Version 1.3 · effective from 11 October 2026
Translation for information; the Czech version is binding. The legally binding text is the Czech version.
This policy explains which personal data we process in the Filamo service (https://filamo.cz), why, for how long and what rights you have. We thereby fulfil our obligation to provide information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Controller and contact
DATAHOLD s.r.o., Company ID (IČO) 23533803, with its registered office at Na Folimance 2155/15, Vinohrady, 120 00 Praha 2, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 428772. Contact for personal data protection: support@filamo.cz, telephone +420 602 723 234, or by letter to the address of the registered office. We have not appointed a data protection officer.
2. Which data we process, why and on what legal basis
| Category | Data | Purpose | Legal basis (Article 6(1) GDPR) | Retention period |
|---|---|---|---|---|
| Account | e-mail address, name and, where applicable, the profile photo address from the provider whose account you sign in with (Google, Microsoft, Facebook or Apple; with Apple this may be a hidden forwarding address), the identifier of your account with the provider, user ID, registration date, e-mail verification. We do not process passwords – sign-in is verified by the provider. For accounts created earlier with an e-mail address and password, Firebase keeps only the password hash, which can no longer be used to sign in; it is deleted when you unlink it in the Account or when the account is deleted | creating and maintaining the account, sign-in | point (b) – contract | for the duration of the account; when the account is deleted, the data are deleted from operational systems immediately and may remain in backups for no longer than 90 days |
| Consents to terms | the versions of the terms and conditions, the policy and the notice on AI outputs to which you consented, the exact wording, server time, method of giving consent, HMAC of the IP address | evidencing what you consented to and when (§ 1839 of the Civil Code) | point (c) – compliance with a legal obligation; point (f) – legitimate interest in proving consent | for the duration of the account |
| Account status | plan, demo, conversions, credits, storage, blocking, conversion history (time, type, project ID) | providing the service and billing conversions | point (b) | for the duration of the account |
| Company details | name, Company ID, VAT ID, address, billing e-mail, contact person and telephone; at your request retrieved from the ARES register | invoicing, contact | point (b); for accounting documents point (c) | for the duration of the account; for accounting documents see “Payments” |
| Sketches, photos and projects | images (reduced in size and stripped of EXIF metadata before upload) and their small thumbnail for the library, descriptions, dimensions, models, orders, stock, workshop | providing the service (recognition, generation, storage) | point (b) | until the project or account is deleted; for the authorship archive see below |
| Payments | Stripe customer ID, goods purchased, amount, discount, subscription status, billing name and address, VAT ID, record of consent to commencement of performance (version and wording, time); card details are processed only by Stripe | payments, subscriptions, accounting documents, refunds, evidencing consent | point (b); point (c) – the VAT Act, the Accounting Act, § 1839 of the Civil Code | tax documents 10 years from the end of the taxable period (§ 35(2) of Act No. 235/2004 Coll., on Value Added Tax); accounting documents 5 years (§ 31(2)(b) of Act No. 563/1991 Coll., on Accounting); after the account is deleted, without any link to the account (pseudonymised); auxiliary payment processing records (received Stripe events 30 days, pending refunds 90 days, sent invoice notifications 400 days) are deleted automatically |
| Promo codes | account ID, code redeemed, type (credits or discount), time, link to the payment | granting credits or a discount, single use of a code per account, campaign evaluation | point (b); point (f) – protection against abuse | for as long as the campaign records are kept; after the account is deleted, under a pseudonym |
| Security and limits | HMAC of the IP address (the IP address converted into a fingerprint using a secret key; the address itself is not stored), account ID, numbers of requests and attempts within a time window, lock on a running AI call; for reports, a fingerprint (HMAC) of the notifier’s e-mail address for the purpose of limiting confirmations | protection against abuse, overload and disproportionate costs | point (f) – legitimate interest in secure operation | hourly AI limits 2 hours, other limits no longer than 3 days, AI call lock 6 minutes – then deleted automatically |
| Bot protection (Firebase App Check, reCAPTCHA Enterprise) | device and browser data (e.g. IP address, browser and device type and settings, time), data on interaction with the page (e.g. pointer movement, taps), the reCAPTCHA cookie and data (see cookies); the result is only a token proving that the request comes from the genuine Filamo application | protection of sign-in, the database and storage against automated abuse (bots, forged requests) | point (f) – legitimate interest in secure operation | Filamo stores neither the assessment nor the data; the token remains in the browser until it expires (usually 1 hour) and is then renewed; Google in accordance with its terms |
| AI costs | account ID (for users who are not signed in, HMAC of the IP address), operation, model, number of tokens, price in USD, time; daily spending of the account | cost circuit breaker, daily and hourly caps, accounting and operational overview | point (f) – legitimate interest in cost management; point (c) for accounting data | individual records 400 days, daily spending of the account 12 months – then deleted automatically; after the account is deleted, the records are pseudonymised and the daily spending is deleted |
| Operational statistics | daily number of conversions per account; daily totals without personal data | operational overview and evaluation of plans | point (f) | 13 months (automatically); deleted when the account is deleted |
| Figurines (AI 3D) | account ID, job at the service, type (photo or description), height, status, price | creating the figurine and billing the conversion | point (b) | 30 days (automatically); we store neither the photo nor the description, we only pass them on to the Meshy service |
| Filamo Scan app (iPhone, iPad) | for a linked device: account ID, device name and model (sent by the app, e.g. “iPhone (iPhone16,1)”), SHA-256 fingerprint of the access token (we do not store the token itself), time of linking and of last use; one-time linking and scan-request codes; for an upload: file with the part geometry (OBJ) or scanned document (PDF or image of a drawing or sketch), name, size, time, device ID. A 3D scan contains only the shape of the object – the app sends no colours, photos or location; a scanned document contains only what is on the scanned paper | linking the app to your account and passing the scan or document to Filamo, only for recognition and creating the model | point (b) | codes 10–60 minutes, scans 7 days (then deleted automatically; you can also delete them right away), devices until unlinked in Account or until the account is deleted |
| One demo per mailbox | HMAC of the canonical form of the e-mail address (without dots and the “+tag” for Gmail) and the time of the first demo – without the address and without the account ID | preventing repeated use of the demo and of “new users only” promo codes by deleting the account or using an alias | point (f) – legitimate interest in protection against abuse | permanently (survives deletion of the account); the address cannot be derived from the fingerprint, it only allows the same mailbox to be recognised on a new registration |
| Technical logs | hosting records (time, request address, IP address in readable form, errors) – we do not write the content of sketches, prompts or model code into the application logs | operation, debugging, security | point (f) | 30 days (Cloud Logging), then deleted automatically |
| Invite a friend | for the inviting user: the random code of the personal link, the numbers of invitees, purchases and credits earned, the HMAC of the IP address from the last time the link was opened in the Account; for the invitee: the pairing (invitee’s account ID and inviting user’s account ID), time of registration and of the first purchase, payment ID, bonus status, HMAC of the canonical e-mail address and a flag whether the HMAC of the IP address at registration matched the inviting user; no name or e-mail address in readable form – Filamo does not send invitations, the user sends the link themselves | granting and, where applicable, removing the bonus (clause 8.5 of the terms), protection against abuse (own accounts, repeated bonus for the same mailbox); a matching IP is only a signal for review and blocks nothing by itself | point (f) – legitimate interest in a fair bonus programme and in protection against abuse | the code and counts for the lifetime of the inviting user’s account; the pairing 12 months from the last change (automatically), immediately after the inviting user’s account is deleted, without the invitee’s ID (pseudonym) after the invitee’s account is deleted; the e-mail fingerprint of a mailbox for which a bonus was granted without time limit – it protects against a repeated bonus for the same mailbox (the address cannot be derived from it) |
| Authorship – licence and verification page | rights holder, licence, file fingerprints, time; name on the public verification page only with consent | issuing the certificate and public verification | point (b); display of the name point (a) – consent (may be withdrawn) | for as long as the project exists; the name ceases to be displayed upon withdrawal of consent or deletion of the project |
| Model sharing | for the author: account ID, shared snapshot of the model (STL, parameters and code), title, description, thumbnail, price, licence, number of uses and earnings in credits; the author’s name in the gallery and on the model page only with consent (“show name”); for the buyer: record of use (account ID, shared model, price, fee, time, ID of the project copy) and credit movements on both accounts (without the ID of the other party) | making the model available, settlement of credits (price, Filamo fee, author’s share), use paid once, refund of credits upon a justified report | point (b) – contract; display of the name point (a) – consent (may be withdrawn at any time in the sharing settings); records of use point (f) – legitimate interest in settlement and in the defence of claims | for the duration of sharing and of the account; when the author’s account is deleted, the sharing is withdrawn and the snapshot is deleted; records of use are pseudonymised after the account is deleted and kept for 3 years (disputes concerning credits and rights) |
| Solemn declaration (declaration log) | user ID (after the account is deleted, a pseudonym), role, wording and version of the declaration, holder, licence fingerprint, server time, HMAC of the IP address, shortened browser user agent | evidencing who made the declaration and when; defence of legal claims | point (f) – legitimate interest in proving and defending claims | 4 years from the declaration; kept even after the account is deleted |
| Reports of infringement of rights | name and e-mail address of the notifier, description, link, verification code, time, HMAC of the IP address, user agent, note and status of handling | handling notices under Articles 16–17 DSA, protection against abuse | point (c) – Regulation (EU) 2022/2065; point (f) | until handled and then 3 years from handling (automatically) |
| Communication with support | e-mail address, content of the message, attachments | handling enquiries, complaints, withdrawals | points (b), (c), (f) | 3 years from handling (complaints and withdrawals for as long as claims may be asserted) |
| Customer directory, quotations, technical drawings and approvals (Premium plan) | data of your customers that you enter: name or business name, Company ID, VAT ID, address, e-mail address, telephone, note; quotations and their items; for drawing approvals, the name of the person who decided, comment, time and HMAC of the IP address (for approvals up to 12 October 2026 also the e-mail address, if they entered it) | maintaining your directory, quotations and drawing approvals | we process them for you as a processor (Article 28 GDPR) – see Article 2a | until the record or the account is deleted; the approval link is valid for 30 days and deletes itself one day later |
| Administration audit | records of administrator actions (who changed what in the account and when); search text only as a fingerprint | security, evidencing interventions | point (f) | 2 years (automatically); after the account is deleted, the account ID in the records is replaced by a pseudonym |
Obligation to provide data: Account and payment data are necessary for the conclusion and performance of the contract; without them we cannot provide the service. Other data (name on the verification page, company details) are voluntary.
Sources of data: directly from you; from the provider when signing in with a Google, Microsoft, Facebook or Apple account (name, e-mail address, where applicable profile photo); from the public ARES register (company details by Company ID); from Stripe (payment status); from another user (notice of infringement of rights, use of your shared model).
Shared models: The public page of a shared model can be seen by anyone with the link (for public models also in the gallery). It shows only the title, description, thumbnail, price, licence, number of uses and the author’s name, if the author has allowed it – neither the author’s account ID nor those of buyers are published. A buyer can see, for their copy, the licence including the rights holder whom the author specified in the licence.
Automatic deletion: Records with a limited retention period carry an expiry date and the database (Firestore TTL) deletes them by itself, as a rule within 24 hours of expiry: limits and locks, auxiliary payment records, drawing approval links, individual AI costs (400 days), daily AI spending of the account (12 months), pairing of an invitee with the inviting user (12 months from the last change), the solemn declaration log (4 years), handled reports (3 years from handling), administration audit (2 years), figurine jobs (30 days) and daily conversion counters (13 months).
Automated decision-making: We do not take decisions about you based solely on automated processing which produce legal effects (Article 22 GDPR). Automatic limits (daily and hourly caps) only temporarily restrict the use of AI. Bot protection (reCAPTCHA) assesses requests automatically; a low score can only lead to an individual request being rejected – write to us if this prevents you from using the service.
Content of sketches and photos: Photos and sketches may contain personal data (faces, names, texts). Please upload only what you have the right to upload; for figurines from a photo of a person, only with the consent of the person depicted. We do not use data from images to identify persons.
2a. Data of your customers – Filamo as a processor (Article 28 GDPR)
We process the data that you enter into Filamo about your customers (directory, quotations, technical drawings and their approval) for you as a processor; you are the controller. This Article, as part of the contract (clause 18.3 of the Terms and Conditions), constitutes a data processing agreement under Article 28(3) GDPR:
- Subject matter and duration: storage, display, export to PDF and creation of the approval link, for the duration of the account. Nature and purpose: providing the directory, quotation and approval features. Data: identification and contact data of customers and their contact persons, content of quotations, approval decisions. Data subjects: your customers and their representatives.
- We process them only on your instructions – use of the application’s features constitutes an instruction; we do not use them for any other purpose.
- Confidentiality: access is granted only to authorised persons bound by confidentiality.
- Security under Article 32 GDPR – see Article 6.
- Sub-processors: Google (Firebase – hosting, database, storage). We do not send the approval link or the customer’s decision by e-mail – you pass the link on to the customer yourself. You grant a general authorisation for the engagement of sub-processors; we will inform you in advance of any intended change and you may object (and close your account).
- We will assist you in handling requests from data subjects and in fulfilling obligations under Articles 32–36 GDPR (you can edit the data yourself, download them in the export and delete them).
- We will notify you of a personal data breach without undue delay.
- Upon termination (deletion of the record or the account) we will delete the data, from backups within 90 days at the latest; you can download them before deletion.
- We will provide the information necessary to demonstrate compliance with these obligations and allow audits to a reasonable extent (by prior arrangement, at your expense, no more than once a year, unless there is a reasonable suspicion of a breach).
You are responsible for having a legal basis for entering your customers’ data and for informing them about the processing.
3. To whom we disclose data (recipients and processors)
We do not sell data. We disclose them only to processors who operate the service on our behalf (Article 28 GDPR) and, to the extent necessary, to other recipients. When transferring data outside the European Economic Area (in particular to the USA), we transfer data on the basis of standard contractual clauses approved by the European Commission, or on the basis of the EU-U.S. Data Privacy Framework, where the recipient is certified under that framework.
| Recipient | Role | What it processes | Where | Safeguard for transfers outside the EU |
|---|---|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Storage, App Hosting, Cloud Logging) – Google Ireland Ltd. / Google LLC | processor | accounts, application data, files, logs | Firestore and Storage in the europe-west3 region (Frankfurt), application hosting in the europe-west4 region (Netherlands); Firebase Authentication (sign-in data) is processed by Google globally, in particular in the USA | Firebase and Google Cloud data processing terms; standard contractual clauses or the EU-U.S. framework, where the recipient is certified |
| Google (reCAPTCHA Enterprise for Firebase App Check) – Google LLC / Google Ireland Ltd. | processor (Google Cloud data processing terms) | device, browser and page interaction data, IP address, reCAPTCHA cookie – for protection against abuse | globally, in particular the USA | standard contractual clauses or the EU–US framework where the recipient is certified; Google Privacy Policy |
| Google (“Continue with Google” sign-in) | independent controller | sign-in with your Google account | in accordance with Google’s policies | in accordance with Google’s policies |
| Anthropic (Claude model, API) | processor | images of sketches and photos, an image attached to a model edit, descriptions, dimensions – for recognition, generation and editing of the model | USA | standard contractual clauses or the EU-U.S. framework, where the processor is certified; it handles data in accordance with its commercial terms for the API, under which inputs and outputs are by default not used to train models and are retained only for a limited period |
| Stripe – Stripe Payments Europe, Ltd. (Ireland), Stripe, LLC (USA) | processor and, for certain purposes (fraud prevention, regulatory obligations), independent controller | payment and billing data, e-mail address | EU and USA | standard contractual clauses or the EU-U.S. framework, where the recipient is certified |
| Mailgun Technologies, Inc. (Sinch group) | processor | transactional e-mails (purchase confirmation, account notifications, outcome of a notice); it does not process invitees’ addresses – Filamo does not send invitations | EU region (servers in the EU); Mailgun keeps delivery records (recipient address, time, status) for no longer than 30 days | standard contractual clauses or the EU-U.S. framework, where the processor is certified (for possible support access from the USA) |
| Meshy (figurines – AI 3D), only if the feature is available and you use it | processor | photo or description of the figurine | in accordance with Meshy’s policies, in particular the USA | standard contractual clauses or the EU-U.S. framework, where the processor is certified; it handles data in accordance with its terms and its privacy policy |
| Cloudflare, Inc. | DNS provider (without proxy) | does not process the content of or visits to the application; it handles only DNS queries | globally | standard contractual clauses or the EU-U.S. framework, where the provider is certified |
| Microsoft, Meta (Facebook), Apple (sign-in with a Microsoft, Facebook or Apple account, if offered) | independent controller | sign-in with your account at the provider | in accordance with the provider’s policies | in accordance with the provider’s policies |
| Accountant, tax adviser, lawyer | recipient | accounting documents, necessary data | Czech Republic | – |
| Public authorities | recipient | on the basis of the law | Czech Republic/EU | – |
4. Your rights
You have the right:
- of access to your data and to a copy (Article 15 GDPR),
- to rectification (Article 16),
- to erasure (Article 17) – most simply by deleting your account,
- to restriction of processing (Article 18),
- to data portability (Article 20) – in the Account, the Download my data button gives you an export of the account data in a machine-readable format (JSON: profile, account, transactions, consents, projects with file download links valid for 1 hour, stock, workshop, customers, quotations, payments, invitations, declarations, shared models); you can also download projects and models individually (STL/3MF),
- to object to processing based on legitimate interest (Article 21),
- to withdraw consent (display of your name on the verification page) at any time in the project’s licence settings – withdrawal does not affect the lawfulness of processing before it (Article 7(3)),
- to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz (Article 77 GDPR).
Send your request to support@filamo.cz from the e-mail address of your account. We will handle it without undue delay and in any event within 1 month (Article 12(3) GDPR). We will verify your identity so that we do not disclose the data to someone else.
5. Deleting your account
You can delete your account in the Account (Delete account) after signing in again. After your account is deleted:
- we immediately cancel any ongoing Filamo subscription at Stripe and terminate any pending payments,
- we delete the account in Firebase Authentication, the account data, projects, files in storage, stock, workshop, customer directory, quotations, drawings and approval links, your “Invite a friend” link with its counts and the pairing of accounts you invited, daily AI spending and conversion counters, and public verification pages (display of the name and content on them ends); we withdraw your shared models (we delete the snapshots; copies that buyers have already taken remain in their libraries),
- we retain only what we must or may retain, and without any link to your account (instead of the account ID, a pseudonym – a fingerprint from which the ID cannot be derived): - the customer at Stripe and its invoices (tax documents); we remove the account ID from the metadata of the customer, Checkouts, payments and invoices – for subscriptions that have already ended, Stripe does not allow the change, so the ID of an account that no longer exists remains there, - payment records (accounting, see the table), AI costs, use of promo codes and shared models (settlement of credits) and the pairing with the user who invited you (it belongs to their bonus), - the solemn declaration log, including the name of the rights holder you specified (evidence of the licence granted, 4 years), - reports of infringement of rights, the audit of administration actions (2 years) and data necessary for the defence of claims (e.g. pending complaints), - the e-mail fingerprint for “one demo per mailbox” and, for an invitation for which a bonus was granted, the fingerprint of your mailbox (see the table),
- in the browser in which you delete the account, we also delete Filamo’s local data (settings, cache); on other devices you can delete them by signing out or by deleting the website data,
- the data are removed from backups within 90 days at the latest.
6. Security
Application data are stored in the EU (Frankfurt) and the application runs in the EU (Netherlands); the exceptions are sign-in data (Firebase Authentication) and AI processing. Transmission is encrypted (HTTPS). Only the server has access to the data; the browser sees only your data. We do not store IP addresses in the database in readable form (in readable form only in the hosting’s technical logs, for 30 days). We compute fingerprints (HMAC) with secret keys separated by purpose. Code created by AI is run in a separate process. Only authorised persons have access to administration and their actions are recorded.
7. Browser storage (cookies)
We use only strictly necessary browser storage (sign-in, your settings, code from an invitation link) and Google’s reCAPTCHA bot protection, which stores its own cookie on the google.com domain; no analytics or advertising. Details: Information on cookies and browser storage.
8. Children
The service is not intended for persons under 15 years of age (§ 7 of Act No. 110/2019 Coll., on the Processing of Personal Data, sets the age of 15 for consent in relation to information society services).
9. Changes to this policy
We may update this policy. We will inform you of material changes in advance by e-mail or in the application. We will send you previous versions on request.
This is the current version (1.3, effective from 11 October 2026). Each further version will be published here with a new version number and effective date. On request we will send you the version you agreed to – write to support@filamo.cz.