 AO and § 257 HGB. This statutory retention obligation overrides any erasure request under Art. 17(1) GDPR; after expiry the data is deleted.

15. Satellite Maps (Mapbox)

PathSweeper allows loading satellite images as project backgrounds. The interactive location picker uses Mapbox GL JS and the Mapbox Geocoding API; the final image import uses the Mapbox Static Images API from Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA.

When you open the location picker, your browser connects directly to Mapbox servers to load map tiles and search suggestions. Technically necessary data (IP address, user-agent, requested map regions, and search queries) is transmitted to Mapbox. The final import of the selected region is made exclusively server-side and transmits only coordinates and zoom level — no personal data.

Legal basis: Art. 6(1)(b) GDPR.

Mapbox, Inc. is a US company. Transfers to the USA are made on the basis of EU Standard Contractual Clauses (SCCs).

More information: Mapbox privacy policy.

16. Web Analytics (OpenPanel – Self-Hosted)

We use the open-source analytics software OpenPanel, which runs entirely on our own servers at Hetzner in Germany. No data is shared with third parties.

Data collected includes usage events (e.g. project created, export completed, tool switched, page views, newsletter signup), session data, device information, language preferences, and marketing attribution (UTM parameters from the entry link, first-session referrer and path — stored locally in your browser and attached to events sent to our own analytics instance). No IP addresses are stored.

Legal basis: Art. 6(1)(f) GDPR.

17. Local Storage (localStorage / sessionStorage)

We use your browser's local storage for technically necessary purposes (authentication tokens, guest credentials, theme preference), functional purposes (export counter, feedback status, preferred unit system m/ft, UI state such as the last-selected plan or already-dismissed hints), and marketing attribution (first-session UTM parameters and referrer, used to analyse which channels drive signups). The marketing attribution data is attached to events sent to our self-hosted analytics instance in Germany; it is not shared with third parties.

18. Cookies

PathSweeper does not set any cookies of its own. Authentication uses localStorage, not cookies. Cloudflare may set technically necessary cookies (e.g. __cf_bm for bot detection), which contain no personal data.

19. Data Processors

Data processing agreements pursuant to Art. 28 GDPR have been concluded with all processors.

20. Data Transfers to Third Countries

Data may be transferred to the USA in connection with Cloudflare and Resend. These transfers are safeguarded by the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR) and/or standard contractual clauses (Art. 46(2)(c) GDPR).

Stripe Payments Europe Ltd. is based in Ireland (EU). However, Stripe may use sub-processors located outside the EU in connection with specific payment methods (e.g. international card networks) or as part of the Stripe group (Stripe, Inc. in the USA); Stripe safeguards such transfers with appropriate guarantees pursuant to Art. 46 GDPR (in particular standard contractual clauses) — see Section 14.

21. Retention Periods

22. Your Rights

Under the GDPR you have the following rights. To exercise them, please contact privacy@pathsweeper.com:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) – your project data can be exported as JSON at any time
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

23. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

24. No Automated Decision-Making

We do not use automated decision-making including profiling pursuant to Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

25. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in the law or our services. The current version is always available on this page. Registered users will be notified of material changes by email.