Privacy Policy
Last updated 16 October 2026
1. Controller
Viktoriia Romanova PR Subotica, Borivoja Misica 86, 24000, Subotica, Serbia, MB00000, PIB 00000, is responsible for the personal data processed by Traceflat (traceflat.com). Contact for any privacy question or request: support@traceflat.com.
2. Without an account
The editor works without an account. Your projects are then stored in your browser only (local storage) and never reach us. Our server sees the technical data of each request (IP address, browser) to deliver the pages and keep the service secure; it is not used to identify you, and server access logs are deleted within 14 days.
3. What we keep, why and for how long
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email, name and Google account id (if you sign in with Google) | Your account; sign-in links; emails about your purchases and the service | Contract | Until you delete the account |
| Sign-in sessions: a session cookie, IP address, browser | Keeping you signed in; security | Contract; legitimate interest (security) | 30 days after the last use |
| Cloud projects (plans, room names, furniture) | Storing and syncing your projects | Contract | Until you delete them (removed for good 30 days later) or the account |
| AI requests: your messages and photos, the plan sent with them, the answers | Running the request; the conversation's memory for your next requests; finding errors | Contract; legitimate interest (fixing errors) | Photos and the detailed steps of the AI: 30 days, or until you clear the chat. Messages and answers: until you delete the account |
| Purchases: pack, price, credits, refunds; the terms you accepted, with the time, IP address and browser | Delivering the pack; proof of the accepted terms; accounting and tax | Contract; legal obligation | As long as accounting law and possible claims require (up to 10 years), also after the account is deleted |
| Security and account events (sign-ins, purchases, blocked actions) with IP address | Preventing abuse and fraud | Legitimate interest | 12 months |
An email address is needed for an account; without one you can still use the editor. We make no automated decisions with legal or similarly significant effects on you. We do not use advertising or analytics trackers, we do not sell personal data, and we do not use your plans or photos to train AI models. The service is not directed at children under 16.
4. Who processes it for us
- Hosting: Hetzner Online GmbH (Germany), servers in Finland». The servers and the database of the service.
- Paddle (Paddle.com Market Ltd, United Kingdom): the reseller and Merchant of Record of every purchase. Paddle collects your payment details, name, email and country itself, under its own privacy notice; we never see your card.
- Resend (Resend, Inc., USA): sends our emails (sign-in links, purchase confirmations).
- Cloudflare Turnstile (Cloudflare, Inc., USA): checks that the sign-in form is used by a person, not a bot; it sees your IP address and browser, sets no cookies.
- OpenRouter (OpenRouter, Inc., USA): routes AI requests to the maker of the model in use (now: models of OpenAI, Anthropic) or to a cloud that hosts that model. What you send to the assistant (your message, photos and the current plan) goes to them to produce the answer; only providers that neither store it nor train on it are used.
Some of them are outside the EU / EEA and Serbia. Transfers rely on adequacy decisions or the standard contractual clauses of the European Commission.
5. Cookies and local storage
One cookie, the session cookie, keeps you signed in; it is strictly necessary and set only when you sign in. Signing in with Google sets two more for 10 minutes, which protect that sign-in. The editor keeps your local projects and settings (theme, units) in the local storage of your browser. The payment form is loaded only when you open it to pay, and sets its provider's own cookies then.
6. Your rights
You can get a copy of your data in a portable format (account menu → Download my data), delete your account and its data (account menu → Delete account), and ask us for the correction of your data, a restriction of processing, or object to processing based on legitimate interest. Write to support@traceflat.com from the email of your account; we answer within 30 days. You also have the right to complain to a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EU, the authority of your country.
7. Changes
We update this page when what we process changes; substantial changes are announced in the service or by email.