Privacy Policy

The controller — the party that decides why and how your data is processed, within the meaning of Article 4(7) GDPR — is:

Registered name

to be completed

Enterprise number

to be completed

Registered office

to be completed

Data protection contact

hello@occlusia.app

No Data Protection Officer has been appointed. Article 37 GDPR requires one only for public authorities, for large-scale systematic monitoring of individuals, or for large-scale processing of special categories of data. Occlusia does none of these, so the contact address above handles data protection requests directly.

This policy covers the occlusia.app website and the Occlusia account it gives access to. The Occlusia application and the Occlusia Link plugins for SketchUp and Blender are governed by their own documentation and terms.

Only what the service needs in order to work. This is the complete list of what the site holds about you today:

• Account details — your email address, your display name, your plan and subscription status, the date the account was created, the date you last signed in, and the version and timestamp of the terms you accepted when you registered. Your password is not among them: what is stored is an Argon2id hash, a one-way transformation from which the original password cannot be recovered.
• Sessions and devices — for each active sign-in: the IP address it came from, the browser's user agent string, a device label, whether it is a web or an application session, and when it was created and last used. You can read this list yourself under Account → Sessions and revoke any entry on it.
• Security check — while the sign-in or sign-up page is open, a Cloudflare Turnstile check runs in an embedded frame served by Occlusia's account API. To tell a person from an automated program, Cloudflare reads technical signals from your browser and your IP address. Occlusia receives only a single-use token, valid for five minutes, which it sends back to Cloudflare, together with your IP address, to be confirmed. Occlusia keeps nothing from the check, which sets no cookie on this site.
• Device storage — six strictly necessary cookies and one session-storage entry, each one named, explained, and timed in the Cookie Policy.
• Correspondence — if you write to us, your message and our reply, so the conversation keeps its context.

There is nothing else. No analytics, no advertising identifiers, no tracking pixels, no profiling, no behavioural scoring beyond the security check's person-or-program verdict, and no automated decision-making that produces legal effects for you.

Every operation below needs a lawful basis under Article 6 GDPR. None of them relies on your consent, because none of them needs to: consent is the right basis for optional processing, and there is no optional processing here.

Retention is bounded, and most of these limits are enforced by the software rather than left to good intentions:

• Your account and its details are kept for as long as the account is open.
• When you delete your account it is deactivated immediately and every session is revoked at once. The data is then permanently erased 30 days later — a window that exists so an accidental deletion can still be reversed by contacting us. Your email address stays reserved during those 30 days and cannot be used to open a new account.
• A session expires 60 days after it was last used, and cannot live longer than 365 days under any circumstances. Signing out, revoking a session, or changing your password removes the affected sessions immediately.
• The sign-in cookie lasts 60 days and is replaced with a fresh value every time it is used. The entitlement cookie lasts 24 hours.
• Support correspondence is kept for 24 months after the exchange is closed.
• Invoices and accounting records are kept for 7 years, because Belgian law requires it.

Your data is never sold, rented, or shared for anyone else's marketing. It is handled by Occlusia and by the service providers needed to run it — hosting, payment, transactional email — each bound by a processing agreement under Article 28 GDPR that forbids them from using your data for their own purposes. One exception, stated plainly: Cloudflare, which runs the security check on the sign-in and sign-up pages, processes its signals on our behalf to run the check, and also, as an independent controller, to improve its detection of automated programs, as its Turnstile Privacy Addendum states.

to be completed The final list of providers, with each one's role and hosting region, is being settled and will be published here before paid plans open.

Where a provider processes data outside the European Economic Area, that transfer rests on an adequacy decision of the European Commission or on the Standard Contractual Clauses, together with whatever supplementary measures the case requires.

Data is disclosed to public authorities only where a valid and binding legal request obliges us to, and never beyond what that request covers.

Security here is a property of the implementation rather than an aspiration:

• Passwords are hashed with Argon2id and never stored or transmitted in readable form. Nobody at Occlusia can read your password, and a database leak would not reveal it.
• Session credentials are held in httpOnly cookies, marked Secure and SameSite=Lax. JavaScript cannot read them, so no script — ours or anyone else's — can lift a usable token out of your browser.
• Your browser never sends a credential to the account API: account requests pass through this site's own server, which holds the credentials on your behalf. The only page your browser loads from that API is the security check, which carries no account data.
• The sign-in credential is replaced every time it is used, so a copy captured earlier stops working.
• Changing your password revokes every other session. Deleting your account revokes all of them.
• Sign-in and registration are rate-limited per email address and per IP address, and protected by a security check.
• All traffic between your browser and Occlusia runs over HTTPS.

The GDPR gives you the following rights over your data. Exercising them is free, and doing so never degrades the service:

• Access — obtain confirmation of what is processed about you, and a copy of it (Art. 15).
• Rectification — have inaccurate details corrected and incomplete ones completed (Art. 16).
• Erasure — have your data deleted, except records the law requires us to keep (Art. 17).
• Restriction — have processing paused while a dispute over accuracy or legitimacy is resolved (Art. 18).
• Portability — receive the data you provided in a structured, machine-readable format, or have it transmitted to another controller (Art. 20).
• Objection — object, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21).

Three of these need no request at all. Your name and email address are editable under Account → Settings; your sessions can be listed and revoked under Account → Sessions; and your account can be deleted under Account → Settings once you confirm your password.

For anything else a plain email is enough — no form, no particular wording required: hello@occlusia.app

We reply within one month, as Article 12(3) GDPR requires. If a request is genuinely complex we may extend that by a further two months, and will tell you within the first month that we are doing so and why.

If you believe your data has been mishandled we would rather hear it first — but you are entitled to go straight to the supervisory authority, and complaining costs nothing. For Occlusia that authority is:

You may also complain to the supervisory authority of the EU country where you live, where you work, or where the alleged infringement took place.

This website neither receives nor stores your 3D models or your drawings. It presents the product, hosts the documentation, and manages your account — nothing more. How the Occlusia application and the Occlusia Link plugins handle your files is described in their own documentation and terms.

There is none. No decision producing legal effects for you, or similarly significantly affecting you, is taken by automated means within the meaning of Article 22 GDPR. Your plan determines which features you can use; nothing profiles you.

Occlusia is a professional drawing tool and is not directed at children. Accounts are not knowingly created for anyone under 16. If you believe a child has registered, write to the contact address above and the account will be removed.

When this policy changes, the revised version is published here with a new date at the top of the page. If a change materially affects how your data is handled, account holders are told by email before it takes effect. Previous versions are available on request.