Privacy Policy

This policy explains what CNC Vector Studio collects and why.

1. Data we collect

Account data: email, display name, and authentication identifiers (via Firebase Authentication).
Content: designs and projects you choose to save to the cloud (stored in Google Firestore).
Billing data: subscription status and customer/price identifiers (via Stripe). We do not store your full card number; Stripe handles payment details.
AI features data: when you use the AI design generator or assistant, your prompt and a short summary of your current design (board sizes and shape counts — not your vector or G-code data) are sent to our AI provider to produce a result.
CNC job data: for every G-code export, and for every job you send to your machine from the app, we keep a job record — the bit, the material you chose, feed, spindle speed, depth, the estimated time and, for jobs run on the machine, how the job ended (finished, stopped, alarm, link lost), the line it stopped at, the error or alarm code the controller returned, the feed and spindle overrides you used, and the real elapsed time. It does not include your drawing, your G-code, your project name or any coordinates. This data makes the Service work: the AI assistant personalises its feeds-and-speeds advice from it, and without it a problem that happens during a cut cannot be investigated.
Technical data: basic logs and error diagnostics needed to operate and secure the Service.

2. How we use it

To provide and maintain the Service, sync your projects, process subscriptions, run AI features you request, prevent abuse, and support you.

3. Processors

We rely on Google Firebase (authentication, database, hosting), Stripe (payments), and Anthropic (AI design generator and assistant). Your data is processed by these providers under their own terms and security practices; see the GDPR notice for the sub-processor list.

4. Sharing

We do not sell your personal data. We share data only with the processors above as needed to run the Service, or where required by law.

5. Retention

We keep account and project data while your account is active. The CNC job records described in section 1 are kept for at most 12 months from the job and are then deleted automatically; export records are limited to the last 20. You can delete individual projects in-app, or delete your entire account and all associated data — including every job record — yourself at any time from your account settings (Plans tab → Delete account), which also cancels any subscription and removes your data from our payment processor. You may also contact us to request deletion. One deliberate, pseudonymous exception is described in section 6. Certain records may be retained where required by law (for example, tax and accounting records).

6. Preventing repeated free trials

The 14-day free trial is once per person, not once per account. So that we can apply that without keeping any record of who you are, we store a one-way keyed hash (HMAC-SHA256) of your email address — reduced first to the form that identifies the mailbox rather than the exact spelling you typed — when you create an account or start a trial — and again, if it is not already stored, when you delete your account. The hash is computed with a secret key held in Google Secret Manager and never disclosed. The stored entry contains only that hash, the date the entry was created, the date it expires, and whether the one-time welcome credits have already been granted. It contains no email address, no name, no account identifier, no IP address and no design data. Your address cannot be read out of it or reversed from it: without the secret key the hash is not linkable to any address, and we do not keep a list of addresses to compare it against. This entry is the only thing that survives the deletion of your account, and it is used for exactly one decision: whether a new sign-up is eligible for a free trial. It never prevents you from creating an account, from deleting an account, from using the free features, or from buying any paid plan — a returning user simply does not receive a second free trial and is offered the paid plans instead. Legal basis: our legitimate interest in preventing repeated use of a free trial that would otherwise be unlimited (Art. 6(1)(f) GDPR). Retention: 24 months from the date the entry was created (whichever came first: account creation or the start of a trial). After that the entry stops having any effect and is deleted automatically by a scheduled job. You have the right to object to this processing: write to besliandrei@gmail.com and we will delete the entry for your address.

7. Security

We use industry-standard measures (per-user access rules, encryption in transit). No method is 100% secure, but we work to protect your data.

8. Your rights

Depending on your location you may have rights to access, correct, export, or delete your data. See the GDPR notice or contact besliandrei@gmail.com.

9. Children

The Service is not directed to children under 16.

10. Contact

Privacy questions: besliandrei@gmail.com