Privacy Policy

1. Information We Collect

Depending on how you use the waitlist, the app and the website, we may collect the following categories of data:

• Waitlist / contact data: email address, signup timestamp, language preference, and the status of your consents (e.g. whether you opted in to marketing communications).
• Account data: name, email address, login credentials, user IDs, roles, and session data.
• Retail and order data: shipping address, billing address, order history, cart contents, and support requests.
• Payment-related data: payment status and transaction references processed through PayPal or other payment providers.
• 3D scan data: scan files, mesh data, textures, measurements, metadata, and locally stored temporary files.
• Technical data: IP address, device model, operating system, app version, language settings, and timestamps.
• Security and audit data: authentication events, access logs, error logs, abuse-prevention records, and records of consents given or withdrawn.
• Support data: information you send us by email or through support channels.

2. How We Use the Information

• To manage the waitlist and notify you of the app launch and material service updates
• To create and manage user accounts and authenticate users
• To provide scanning, storage, upload, restore, and processing features
• To process orders for physical products and support checkout
• Where you have separately consented: for ongoing marketing purposes, including after launch (see Section 3)
• To detect fraud, prevent abuse, secure our systems, and maintain audit trails
• To improve our app, backend services, and customer support
• To comply with legal, tax, and accounting obligations

On-device scan data

Scan data may be stored locally on your device and encrypted for security. Depending on the feature and your actions in the app, scan data may also be uploaded securely to our backend systems for account sync, restore, or user-requested storage.

3. Waitlist, Notifications & Marketing Communications

When you sign up for our waitlist with your email address, we process it to notify you of the app launch and material changes. This is based on taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in effective user communication (Art. 6(1)(f) GDPR).

If you have additionally and separately consented at signup (“Yes, I would also like to receive product news, offers and marketing emails”), we also use your email address for ongoing marketing purposes – including after the app launches – such as newsletters, product updates and special offers. The legal basis for this is your consent (Art. 6(1)(a) GDPR). This consent is voluntary, requested separately from waitlist signup, and does not affect whether you are notified of the launch.

You may withdraw your marketing consent at any time, with effect for the future, via the unsubscribe link in every email or by contacting us at the address below. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. We may use an email marketing service provider as a processor, which handles your email address solely on our behalf and instructions.

4. Analytics (Google Analytics)

Our website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies or comparable technologies to collect information about your use of our website, such as pages visited, time spent, approximate region (derived from your IP address), and device/browser type.

We only use Google Analytics if you have selected "Accept all" in the cookie banner. The legal basis is therefore exclusively your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG, the German law implementing the ePrivacy Directive's cookie-consent requirement). Without this consent, no Google Analytics script is loaded and no data is transmitted to Google.

Google automatically and irreversibly truncates IP addresses before they are processed or stored; your full IP address is not retained. Because Google Analytics is processed on Google's servers, data may also be transferred to the United States; we rely on the safeguards described in Section 6 (Standard Contractual Clauses, or the EU-U.S. Data Privacy Framework where the provider is certified) for this.

You may withdraw your consent at any time, with effect for the future, by changing your choice via the "Cookie Settings" link in our website's footer. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Sharing of Information

We do not sell your personal data. We may share information only when necessary, for example with:

• Cloud hosting and infrastructure providers
• Authentication and database service providers
• Payment providers such as PayPal
• Email marketing and newsletter service providers (only where you have consented to marketing communications)
• Analytics, logging, and security providers
• Professional advisors, courts, or authorities where required by law

Third-party providers are permitted to process personal data only to provide services to us and subject to appropriate contractual safeguards, in particular data processing agreements under Art. 28 GDPR. In the event of a business sale, merger, restructuring, or asset transfer, personal data may be transferred to the acquirer as part of the business assets; we will inform you where this involves a material change of processing purpose.

We do not “sell” or “share” personal data within the meaning of the California Consumer Privacy Act (CCPA/CPRA) for third-party targeted advertising (see Section 7).

6. Data Storage and Transfers

Our operations are based in Germany. Depending on the service involved, data may be stored or processed in the European Union, the United Kingdom, the United States, or other countries where our service providers operate.

Where personal data is transferred outside the EEA or UK – in particular to the United States – we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or, where the relevant provider is certified, the EU-U.S. Data Privacy Framework.

We retain data only as long as necessary for the purposes described in this policy or as required by law (see also the retention periods in Section 3).

7. Your Rights (GDPR)

Depending on your location, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to withdraw any consent given at any time with effect for the future, and to request data portability. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.

If your account supports deletion in-app, you may request deletion there. Otherwise, contact us using the details below and we will verify your identity before handling your request.

8. Your Rights in the United States (CCPA/CPRA and Other State Laws)

If you are located in the United States, in particular in California, additional rights may apply under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), as well as comparable privacy laws of other U.S. states (e.g. Virginia, Colorado, Connecticut, Utah). These include, among others:

• the right to know what personal information we collect and for what purpose;
• the right to delete your personal information;
• the right to correct inaccurate information;
• the right to opt out of the “sale” or “sharing” of personal information and of certain forms of targeted advertising;
• the right to non-discrimination for exercising these rights.

As described in Section 4, we do not sell or share personal information for monetary or other valuable consideration, nor for third-party behavioral advertising. You may submit requests to exercise these rights using the contact details below; we will verify your identity to a reasonable degree before processing the request.

9. Security

We use reasonable technical and organizational measures to protect data, including encryption, access controls, key management, and restricted administrative access. These measures are designed to also address requirements under applicable U.S. state data-security laws (e.g. data breach notification obligations). No method of transmission or storage is completely secure.

10. Email Marketing Rules

For marketing emails sent to recipients in the United States, we comply with the CAN-SPAM Act: no misleading header or subject lines, clear identification as advertising, our physical business address in every email, and a working opt-out mechanism that we honor within the legally required timeframe.

For recipients in the EU, we send marketing emails only with prior, express consent in line with the German Telecommunications-Digital-Services-Data-Protection Act (TDDDG) and the Act Against Unfair Competition (UWG). Every email includes a simple unsubscribe link.

11. Children

Our services are not intended for children under 13. We do not knowingly collect personal data from children under 13 without appropriate consent where required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be posted on our website. We will inform you appropriately of material changes, in particular new marketing purposes.

13. Contact Information

If you have questions about this Privacy Policy, our data practices, or wish to withdraw consent, please contact us at:

Email: lukasgroetsch94@gmail.com
Company: ScanShape UG (haftungsbeschränkt)
Address: Pappelallee 78/79, 10437 Berlin, Germany