Privacy policy
1. Controller
Andrii Tokar, Am Reinhardshof 55, 97877 Wertheim, Germany. E-mail: support@wish2part.com. No data protection officer is appointed or legally required. This policy follows the EU General Data Protection Regulation (GDPR), which applies wherever you are.
Contact form
If you write to me through the contact form, I store your name (optional), e-mail address, message, the time and the country Cloudflare derives from your IP address, in order to answer you (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for general questions). Storage: Cloudflare D1 (see “Visiting this website”). I delete the message once the matter is settled, at the latest after one year, unless commercial or tax law requires longer storage.
2. Visiting this website
The website is delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (processor under Art. 28 GDPR). When you visit it, Cloudflare processes technically necessary data such as IP address, time, requested address and browser identifier to deliver the pages and protect them against attacks. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). Transfers to the USA rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified. Cloudflare's privacy notice: https://www.cloudflare.com/privacypolicy/.
3. Cookies
The pages at wish2part.com set no cookies and use no analytics or advertising services. Fonts are loaded from this server, not from third parties. Only when you send a file or a description does the page load the application from app.wish2part.com, which sets a session cookie (section 5).
4. STL viewer, file drop and the input field
The STL viewer (/stl-viewer) opens files locally in your browser; they are not uploaded.
A model file you drop or choose for editing stays in your browser until you press the button. Then it is handed directly to the application at app.wish2part.com, together with what you wrote; this website itself does not store it. A description you type for a new part is passed to the application as part of the address and used as the first message to the design assistant. The application opens inside this page.
5. Application (app.wish2part.com)
Connection. The application runs on my own computer in Germany. The connection to it goes through an encrypted Cloudflare tunnel (section 2); Cloudflare processes the same connection data as for the website. To prevent abuse, the application counts requests per IP address; these counters are short-lived and not stored with your account (Art. 6(1)(f) GDPR).
Bot check. Before a guest account is created, the page runs Cloudflare Turnstile to tell people from bots. It processes your IP address, the browser identifier (user agent) and technical connection features (TLS fingerprint), not to identify you. Cloudflare acts as our processor for this check and, according to its Turnstile privacy addendum, as a separate controller when it uses these signals to improve bot detection (legal basis there: its legitimate interest). Our legal basis: Art. 6(1)(f) GDPR (protecting a free service against automated mass use); reading these signals is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). Details: cloudflare.com/turnstile-privacy-policy.
Use without an account. When you start, we create a guest account without name or e-mail address, linked to your browser by a session cookie valid for 90 days, so you find your parts again on a later visit. The cookie is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); processing is needed to perform the contract of use (Art. 6(1)(b) GDPR). We set no advertising or tracking cookies.
Your information about the part. We process what you send us: model files, the description, photos, sketches and your answers to follow-up questions. From this we create the 3D model, the print file (STL/3MF), an estimate of material and weight and a part data sheet, in order to design the part for you (Art. 6(1)(b) GDPR). Please do not send photos showing people, number plates or addresses.
Free allowance. A guest can design one part for free; more needs an account. To enforce this, we record the computing cost of each part together with the IP address it was started from (Art. 6(1)(f) GDPR: preventing the free allowance from being used many times over). Because the limits count per calendar month, we remove the IP address from these records after 31 days; the amounts remain.
AI assistant. The design is made by an AI assistant called Kerf; Kerf is a program, not a person. Your files, description, photos and answers are transmitted to Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA, which operates the language model. Anthropic processes them as our processor under Art. 28 GDPR on the basis of a data processing agreement; the transfer to the USA is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Under its contract terms Anthropic does not use this content to train its models and keeps it only for a limited time, for example to detect abuse.
Sign-in by e-mail. We only need your e-mail address when you want to save the part and download the print file, or when your free guest allowance is used up. You can sign in with a link we send you (valid for 30 minutes, single use) or set a password; we store the password only as a cryptographic hash, and your address counts as confirmed only after you have opened a link from our e-mail; until then the account cannot use the assistant or sign in with the password. If you do not confirm within 7 days, we erase the address and the password hash. Addresses of disposable e-mail services are not accepted. With your account we also store which version of the Terms you accepted and when. E-mails are sent through our mailbox at mailbox.org (Heinlein Hosting GmbH, Berlin, processor). Legal basis: Art. 6(1)(b) GDPR.
Sign-in with Google. Our pages load no Google code. Only if you click “Continue with Google” does a small window (or, if pop-ups are blocked, the page) take you to Google’s sign-in, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; from then on Google also receives your IP address and browser data. After you confirm, Google tells us your e-mail address and name; we receive no password. Google's privacy policy applies to the sign-in there (policies.google.com/privacy). Legal basis: Art. 6(1)(b) GDPR.
Where you came from. If you come from this website, we store with the part which page you came from and in which language, to understand which content is useful (Art. 6(1)(f) GDPR). We do not build personal profiles from it.
Protection against abuse. To stop mass use, the application briefly stores your IP address with a timestamp (for sign-in links together with the e-mail address) in a cache on our own server, not with third parties: at most 10 guest starts per hour per IP address, at most 5 sign-in links per 15 minutes. Entries expire after at most two hours and are removed by the daily clean-up, at the latest after about 26 hours. Legal basis: Art. 6(1)(f) GDPR (protecting the service against abuse).
Storage. Guest accounts without a confirmed e-mail address are deleted 90 days after their last activity, together with their parts, files, chat and everything the assistant stored for them. Accounts with a confirmed e-mail address and their parts are kept until you ask us to delete them; an e-mail to the address above is enough. Invoices and related records are kept as long as German commercial and tax law requires (up to ten years).
6. “Print it — coming soon”
Printing is not offered yet. If you press “Print it” next to a designed part and subscribe, the application stores, with your account (e-mail address), the part and its version, the country and quantity you enter, an optional comment, the date and the page you came from, in order to send you one e-mail when printing becomes available in your country. Legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by e-mail to the address above, with effect for the future; we then delete the request. Storage: the application's server in Germany (section 5).
7. “Tell me when I can start”
If the design assistant is paused, has used up its free designs for the day or cannot be reached, you can leave your e-mail address so that we write to you once when you can start a part. We store the e-mail address, the reason shown (paused, full for today, unreachable), the page, the time, the country Cloudflare derives from your IP address and the version of the text next to the field, as a record of your request. We use them only to send you this one e-mail; it contains no advertising. Legal basis is your request (Art. 6(1)(b) GDPR). Storage: Cloudflare D1 (processor, see section 2); the e-mail is sent through our mailbox at mailbox.org (Heinlein Hosting GmbH, Berlin, processor). We delete your address right after sending, and at the latest after six months if the assistant has not opened again by then. You can cancel the request at any time by e-mail to the address above.
8. No obligation, no automated decisions
You are not obliged to give us any data. Without a description or file, however, the assistant cannot design a part, and without an e-mail address or Google sign-in you cannot create an account. There is no automated decision within the meaning of Art. 22 GDPR; if the assistant declines a design (see Terms), you can always write to me.
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR), and to lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. the one in your country or the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg. An e-mail to the address above is enough.
Right to object (Art. 21 GDPR). Where we process data on the basis of Art. 6(1)(f) GDPR (sections 2 and 5: protection against attacks and abuse, where you came from), you may object to this processing at any time on grounds relating to your particular situation.