GDPR & Data Protection

GDPR & Data Protection Notice — Effective August 1, 2026

This notice supplements our Privacy Policy for users in the European Economic Area, the UK, and similar jurisdictions.

1. Controller

The data controller is Mobicon Line SRL (CUI 17238385), Str. Moise Constantin nr. 30, București, România, operator of CNC Vector Studio. Contact: besliandrei@gmail.com.

2. Legal bases

• Contract: to provide the Service you signed up for (account, project sync, subscriptions).
• Legitimate interests: to secure the Service, to prevent abuse, to investigate incidents that happen during a cut on your machine, and to improve feeds-and-speeds advice from CNC job records (see Privacy Policy, sections 1 and 5 — kept for at most 12 months, with no drawings, G-code or coordinates), and to prevent repeated use of the free trial (see Privacy Policy, section 6 — we keep only a keyed hash of the email address, for 24 months).
• Consent: where required, e.g. optional communications.
• Legal obligation: to comply with tax/accounting and lawful requests.

3. Your rights

You have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. You may withdraw consent at any time where processing is based on consent.

4. International transfers

Our processors (Google, Stripe, Anthropic) may process data outside the EEA/UK, including in the United States, under appropriate safeguards such as the EU Standard Contractual Clauses.

5. Sub-processors

• Google Firebase — authentication, database, hosting.
• Stripe — payment processing.
• Anthropic — AI design generator and assistant (processes your prompt and a short design summary when you use AI features).

6. Data deletion

You can delete cloud projects in-app, and delete your entire account and all associated personal data yourself at any time from your account settings — this immediately cancels any subscription and deletes your data from us and from our payment processor (Stripe). You may also contact besliandrei@gmail.com to request deletion; we will action verified requests within the period required by law. Certain records may be retained where a legal obligation requires it (for example, tax and accounting records). One pseudonymous record is retained deliberately, and we state it plainly rather than leave it out: a keyed hash (HMAC-SHA256) of your email address, kept for 24 months, so that the once-per-person free trial cannot be restarted by deleting an account and registering again. It holds no address, name, identifier or IP, your address cannot be recovered from it, and it governs nothing except trial eligibility — you can still register, use the free tier and subscribe. It is processed on the legitimate-interest basis above, and you may object at besliandrei@gmail.com, in which case we delete it. See Privacy Policy, section 6.

7. Complaints

You have the right to lodge a complaint with your local data protection authority.

8. Contact

Data protection requests: besliandrei@gmail.com