Last updated: 16 September 2026
The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Furnify3D GmbH
Elisabethstraße 7Full provider identification in the Legal Notice.
Given the size of our organisation, we are not required to appoint a data protection officer under § 38 BDSG. For data-protection enquiries please contact us directly via the email address above.
We process personal data only to the extent necessary to provide a functional website together with our content and services. Such processing is normally based on the user's consent or on a statutory permission (in particular Art. 6(1)(b) and (f) GDPR).
When you visit our website, our hosting provider automatically captures technical data in log files:
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation). Retention: up to 14 days, then anonymised aggregation or deletion.
The website is hosted on servers operated by Vercel Inc. (frontend) and Hetzner Online GmbH (backend, API server, worker, and object storage). Hetzner servers are located in Falkenstein, Germany. Vercel operates a global infrastructure; individual requests may be processed in data centres in the United States or other third countries.
Legal basis: Art. 6(1)(f) GDPR (provision of services). Data processing agreements pursuant to Art. 28 GDPR are in place. Transfers to the United States are based on the EU-US Data Privacy Framework or on Standard Contractual Clauses (Art. 46 GDPR).
We use Supabase (Supabase Inc.) for sign-up and sign-in. The data is processed in a Postgres database hosted in the “Central Europe (Zurich)” region, i.e. in Switzerland. Switzerland is not an EU/EEA country but is covered by an adequacy decision of the European Commission; the transfer is therefore permitted under Art. 45 GDPR without additional safeguards (see also section 18). We collect:
Session tokens are stored in your browser's local storage and are not retained on our servers.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention: for the duration of your usage; after account deletion, identification data are removed without undue delay. A data processing agreement pursuant to Art. 28 GDPR is in place.
To sign up for the free beta we collect the information from the signup form: first and last name, email address, company (optional), language for emails, how regularly you use Enscape, your operating systems and design tools, further tools and additional information (both optional), whether you would like to subscribe to the newsletter, and your consent with its timestamp. We also record the page on which you signed up and the referring page. The form sends this information directly to our database at Supabase (see section 6).
We use this information to decide on your activation, send you the invitation, pre-fill your user profile when your account is created and contact you about the beta (for example about its end). If your first and last name, your answer on Enscape usage and your consent are provided, the invitation is sent automatically. Otherwise we review the signup manually; for this purpose our support mailbox receives your details by email (sent via Resend, see section 15). A signup is never rejected by automated means alone.
We ask whether you would like to receive the newsletter only once, in the signup form; we do not send a separate confirmation email for it. Your choice is carried over to your profile, where you can change it at any time and thereby withdraw your consent. The newsletter is only sent to addresses you have confirmed by activating your account via the link in the invitation email. We do not currently send a newsletter.
Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract and performance of the beta participation); for the newsletter preference Art. 6(1)(a) GDPR (consent, revocable at any time). Retention: if you create an account, for the duration of the user relationship (see section 6). Signups that do not result in an account are deleted no later than twelve months after the end of the beta phase.
Before your 5th, 15th, 30th, 50th and 100th download we ask you to complete a short survey, for example about getting started, model quality, likelihood to recommend, willingness to pay and feature wishes. We store your answers together with your account ID, the survey number, the questionnaire version and the timestamp; to determine when the next survey is due, we count your downloads. You can cancel a survey; the pending download will then not start, and the survey will appear again with your next download.
Using the feedback form in the application you can send us a message at any time, optionally with a rating from 1 to 5 and up to three images. We store your account ID, your email address, the page from which you sent the feedback and the timestamp; images are stored in our object storage at Hetzner (see section 5). Please do not upload images containing personal data of third parties.
We evaluate survey answers and feedback internally only, in order to improve Furnify3D; only authorized staff have access. The rights to your feedback are governed by the Beta Participation Terms (section 7). In addition, we evaluate the technical data of your downloads (for example target format, processing time and errors) to improve processing.
Legal basis: Art. 6(1)(b) GDPR (performance of the beta participation under the Beta Participation Terms) and Art. 6(1)(f) GDPR (legitimate interest in improving our service). Retention: until your account is deleted; you can request deletion of individual answers or feedback messages at any time by email.
Subscriptions are processed through Stripe (Stripe Payments Europe Ltd., governed by Irish law, with offices in the United States and elsewhere). Payment data (card details, SEPA mandate data, etc.) is entered directly with Stripe and is processed exclusively by Stripe — we neither receive nor store this data. Stripe only transmits to us information about successful payments, the associated Stripe customer ID, and the chosen plan.
During checkout we additionally log your consent to performance beginning before the end of the withdrawal period (time, wording and version of the declaration) in order to meet our statutory duties of proof.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Transfers to the United States are based on the EU-US Data Privacy Framework or on Standard Contractual Clauses. A data processing agreement pursuant to Art. 28 GDPR is in place. Stripe's privacy policy: stripe.com/privacy.
Our cancellation page (Cancel contracts here) lets you cancel contracts without logging in. We process the data you provide (email address, optional contract/organization details, type of cancellation, reason where applicable and requested effective date) together with the date and time of receipt. We store the cancellation notice for processing and as legally required proof and send you a confirmation of receipt by email.
Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR in conjunction with § 312k of the German Civil Code (statutory confirmation duty). Retention: for the duration of statutory evidence and limitation periods.
On one of our sub-pages (the catalogue) we embed the pCon catalogue of our partner EasternGraphics GmbH via an iframe. Technically necessary connection data (in particular your IP address, user agent, and cookie data) is transmitted directly to the EasternGraphics servers. We have no influence on the scope of this data collection; details are governed by the EasternGraphics privacy policy: easterngraphics.com/en/data-protection.
The catalogue uses its own cookies and similar technologies in four categories (strictly necessary, diagnostics, statistics, YouTube) and may show its own cookie dialog for this purpose. According to EasternGraphics, the catalogue's audience measurement (Matomo) runs on its own servers in Germany with anonymised IP addresses; YouTube videos are embedded in extended privacy mode and only transmit data to YouTube once played.
Legal basis: Art. 6(1)(b) and (f) GDPR (provision of the catalogue as a core function).
We store the following values locally in your browser. They are used to make the application work and are not used for analytics or advertising. They are not transmitted to our servers automatically; the authentication token is sent along with requests that require you to be signed in.
furnify3d_lang) and whether you dismissed the language suggestion (furnify3d_lang_suggest_dismissed)sb-…-auth-token) — only for signed-in usersfurnify_trial_lead_v1, furnify_trial_lead_email_v1), so the confirmation can display it and a new invitation request can be pre-filledfv_active_org), one-time setup of your organization (fv_org_bootstrapped_…), the last version of the beta notice you have seen (furnify_beta_info_v) and whether you completed or dismissed the profile form (fv_profile_done, fv_profile_prompt_dismissed)pcon_access), the configuration of a model you want to adjust (furnify3d_reconfig_obx) and whether the beta notice has already been shown (furnify_beta_info_shown)furnify3d_new_brands_v2) — for faster displayfurnify3d_fs) — if you choose a destination folder for downloads in a supported browser, the browser stores the access permission you granted so that later downloads are saved there directly. Neither the folder nor its contents are transmitted to our servers.Internal administration pages additionally store display settings such as column widths. You may clear all of this data at any time through your browser settings.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional web application) and § 25(2) no. 2 TDDDG (storage strictly necessary on the end device).
On our landing page and in our web application (signed-in area,
e.g. catalogue, downloads, “My Assets”) we use Matomo Analytics via
Matomo Cloud (InnoCraft Ltd., hosted at
furnify3d.matomo.cloud) to understand how visitors
use the pages (e.g. which sections they view, where they drop off,
whether they sign up for trial notifications). We use cookieless
tracking in a minimal configuration: we do not set analytics
tracking cookies, and without your consent no device information
is read from your device — browser feature detection including
so-called client hints (e.g. browser version list, operating
system version, screen resolution, supported browser features) is
disabled. IP addresses are anonymized in Matomo (server-side
setting, truncation of at least 2 bytes). No marketing profiles
are created. Campaign parameters from ad links (e.g. Google Ads)
are only used to attribute traffic sources. For aggregate funnel
comparisons, Matomo also receives only the fixed anonymous status
granted, denied or
unavailable for the Cookiebot “Statistics” category.
We do not transmit a Cookiebot ID, consent timestamp or complete
consent string to Matomo.
Only if you consent to the “Statistics” category via our cookie banner do we additionally collect the aforementioned device information (browser version, operating system, screen resolution, supported features) for our device and browser statistics — still without tracking cookies. You can withdraw this consent at any time with effect for the future via the cookie settings (link in the footer).
If you are additionally signed in to your Furnify3D account and have consented to the “Statistics” category, we link your page views to a pseudonymous user identifier (“User ID”). The identifier used is exclusively the internal, randomly assigned account ID (UUID) — not your email address or your name. This allows us to attribute usage across multiple visits and devices to the same account in order to improve our offering. Without consent, after its withdrawal or after signing out, no User ID is transmitted; collection then continues without any account reference.
Matomo also offers heatmaps and session recordings (the “HeatmapSessionRecording” feature), which could capture mouse movements, clicks, scrolling behaviour and time on page. We do not currently activate this feature: there is no active recording configuration and no session-recording or heatmap data is collected. Any future activation would require a separate privacy approval and your prior consent to the “Statistics” category. Without that consent, the feature would remain technically disabled.
You may object to this analysis altogether by enabling “Do Not Track” in your browser (with “Do Not Track” enabled, no Matomo collection takes place at all) or via the Matomo opt-out page. Matomo's privacy policy is available at matomo.org/privacy-policy.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring and optimizing our website) for the cookieless minimal collection; for reading device information, for the pseudonymous User ID of signed-in users and, if activated in the future, for heatmaps and session recordings after consent, § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent, revocable at any time). You have the right to object at any time on grounds relating to your particular situation (Art. 21(1) GDPR).
On our landing pages (furnify3d.com/ and
furnify3d.com/enscape/ and their language versions) we use two tools to measure whether our online
advertising works and to target it. Neither of them sets cookies or
comparable identifiers on your device until you have consented to the
“Marketing” category in our cookie banner. Only the following events
are measured: viewing a landing page, interacting with the embedded
product configurator, generating a sample file, and signing up for the
trial or waitlist. We do not transmit your name, email address or any
other account data to Google or Meta.
The provider is Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland (“Google”). We use the Google Ads tag in
Google Consent Mode v2 with all storage purposes
defaulting to “denied”. Without your consent, Google sets no cookies
and reads no identifiers on your device; the tag then only sends
cookieless signals from which Google derives aggregated conversion
estimates. For technical reasons this transmits your IP address, the
page visited and the time to Google. After your consent, Google sets
the cookies _gcl_au, _gcl_ls and
test_cookie (lifetime up to three months) and can thereby
recognise whether you triggered one of the events listed above after
clicking on one of our Google ads. We ourselves only receive aggregated
figures (e.g. number of sign-ups per ad), no information that would
allow us to identify you. Google may link the data to your Google
account if you are signed in. Further information:
policies.google.com/technologies/ads
and policies.google.com/privacy.
The provider is Meta Platforms Ireland Limited, Merrion Road,
Dublin 4, D04 X2K5, Ireland (“Meta”). The Meta Pixel is loaded
only after you have consented to the “Marketing” category; before
that, no connection to Meta servers is established. After consent,
your browser loads the pixel script from
connect.facebook.net, Meta sets the cookie
_fbp (lifetime three months) and the local storage
entries lastExternalReferrer and
lastExternalReferrerTime, and receives the page view, the
events listed above (the trial sign-up as the standard event “Lead”),
your IP address, browser information, the referring page and the
time. Meta uses this data to measure the effectiveness of our ads on
Facebook and Instagram and to show our ads to people who have already
visited our website. If your browser is signed in to Facebook or
Instagram, Meta may attribute the data to your account there. We use
neither “advanced matching” nor the Conversions API; account data such
as your name or email address is not transmitted to Meta.
For the collection and transmission of data via the pixel, we and Meta are joint controllers (Art. 26 GDPR); the corresponding agreement is available at facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing in its own systems; information on this and on your rights vis-à-vis Meta can be found in the Meta Privacy Policy. You can adjust your ad settings with Meta at facebook.com/adpreferences.
Google and Meta transfer data to their parent companies in the United States (Google LLC and Meta Platforms, Inc.). Both are certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition (see section 18).
You can withdraw your consent at any time with effect for the future by deselecting the “Marketing” category in the cookie settings. The Meta Pixel will then no longer be loaded and Google will again operate exclusively in cookieless mode.
Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent, revocable at any time) for setting and reading cookies and identifiers and the processing based on them; for the cookieless signals of the Google tag, Art. 6(1)(f) GDPR (legitimate interest in the aggregated measurement of our advertising). You have the right to object at any time on grounds relating to your particular situation (Art. 21(1) GDPR).
We only set strictly necessary cookies or comparable storage required to operate the website. Matomo on the landing page and in the web application runs without tracking cookies. Marketing cookies from Google Ads and Meta are set only after your consent (see section 13). When you visit Stripe's payment pages, Stripe may set its own cookies; Stripe's privacy policy applies there.
We use the consent management platform Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark) to manage your consent. You can change or withdraw your consent at any time with effect for the future: open cookie settings. The current overview of cookies in use:
Legal basis: § 25(2) no. 2 TDDDG (strict necessity) or § 25(1) TDDDG, Art. 6(1)(a) GDPR (cookies requiring consent).
We use Resend (Plus Five Five, Inc., USA) to send system and transactional emails (e.g. confirmations of receipt and of contract, trial notifications). Your email address and the respective message content are processed. Transfers to the USA are based on the EU-US Data Privacy Framework and standard contractual clauses; a data processing agreement is in place.
Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (reliable delivery of system messages).
We use Sentry (provider: Functional Software, Inc., USA) on our servers to detect and fix technical errors; the error data is processed in the EU region (Germany, ingest.de.sentry.io). When an error occurs, technical diagnostic data is processed (including IP address, time, affected endpoint and technical error details). We also use Grafana Cloud (provider: Grafana Labs, USA) to monitor system health; the data is held in the EU region (London, eu-west-2), and only aggregated technical metrics without personal data are transmitted there. Where the US-based providers can access data for support or maintenance, we base this on the EU-US Data Privacy Framework and standard contractual clauses.
When an error message is displayed to you in the application, your browser additionally sends an error report to our support mailbox automatically – that is, without any action on your part. The report contains the error message shown, the page you were on, the selected language, browser identification (user agent) and window size, the time, and – where available – technical identifiers of the affected processing job (job, object and LOD identifiers). If you are signed in, your user ID and email address are also transmitted so that we can reply to you if needed. The report is sent via our email service provider (see section 15); there are no other recipients. Previously, sending this report required a click on “Report this error to support”.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation). Retention of error diagnostic data: maximum 90 days.
Personal data is only disclosed to the following categories of recipients:
An up-to-date overview of the providers engaged as processors, with purpose, location and transfer mechanism, is available in our subprocessor list. For business customers, the Data Processing Agreement (DPA) applies in addition.
Our database (Supabase, see section 6) is operated in Switzerland (“Central Europe (Zurich)” region). Switzerland is a third country within the meaning of the GDPR for which the European Commission has recognised an adequate level of data protection; the transfer is therefore based on Art. 45 GDPR and does not require standard contractual clauses. Our own servers and object storage (Hetzner) are located in Germany; for providers established in the United States, see the following paragraph.
Where personal data is transferred to providers established in the United States (in particular Stripe and Vercel), such transfers are based on an adequacy decision of the European Commission (EU-US Data Privacy Framework) and/or on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
US providers currently in use are Vercel, Stripe, Supabase (support access), Resend, Sentry and Grafana Labs and — only after your consent — Google (Google Ads) and Meta (Meta Pixel), see section 13; Google LLC and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework. We continuously monitor the legal situation regarding the EU-US Data Privacy Framework and agree standard contractual clauses as an additional safeguard so that transfers remain covered even if the adequacy decision were to lapse.
Personal data is deleted as soon as the purpose of processing ceases, unless statutory retention obligations apply (in particular § 257 HGB and § 147 AO: up to 10 years for accounting-relevant data).
Source data and results of individual processing jobs that arise as intermediate artifacts are removed by regular automated clean-up runs, generally 14 days after the job is completed, unless they are needed for an entry under “My Assets”.
The processed models themselves – the source file of a catalogue download or of a model you uploaded, together with the optimized versions and preview images generated from it – are stored for as long as the Service is operated. This allows you to download a model again later and in other target formats without it having to be reprocessed. Optimized versions that have not been retrieved for a longer period may be deleted and regenerated when needed. You can remove entries under “My Assets” yourself; you can request deletion of your account and your uploaded models at any time by email (see section 20).
Records of consents and cancellations are retained for the duration of statutory evidence and limitation periods.
You have the following rights under the GDPR:
To exercise your rights, please send an informal email to info@furnify3d.com.
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority for us is:
Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI)This section applies to visitors and customers in the United States. Depending on your state of residence (e.g. California, Virginia, Colorado, Connecticut, Texas), you may have the right to know what categories of personal information we collect, to access, correct or delete your personal information, to opt out of the sale or sharing of personal information and of targeted advertising, and not to be discriminated against for exercising these rights.
We collect the categories of personal information described in this policy (identifiers such as name and email address, commercial information such as subscription and payment records, and internet activity such as server log data) for the purposes described here. We do not sell personal information. We do not share personal information for cross-context behavioral advertising unless you opt in to the “Marketing” category in our cookie banner; in that case the Google Ads and Meta Pixel tags described in section 13 may collect identifiers and internet activity in a way that qualifies as “sharing” under California law. You can opt out at any time by deselecting “Marketing” in the cookie settings. Apart from that, we disclose personal information only to the service providers listed in the "Categories of Recipients" section.
We honor the "Do Not Track" browser setting for our web analytics: if Do Not Track is enabled, no Matomo data is collected at all. Signals such as Global Privacy Control are treated the same way where applicable law requires it.
You can exercise your rights — regardless of your state of residence — by emailing info@furnify3d.com. We will verify your request using the email address associated with your account and respond within the timeframe required by applicable law. You may use an authorized agent, provided we can verify the agent's authority and your identity.
Our service is directed at professionals and businesses and not at children. We do not knowingly collect personal information from children under 16 years of age (or under 13 within the meaning of the U.S. COPPA rules). If you believe a child has provided us with personal information, please contact us at info@furnify3d.com and we will delete it.
We reserve the right to amend this Privacy Policy to reflect changes in the legal landscape or in the way we operate our service. The version in force at the time of your subsequent visit will then apply.