CRN 3DThis policy explains which personal data we process when you visit crn3d.com and use the CRN 3D application (the "Service"), why we process it and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the law of the provider's country of registration.
1. Controller
IPJ Solutions. For any privacy question: support@crn3d.com.
2. Data we process
Visiting this website
This website uses no cookies, analytics or advertising tools. Like any web server, ours logs technical request data (IP address, time, page requested, browser type) for security and troubleshooting, and deletes it after 30 days at the latest.
Account and company
Name, email address, password (we store only its cryptographic hash, never the password itself), company name, role in the company and invitations. If you sign in with Google or Microsoft, we receive your name, email and account identifier from them.
Content you enter
Projects, catalogues, quotes, jobs, photos from measuring or complaints, and data about your customers and suppliers (e.g. name, address, phone). For this third-party data you are the controller and we process it only on your instructions (see section 8).
Using the application
IP address, sign-in times, technical logs and a change log (who changed a project or setting and when), for security, support and project history.
Payments
Payments are processed by Paddle.com (Paddle.com Market Limited, United Kingdom) as Merchant of Record and independent controller of payment data. From Paddle we receive name, email, country, subscription status and amounts, but never card details. See Paddle's privacy policy.
Communication
The content of emails you send us and our replies.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service: account, company, projects, teamwork | Performance of contract |
| Billing the subscription and keeping transaction records | Performance of contract and legal obligation |
| Service emails (invitations, password reset, subscription notices and changes to terms) | Performance of contract |
| Security, abuse prevention, technical logs and backups | Legitimate interest |
| Answering enquiries and support | Performance of contract or legitimate interest |
| News and offers by email (if we introduce them) | Only with your consent, which you can withdraw at any time |
We do not sell personal data, use it for advertising or make automated decisions with legal effect on you.
4. Cookies and local storage
This website sets no cookies. The application uses only strictly necessary cookies for sign-in and protection against forged requests, and remembers settings such as theme and panel layout in your browser's storage. We use no tracking or advertising cookies, so no cookie consent is required. If that changes, we will ask for your consent first.
5. Who we share data with
We share data only with trusted service providers who process it on our instructions under a data processing agreement:
- Hosting and backups: Hetzner Online GmbH (Germany), server in Helsinki, Finland (EU)
- Sending email: Namecheap, Inc. (Private Email), USA
- Payments: Paddle.com Market Limited (independent controller for payment data)
- Third-party sign-in (only if you choose it): Google LLC, Microsoft Corporation
We may also disclose data to public authorities where the law requires it.
6. Transfers outside the EU
Service data is stored in the European Union. Where one of the providers above processes data outside the EU/EEA (e.g. Paddle in the United Kingdom, or Google and Microsoft in the USA), this is based on an adequacy decision or the European Commission's standard contractual clauses.
7. How long we keep data
- Account and company data — while the account is active; after a deletion request we delete it within 30 days.
- Backups — expire on rotation, within 12 months at the latest.
- Website and application technical logs — up to 30 days, unless needed to investigate a security incident.
- Subscription and payment records — as long as accounting and tax law requires.
- Support email correspondence — up to 2 years after the last message.
8. Processing on behalf of the Customer
For personal data the Customer enters about its customers, suppliers and employees, the Customer is the controller and we are the processor. We process that data only to provide the Service and on the Customer's instructions; bind everyone with access to it to confidentiality; use only the providers listed in section 5 and announce changes to that list in advance; help the Customer answer requests from data subjects; notify the Customer of a data breach without undue delay; and delete or return the data when the contract ends. On request we sign a separate data processing agreement (DPA).
9. Security
All traffic uses HTTPS. Passwords are stored as cryptographic hashes, each company's data is separated at database level, server access is restricted and logged, and backups are made daily. No system is completely secure; if a data breach affects you, we will notify you and the competent authority as the law requires.
10. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent. Send requests to support@crn3d.com; we reply within 30 days. You may also lodge a complaint with a supervisory authority: the data protection authority of the provider's country of registration or the authority of the EU country where you live or work.
11. Children
The Service is intended for business users and we do not knowingly process data of persons under 16.
12. Changes to this policy
We announce material changes to this policy by email or in the Service before they take effect. The effective date is shown at the top.
This policy is also available in Serbian / Bosnian.