Privacy Policy

1. Controller

The controller within the meaning of data protection law, in particular the EU General Data Protection Regulation (GDPR), is Formulor GmbH, Rheinstraße 201, 76532 Baden-Baden, Germany, email: service@formulor.de (see imprint).

2. Hosting, delivery and server logs

Our platform runs on servers operated by Hetzner Online GmbH (Germany). For protection and fast delivery we use the content delivery network and web application firewall of Cloudflare, Inc.; your requests pass through Cloudflare servers. Data processing agreements pursuant to Art. 28 GDPR are in place with both providers.

When you access our website, general information is collected automatically (server log files): IP address, date and time of access, page requested, browser type and version, operating system and referrer URL. This data is technically required to deliver the website, ensure its stability and security, and fend off attacks (e.g. denial of service).

The legal basis is our legitimate interest in operating and securing the platform (Art. 6(1)(f) GDPR). Log files are stored only as long as required for these purposes and are then deleted.

3. Cookies

We use only technically necessary first-party cookies. There are no analytics, tracking or advertising cookies and no third-party cookies. Technically necessary cookies do not require consent (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); this is why we do not show a cookie banner.

The legal basis is contract performance or initiation (Art. 6(1)(b) GDPR) for the cart and account session, and our legitimate interest in a functioning website (Art. 6(1)(f) GDPR).

4. Customer account (passwordless sign-in)

A customer account is optional — orders can also be placed as a guest. Sign-in is passwordless: we store no password. Instead, on request we send a one-time sign-in link to your email address (only a hash of the link is stored, not the link itself), or you register a passkey. For passkeys we store only the public key — biometric data (e.g. your fingerprint) never leaves your device and is never transmitted to us.

Within the account we process: email address, optionally a display name, language preference, session data (sign-in sessions are valid for 30 days and can be revoked server-side) as well as your saved designs and order overviews. The legal basis is contract performance (Art. 6(1)(b) GDPR).

You can delete your account yourself at any time under delete account. This removes your account data completely (email address, passkeys, sessions, saved designs). Order and invoice data remain unaffected because we must retain them under commercial and tax law (see section 5).

shape.tools beta programme: If you apply for beta access to the shape.tools configurator, we store your e-mail address, optionally your name, your language setting and the status of your application (applied, approved or revoked) in order to manage access and to notify you by e-mail once you are approved (Art. 6(1)(b) GDPR). The data is deleted when the beta programme ends or when you request deletion; you can apply without a customer account.

5. Orders and checkout

To process your order we handle the data entered at checkout: email address, first and last name, optionally a company name, delivery and billing address, phone number, optionally a VAT identification number, plus your order and payment information. Checkout is also possible without a customer account (guest order).

We pass this data only to the service providers who need it for fulfilment: the shipping company commissioned with delivery (name, delivery address) and our payment service provider (section 6). The legal basis is contract performance (Art. 6(1)(b) GDPR).

Order and invoice data are subject to statutory commercial and tax retention obligations (§ 257 HGB, § 147 AO; six to ten years depending on the document type) and are stored for that period (Art. 6(1)(c) GDPR). The confirmations you give during checkout (terms, made-to-measure notice) are logged with a timestamp as evidence.

6. Payment processing (Mollie)

Payments via PayPal, credit card and bank transfer (prepayment) are processed by our payment service provider Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands). Mollie receives the data required for the payment (amount, reference and, depending on the payment method, your payment details). Your credit card or bank details are collected directly by Mollie or the respective payment provider and never reach our systems.

The legal basis is contract performance (Art. 6(1)(b) GDPR). Mollie’s privacy policy applies in addition: mollie.com/privacy. Purchases on account for business customers (after prior approval) are processed directly by us.

7. AI configurator (shape.tools)

In the shape.tools configurator you can configure products in a dialog with an AI assistant. You are interacting with an AI system; the responses are machine-generated. To generate the responses we transmit your chat messages and the conversation history of the current session to our processor Anthropic (Claude API). Price, dimensions and feasibility are always computed by our own system — not by the AI.

Please do not enter personal data in the chat (e.g. names, addresses, contact details) — they are not needed to configure your product. We do not store chat histories permanently: they exist only for the duration of the current session and are automatically discarded afterwards. According to Anthropic, content transmitted via the API is not used to train AI models.

The legal basis is contract initiation (Art. 6(1)(b) GDPR) and our legitimate interest in a convenient configuration experience (Art. 6(1)(f) GDPR). Where data is transferred to the USA in the process, this is based on appropriate safeguards pursuant to Art. 44 et seq. GDPR (EU standard contractual clauses or the EU-US Data Privacy Framework).

8. Uploaded files and designs

Files you upload for fabrication, as well as your designs from the modeller and configurator, are stored in an S3-compatible object store on servers in Germany. We use them exclusively for verification (manual review before production by our staff), for fabricating your order and for creating the associated production documents. We grant no third-party access, except for service providers who need the data to fulfil your order (see terms and conditions, § 11).

The legal basis is contract performance or initiation (Art. 6(1)(b) GDPR). Files belonging to orders are retained within the statutory periods; uploads and designs without an order are deleted as soon as their storage is no longer required, and immediately upon account deletion.

9. Email communication

We send transactional emails only: sign-in links, order and payment confirmations, invoices and messages about your order (e.g. queries from the file review). There is no newsletter. Emails are sent via an email service provider commissioned by us (data processing agreement). The legal basis is contract performance (Art. 6(1)(b) GDPR).

If you contact us by email, we process your details to handle the enquiry and possible follow-up questions (Art. 6(1)(b) or (f) GDPR). Once your enquiry is resolved, the data is deleted unless retention obligations apply.

10. No analytics, tracking or advertising services

We use no web analytics (e.g. Google Analytics), no conversion tracking, no social media plugins, no embedded third-party content (e.g. YouTube) and no external font services. Fonts and all content are served from our own servers.

11. Your rights

You can exercise the following rights at any time:

• access to your data stored by us and its processing (Art. 15 GDPR),
• rectification of inaccurate personal data (Art. 16 GDPR),
• erasure of your data stored by us (Art. 17 GDPR),
• restriction of processing where we may not yet delete your data due to legal obligations (Art. 18 GDPR),
• objection to the processing of your data by us (Art. 21 GDPR), and
• data portability, provided you have consented to the processing or concluded a contract with us (Art. 20 GDPR).

If you have given us consent, you can revoke it at any time with effect for the future. To exercise your rights, an informal email to service@formulor.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg. A list of supervisory authorities is available at bfdi.bund.de.

12. Data security

All connections to our website are encrypted with TLS (HTTPS) in line with the current state of the art. Internal access to customer data is restricted to the staff handling it.

13. Changes to this privacy policy

We update this privacy policy when the legal situation or our services change (e.g. when new services are introduced). The current version published here applies.