Privacy Policy

1. Data Controller and Data Protection Officer

Data Controller under GDPR: Spooly Tobias Terzer Bertha-von-Suttner-Gasse 8/1/57 1220 Vienna, Austria Email: support@spooly.eu Website: https://spooly.eu As we employ fewer than 20 employees who are constantly involved in automated processing of personal data, the appointment of a Data Protection Officer is not required. For any data protection questions, please contact us at the email address above.

2. Overview of Processing

The following information provides a simple overview of what happens to your personal data when you visit our website or use our services.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• Art. 6(1)(a) GDPR: Consent (e.g., newsletter, optional features)
• Art. 6(1)(b) GDPR: Contract performance (providing Spooly service, payment processing)
• Art. 6(1)(c) GDPR: Legal obligation (tax retention requirements)
• Art. 6(1)(f) GDPR: Legitimate interests (security, fraud prevention, analysis for improvement)

4. What Data Do We Collect?

When using Spooly, we collect the following categories of personal data:

5. Data Retention and Deletion

We store your data only as long as necessary for the respective purposes:

• Account data: Until account deletion
• Apple sign-in data: Until account deletion. We then also revoke the connection to your Apple ID with Apple
• Usage data (filaments, prints): Until account deletion
• Invoices and payment records: 7 years from the end of the calendar year (Section 132 Austrian Federal Fiscal Code), also after an account is deleted, then no longer linked to the account
• Server logs: Maximum 30 days
• Bambu Lab token: Until integration deactivation or account deletion
• Prusa Connect Token: Until integration deactivation or account deletion
• Klipper Bridge API Key: Until integration deactivation or account deletion
• Bridge diagnostic data: The latest 50 entries per account, older ones are deleted automatically
• Anycubic and Creality credentials: Until integration deactivation or account deletion
• AI-processed photos, invoices and table excerpts: NOT stored by Spooly. OpenAI may retain data for up to 30 days for abuse monitoring per API terms, then deletes it automatically
• Consent to the AI import (time of consent): Until withdrawal or account deletion
• Push tokens (FCM/Web Push): Until notifications are disabled or account deletion
• Login attempts: Max 15 minutes after last failed attempt (for account lockout)
• Abuse prevention (pseudonymised email hash): 12 months after account deletion, then deleted automatically
• PostHog analytics data (only with "Analytics" consent): events up to 7 years, session replays 30 days
• Setup and purchase usage events (see 8.15): 12 months after they were created, immediately on account deletion
• Your vote, stars and comments on the design (see 8.16): Until your account is deleted
• Times at which emails and notifications about setup and the Pro period were sent (see 8.17): Until your account is deleted
• Newsletter (see 8.18): Unconfirmed subscriptions after 30 days; proof of consent and unsubscription until your account is deleted, at most three years after unsubscribing

After account deletion, all personal data will be completely removed from our systems within 30 days, unless legal retention requirements apply.

Free accounts that have not been used for 12 months (no sign-in, no use of the app, no connection via bridge or plugin) are deleted. Before that, you receive two notices by email, 30 and 7 days before deletion. One click on "Keep account" or signing in is enough to keep the account. Accounts with an active Pro subscription or a Lifetime license are excluded.

6. Recipients and Data Processors

We only share your data with third parties when necessary for contract performance or with your consent. The following service providers process data on our behalf:

Payments with a billing country in the EU are processed by Stripe. For a billing country outside the EU (such as the USA, United Kingdom, Switzerland, Canada or Australia), Polar Software, Inc. is itself the seller (merchant of record) and processes the payment and billing data under its own privacy policy. For this purpose, Spooly transmits your email address, an internal customer ID, the billing country and your IP address to Polar.

7. Third Country Transfers

Some of our service providers are based in the USA. Data transfers are conducted based on EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. These ensure an adequate level of data protection.

You may request a copy of the Standard Contractual Clauses from us.

For the optional Anycubic and Creality printer integrations, data is transferred to servers outside the EU (Anycubic: USA / China, Creality: China). See Section 8.9 for details and the legal basis.

When the Spooly Bridge is installed or updated, GitHub, Inc. (USA) receives the IP address of your printer or internet connection. GitHub is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission adequacy decision under Art. 45 GDPR. See Section 8.8 for details.

8. Bambu Lab Integration (Detailed)

The Bambu Lab integration is an optional feature that you must actively enable. Here we transparently explain which data is processed and how we protect it.

8.1 What Data Is Processed in the Bambu Lab Integration?

8.2 What Is NOT Stored?

Your security matters to us. The following sensitive data is NEVER stored:

• Your Bambu Lab password - it is only sent to Bambu Lab once to generate the token
• Your two-factor authentication codes
• Live print data or camera feeds
• Personal data from your Bambu Lab profile

8.3 How Do We Protect Your Bambu Lab Credentials?

The access token is protected with state-of-the-art encryption:

• Fernet encryption (AES-128 with HMAC authentication)
• The encryption key is secured on the server side and not stored in the database
• Even in the hypothetical case of database access, the tokens would not be readable
• Tokens are automatically deleted when the integration is deactivated

8.4 Communication with Bambu Lab Servers

When you use the integration, Spooly communicates directly with the official Bambu Lab API servers:

• All connections use HTTPS (TLS-encrypted)
• We exclusively use the official Bambu Lab Cloud API
• Your printers are NOT contacted directly (no local network connection)
• After setup, Spooly retrieves completed prints automatically: about every 30 minutes via the cloud API and continuously via an encrypted connection (MQTT) to the Bambu Lab Cloud

8.5 Your Control Options

You have full control over the Bambu Lab integration at all times:

• Activation: The integration must be actively set up by you
• Deactivation: Possible at any time in the settings - all stored tokens are deleted immediately
• Automatic import: After setup, completed prints are imported automatically. You end this by deactivating the integration
• Account deletion: When you delete your Spooly account, all Bambu Lab data is irrevocably removed

8.6 Legal Basis for the Bambu Lab Integration

Your Bambu Lab data is processed exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR. You give this consent by actively setting up the integration in the settings.

You can withdraw this consent at any time by deactivating the integration. The withdrawal does not affect the lawfulness of the processing carried out until then.

8.7 Prusa Connect Integration

The Prusa Connect integration is an optional feature that you must actively enable. It allows importing print jobs from your Prusa printers.

• Authentication: OAuth2 PKCE flow via Prusa Account server (account.prusa3d.com). Your password is NEVER stored by us.
• Access Token: Stored encrypted (AES-128, Fernet), can be deleted at any time by deactivating the integration.
• Print History: Completed print jobs with filename, duration, weight, filament type.
• MMU3 Data: For multi-material prints, slot assignments and color information are processed.
• Printer Information: Name, model, status, firmware version of your registered printers.
• Preview Images: Thumbnails of print files are downloaded from Prusa Connect.

Legal basis: Consent under Art. 6(1)(a) GDPR. You can withdraw consent at any time by deactivating the integration in settings.

8.8 Klipper/Moonraker Bridge Integration

The Spooly Bridge is optional software you can install on your printer (e.g., Snapmaker U1, Voron or other printers running Klipper). It automatically reports completed print jobs to Spooly.

• API Key: A unique access key is generated during setup. We store it encrypted (AES-128, Fernet) so that you can retrieve it again in the settings and insert it directly into the installation command, and additionally as a SHA-256 hash that is used to assign the Bridge to your account.
• Print History: Completed jobs with filename, duration and filament usage are automatically transmitted.
• G-Code Metadata: Material type, color and print parameters from the G-Code are used for automatic filament matching.
• Thumbnails: Preview images of print files are transmitted.
• Operating Data: At regular intervals, the Bridge reports the printer hostname and firmware version, its own version, its installation location and type of autostart, the address and reachability of Moonraker and the state of Klipper. Spooly uses this to show whether the Bridge is running and whether it survives a printer restart.
• Diagnostic Data: For every transmitted print job, we additionally store the complete G-Code metadata as supplied by the printer. It is used to find errors in automatic filament matching and to improve support for further printers. Only the latest 50 entries per account are kept, older ones are deleted automatically.
• Automatic Updates: The Bridge regularly checks whether a new version is available and installs it on its own. As during installation, it downloads the program files from GitHub (GitHub, Inc., USA). For technical reasons, GitHub receives the IP address of your printer or internet connection; no data from your Spooly account is transmitted to GitHub.

The Bridge communicates with Spooly exclusively in encrypted form via HTTPS. Apart from the requests to GitHub, it does not share any data with third parties.

The legal basis for the integration is your consent under Art. 6(1)(a) GDPR, which you give by setting up the Bridge. Diagnostic data and automatic updates are based on our legitimate interest under Art. 6(1)(f) GDPR in operating the Bridge securely and without errors and in improving filament matching. You can object to the storage of diagnostic data at any time, informally by email to support@spooly.eu; we will then no longer store diagnostic data for your account and delete the existing entries.

8.9 Anycubic Cloud and Creality Cloud Integration

Both integrations are optional features that you must actively set up. They do not use an official manufacturer interface: you provide a credential from your own browser (Anycubic: web token, Creality: session cookies) that Spooly uses to retrieve your print history and printer list.

• Credentials: Token or cookie values are stored encrypted (AES-128, Fernet). Your password is neither transmitted nor stored.
• Print History: Completed and cancelled prints with filename, timestamps, duration and filament usage are retrieved every 30 minutes.
• Printer List and Device State: Name, model and, for Anycubic, the slot state of the ACE filament station.
• Preview Images: Thumbnails of print files are downloaded from the manufacturer server and stored in reduced size.

Requests go directly to the respective manufacturer servers (Anycubic: cloud-universe.anycubic.com, Creality: crealitycloud.com). Anycubic states in its privacy policy (as of 31 March 2026) that its servers are located in the USA; the controllers are ANYCUBIC Technology Co., Ltd. in Shenzhen and HONGKONG Anycubic Technology Co., Ltd. Creality operates its cloud in China. Your access token is sent to those servers with every request; your print data flows from there to Spooly, not the other way round. There is no EU Commission adequacy decision for China, and the manufacturers hold no certification under the EU-US Data Privacy Framework for the USA. The transfer of the token is therefore based on your explicit consent under Art. 49(1)(a) GDPR, which you give via a separate confirmation when setting up the integration; the time of consent is stored. You can disconnect the integration at any time in the settings; the credentials are then deleted immediately. Legal basis for processing: Consent under Art. 6(1)(a) GDPR.

8.10 AI-Powered Features (OpenAI, Google Gemini)

Spooly uses AI services for the following features:

• AI Import (OpenAI): During an import, Spooly sends photos of spools and labels, invoices as photo or PDF and, for tables whose layout Spooly does not recognise, the column names and a few sample values to the OpenAI API to identify manufacturer, material, color, weight and price. Invoices often contain your name, address and order details. Spooly explicitly asks for your consent before the first transfer (in the app from version 8.3.1) and stores the time of consent. Without consent, no data is sent to OpenAI; tables and Spoolman data can still be imported without AI. You can withdraw your consent at any time in the settings under "Privacy & legal". Spooly does not store the transmitted photos and files. OpenAI may retain transmitted data for up to 30 days for abuse monitoring per their API terms of service and deletes it automatically afterwards. The data is NOT used to train OpenAI models.
• Automatic Translations (Google Gemini): Blog articles and changelog entries are automatically translated between German and English. Only editorial texts are processed, NO user data.
• Topics for feedback (Google Gemini): When you send a message through the feedback feature, Spooly sends the category (bug, improvement, question) and the text of your message to Google’s Gemini API. Gemini assigns the message to a topic such as "Printer integration" or "Labels & QR", and the topic then appears as a label on the feedback card in Trello. Spooly does not send your name, email address, screenshots or the debug report to Google. Google does not use content from the paid Gemini API to improve its products and stores it for up to 55 days to detect abuse.

Legal basis for the AI import: Consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future. The transfer to the USA is based on EU Standard Contractual Clauses. The translation feature does not process personal data.

Legal basis for the topic assignment: legitimate interest under Art. 6(1)(f) GDPR. I want to handle requests faster and analyse errors by area. You can object to this processing at any time (Art. 21 GDPR), informally by email to support@spooly.eu. The transfer to the USA is based on EU Standard Contractual Clauses.

8.11 Feedback System (Trello)

When you send a message through the in-app feedback feature, it is transmitted to my Trello board (Atlassian). The following data is processed:

• Your feedback text
• Category (bug, improvement, question)
• Your name and email address from your Spooly account, so that I can reply to you
• Optional: screenshots
• A debug report as a file, automatically attached to every feedback: account and settings data (name, email, language, consent status), inventory (spools, storage locations, weight history), prints and projects, status of printer connections and AMS slots, maintenance log, subscription status with recent payments (no card data), as well as device, operating system and app version

Legal basis: Legitimate interest under Art. 6(1)(f) GDPR (handling your request and product improvement). The debug report helps me understand your request and find errors.

To assign a topic, the text of your message and the category are also sent to Google Gemini (see 8.10).

8.12 Hosting Infrastructure

Spooly is hosted on servers of Hetzner Online GmbH in Germany. As a technical service provider, Hetzner processes data arising from hosting (IP addresses, server logs) in accordance with applicable data protection regulations.

Location: Hetzner data center in Germany (EU). Data Processing Agreement (DPA) is in place.

8.13 Analytics (Umami, self-hosted)

To improve Spooly we use the open source analytics software Umami. Umami runs entirely on our own servers in Germany (see 8.12); no data is transferred to third parties.

Umami works without cookies and without cross-device tracking. It only collects anonymized usage data: pages visited, referrer (which site you came from), browser type, device category, country, and anonymous events (for example which onboarding step was completed). IP addresses are not stored; identifying individual persons is not possible.

The legal basis is our legitimate interest in analyzing and improving our service (Art. 6(1)(f) GDPR). Since no cookies are set and no personal data is processed, no consent is required.

In the web app, we record the interaction flow for a portion of sessions (session replay): clicks, scrolling, and page changes. From these recordings we additionally create aggregated click and scroll overviews (heatmaps) that do not allow conclusions about individual persons. All input into form fields (such as email address or password) is technically masked and never transmitted. A recording stops after 5 minutes at the latest, stays on our own servers in Germany, and is automatically deleted after 30 days. No recording takes place in the native apps (iOS/Android). The legal basis is our legitimate interest in identifying and fixing usability friction (Art. 6 (1)(f) GDPR); you may object to this processing at any time (see the section on data subject rights).

If you reach Spooly via one of our campaign links (e.g. spooly.eu/go/…) and register within 24 hours, we store with your account which campaign brought you to Spooly. Only the campaign name is stored — no advertising IDs and no third-party data. We use this to evaluate the effectiveness of our campaigns. The legal basis is our legitimate interest in measuring the success of our marketing (Art. 6(1)(f) GDPR); this information is included in your data export (Art. 15/20 GDPR).

8.14 Product Analytics and Campaign Measurement (PostHog)

To improve Spooly and to measure the effectiveness of my marketing campaigns, I use PostHog, a product analytics platform. Processing takes place on servers within the European Union (Frankfurt); a data processing agreement pursuant to Art. 28 GDPR is in place with the provider. I plan to move to my own servers in the future.

PostHog collects usage data such as pages visited, clicks and interactions, features used, the origin of your visit (referrer and campaign parameters such as UTM), and device and browser information. For logged-in users, these events are linked to your internal user identifier (not to your email address or name) so that usage flows and conversion funnels can be analyzed. In addition, I record your sessions as session replay; all input into form fields (such as email address or password) is technically masked and never transmitted, as is the text rendered on screen.

In addition to the collection in your browser, my server also sends events to PostHog, exclusively about the subscription lifecycle: purchase, renewal, plan change, conversion from trial to a paid plan, and cancellation. What is transmitted is the name of the event, the package concerned, for payments the amount and currency, and your internal user identifier as the linking key. Your name, email address, postal address, and payment details are not transmitted. These events occur in the background during payment processing, that is, without any browser involved: renewals and cancellations would otherwise be entirely invisible in the analysis. The purpose is to evaluate which campaigns and which steps in the product actually lead to a subscription.

For the collection in your browser, PostHog uses cookies or comparable storage technologies. Both the collection in your browser and the server-side subscription events take place solely on the basis of your consent (Art. 6(1)(a) GDPR), which you provide via my cookie banner in the "Analytics" category. So that my server knows whether consent exists, I record your decision together with the time you made it on your account; this also serves as the record of consent under Art. 7(1) GDPR. Without your consent, PostHog is not even loaded in your browser, and my server transmits nothing either.

You can withdraw your consent at any time with effect for the future by clearing the website data for spooly.eu in your browser; the cookie banner will then appear again and you can decline the "Analytics" category. If you do not make a new choice in that case, server-side subscription events may still be transmitted on the basis of your earlier consent. You can also send the withdrawal informally to the address given in the legal notice, in which case I will reset the flag on your account.

PostHog does not run in the native apps (iOS/Android): nothing is collected there, and there is no cookie banner either. The server-side subscription events depend solely on the consent you gave in the web app, and are then transmitted regardless of which device you use to take out your subscription. If you never consented in the web app, no subscription events are sent to PostHog either.

8.15 Analysis of the Setup on My Own Servers

So that I can see where new users get stuck when setting up Spooly, my server logs individual steps of the setup and of the first use: the registration and its method (email, Google, Apple), the steps of the setup wizard (shown, skipped, finished), attempts to connect a printer, with the manufacturer and the type of error (for example "wrong credentials" or "manufacturer's server unreachable"), the creation of the first spool with the method used (catalog, manual, photo, AMS, import), and the days on which you used Spooly. The purchase flow is logged as well: which purchase prompt was shown to you or tapped by you, the opening of the purchase window, the start, cancellation or failure of a purchase (with a short error type, without error text) and the chosen package. Whether a purchase went through, I take from my payment data, not from this log. The same log contains events about the use of individual features, such as streaks, challenges and exports.

What is stored is your internal user identifier, the name of the event, the time, the platform (web, iOS or Android), the app version and the characteristics listed above. Credentials, the contents of input fields, your email address and your IP address are not stored. The data is kept exclusively in my own database (see 8.12) and is not passed on to third parties. No cookies are set for this and no additional information is read from your device; the events arise from requests that the app sends to my server anyway in order to work, the purchase flow events from a small separate request of the app.

I evaluate the events in aggregated form, for example as the share of a week's new registrations that connected a printer. I only look at individual histories if you contact me with a request or if an error cannot be traced in any other way.

The legal basis is my legitimate interest in making the setup of Spooly easy to understand, in finding and fixing errors when connecting printers, and in seeing which prompts lead to a purchase and where a purchase fails (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR), informally by email to support@spooly.eu; your account will then be excluded from the logging.

The events are deleted automatically 12 months after they were created, and immediately when you delete your account. If you voluntarily give a reason when deleting your account, I store only this reason with rough details (month of deletion, platform, whether a subscription existed, length of use in rough ranges) without any reference to you.

8.16 Vote on the Design

At spooly.eu/mitgestalten you can use your Spooly account to vote on what Spooly will look like in the future. For this, I store your choice together with your user account, along with the time of your vote and of your last change. For taking part, you receive the "Co-Designer" badge.

You can also voluntarily rate each design with 1 to 5 stars and write what you like and what bothers you. I store these ratings and comments with your user account as well. As long as you are not logged in, they stay only in your browser's session storage and are transferred only after you log in.

The purpose is to determine the result, to count each person only once and to improve the new design based on your feedback. Other users only see aggregated numbers such as shares and the average star rating, never who voted or rated how. Only I read your comments, they are never published. The legal basis is the provision of a feature you use voluntarily (Art. 6(1)(b) GDPR). Your vote, ratings and comments are deleted together with your account.

8.17 Emails and Notifications During Setup and the Pro Period

Around setup and your Pro period, Spooly sends a few messages that are tied to your account. Each of them is sent at most once per account:

First automatic deduction: When Spooly deducts a print from one of your spools for the first time, you receive a notification on your device, provided you have allowed notifications for automatic imports.

Printer not yet connected: If you chose a manufacturer during setup but did not connect a printer, Spooly reminds you with a notification one day after registration (only if you have allowed notifications, between 9 am and 8 pm your local time) and with an email three days after registration at 10 am your local time. As soon as a printer is connected, none of these reminders are sent.

End of the Pro period: Two days before your Pro period ends, you receive an email and a notification at 10 am your local time. The email shows what Spooly booked for you during this time (booked prints, deducted filament, spools in stock), and what changes after the end. It only contains a link to the Pro prices if you have subscribed to the newsletter (see 8.18). If you have already bought Pro, you do not receive this message. After the end, Spooly shows the same overview once in the app.

For this, I process your email address, your language and time zone, the figures from your account mentioned above and, for notifications, your push token (see section 4). I store when each message was sent so that none arrives twice. I send the emails via Resend (see section 6) and the notifications via Firebase Cloud Messaging or Web Push.

The legal basis for the notice before the end of the Pro period is the performance of your user agreement (Art. 6(1)(b) GDPR): you learn in good time what changes. For the confirmation of the first deduction and the printer reminder, the legal basis is my legitimate interest in making it easier for you to get started with Spooly (Art. 6(1)(f) GDPR). For the link to the Pro prices, it is your consent to the newsletter (see 8.18).

You can unsubscribe from these emails at any time free of charge: via the unsubscribe link in each of these emails, and for the reminder before the end of the Pro period also in the settings under "Notifications". You can turn off notifications in the settings of Spooly or of your device. I only send the newsletter with news and offers with your consent (see 8.18).

8.18 Newsletter

If you want, I send you a newsletter: once a month a recap of what is new in Spooly, plus discount codes, offers and contributions from partners in the benefits portal (see 10.5). In between only when there is something big or when I ask you for something, for example a vote. If you have subscribed to the newsletter, the email before the end of the Pro period also contains a link to the Pro prices (see 8.17).

You can subscribe at the end of setup, in the settings under "Notifications" or via a one-time hint in the app. None of these is preselected, and the newsletter is not a condition for Spooly, Pro, discount codes or raffles. After subscribing, you receive an email with a confirmation link that is valid for 7 days (double opt-in). The subscription only takes effect with this confirmation. If you do not confirm, the subscription expires after 30 days.

As proof of your consent, I store when and where you subscribed and confirmed, in which language, which version of the consent text you saw and when you unsubscribed. Of the confirmation link I only store a hash value.

To make the newsletter better, I see whether you open an issue (via a small image in the email) and which links you click (via redirects through spooly.eu). This only applies to the newsletter itself, not to the confirmation email and not to other emails from Spooly. Partners do not receive any personal data, at most aggregated figures such as the number of clicks on their offer or how the people who clicked are distributed across languages, Pro and printer brands, and such distributions only from 10 people. If Resend reports that an address cannot be reached or that a newsletter was marked as spam, I unsubscribe this address from the newsletter.

I send the emails via Resend (see section 6). The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021), and for the proof of consent my legal obligation (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every newsletter or in the settings under "Notifications". The lawfulness of the processing until withdrawal remains unaffected.

9. Meta Pixel (Facebook Pixel)

We use the Meta Pixel (formerly Facebook Pixel) by Meta Platforms Ireland Limited to measure the effectiveness of our advertisements on Meta platforms (Facebook, Instagram) and to optimize our target audiences.

9.1 What Data Does the Meta Pixel Process?

The Meta Pixel tracks the following events and data:

• Page views (PageView)
• Completed registrations (CompleteRegistration)
• Started trial periods (StartTrial)
• Initiated checkouts (InitiateCheckout)
• Completed purchases including amount and currency (Purchase)
• Adding filament (Lead)

Technical data such as IP address, browser type, operating system, and referrer URL may be transmitted to Meta. Meta may associate this data with your Meta account if you are logged in.

9.2 Legal Basis for Meta Pixel

The use of the Meta Pixel is based on your consent pursuant to Art. 6(1)(a) GDPR, which you can provide via our cookie banner.

9.3 Disabling Meta Pixel

You can prevent tracking by the Meta Pixel as follows:

• Adjust cookie settings in our cookie banner
• Facebook ad preferences: https://www.facebook.com/adpreferences/ad_settings
• Browser add-on for deactivation: https://www.facebook.com/help/568137493302217

10. Affiliate and Advertising Partner Programs

In some places, Spooly shows reorder links to partner shops that are clearly labeled as "Ad". If you make a purchase through such a link, I receive a small commission from the respective partner. There are NO additional costs for you.

As an Amazon Associate I earn from qualifying purchases.

10.1 Current Partner Programs

I currently participate in the following partner programs:

Additional advertising partners may be added in the future (e.g. retailers via the AWIN advertising network). This overview will be updated accordingly.

10.2 What Data Is Processed for Reorder Links?

When you click a reorder link, you are redirected directly to the respective partner shop. Only there may the partner set cookies, which is solely the responsibility of that partner. Spooly does not embed any partner content, widgets, or tracking pixels.

NO personal data is transmitted to the partners.

To evaluate which reorder links are used, I keep a fully anonymous click statistic. Only the following is stored:

• Filament type (e.g. PLA, PETG)
• Filament manufacturer
• Partner (e.g. Amazon, Sunlu, or Prusa)
• Location in the app (e.g. filament detail page or statistics)
• Link type (search link or direct product link)
• Time of the click

Neither a user ID nor an IP address is stored. The statistic cannot be linked to any person and cannot be re-identified afterwards.

10.3 Legal Basis for Reorder Links

The anonymous click statistic does not contain any personal data. To the extent that any processing takes place when you click, it is based on my legitimate interest pursuant to Art. 6(1)(f) GDPR (financing the service).

Pro users can disable the affiliate hints in the settings. The links remain functional, but the visual hints are hidden.

10.4 Transparency

All reorder links are visibly labeled as "Ad". I only recommend products and shops that I consider reputable. The commission does NOT influence the recommendations in the app.

10.5 Benefits Portal and Partner Wishes

In the benefits portal you get discount codes from partners and can suggest shops or vote for suggestions. For this, I store, each linked to your user account:

• which codes you retrieved and when
• when you opened an offer and clicked the shop link
• the country the request came from (determined from the IP address, see 10.6)
• your shop suggestions and votes

Purpose: showing your retrieved codes again ("My codes"), detecting misuse such as passing codes on (Terms § 6b), evaluating which offers are used, and deciding which shops I approach as partners. Partners only receive aggregated figures (e.g. how often a code was retrieved), no personal data. If you buy from a partner via a code or link, the partner's privacy policy applies there; for offers labeled as "Ad", the partner network (see 10.1) sets its own cookies only after the click.

The legal basis is the provision of the feature (Art. 6(1)(b) GDPR) and my legitimate interest in preventing misuse and evaluating the portal (Art. 6(1)(f) GDPR). The data is deleted together with your account. A shop suggestion then remains for the other votes without any link to you.

10.6 Determining Your Country

For country-specific prices and payment methods and in the benefits portal (partners' shipping countries), I determine the country from which you access Spooly. For this, your IP address is transmitted to the service country.is (api.country.is), which returns only the country. The operator states that it does not log requests; it does not name a server location, so processing outside the EU cannot be ruled out. Spooly does not store the IP address in this process, only the country. The legal basis is my legitimate interest in correct prices and offers for your country (Art. 6(1)(f) GDPR).

11. Cookies and Storage Technologies

Spooly uses technically necessary cookies and, with your consent, analytics cookies (PostHog) and marketing cookies (Meta Pixel):

12. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request confirmation of whether we process your data and information about that data.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your data ("right to be forgotten").
• Right to restriction (Art. 18 GDPR): You may request restriction of processing under certain circumstances.
• Right to data portability (Art. 20 GDPR): You may receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to the processing of your data.
• Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any given consent at any time.

13. Right to Lodge a Complaint

If you believe that the processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Competent supervisory authority in Austria: Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna Phone: +43 1 52 152-0 Email: dsb@dsb.gv.at Website: www.dsb.gv.at

14. Automated Decision-Making

We do NOT use automated decision-making or profiling within the meaning of Art. 22 GDPR that would have legal or similarly significant effects on you.

15. Data Security

We implement extensive technical and organizational measures to protect your data:

• SSL/TLS encryption for all data transfers
• RSA encryption (2048-bit) for sensitive login data during transmission
• Encrypted password storage (bcrypt with 12 rounds)
• Encrypted storage of third-party tokens (AES-128, Fernet)
• Temporary key pairs for credential transmission (hourly rotation)
• Regular security updates
• Access restrictions based on the principle of least privilege
• Database hosting in EU data centers

15.1 End-to-End Encryption at Login

During registration and login, your credentials (email, password) are encrypted on the client side with RSA-2048 before they are transmitted to our server. This ensures that your passwords cannot be intercepted even if the network is compromised.

The encryption keys are automatically renewed every hour to ensure maximum security.

16. Account Deletion

You can delete your account and all associated data at any time:

• Via account settings in the app
• By email to support@spooly.eu

After deletion, all your personal data will be irreversibly removed. Recovery is not possible.

To prevent abuse of our free trial period (legitimate interest pursuant to Art. 6(1)(f) GDPR), we retain a cryptographically pseudonymised hash value (SHA-256 with server-side salt) of your email address after account deletion. The hash does not allow any inference about your email address. It is used solely to prevent repeated use of the trial period with the same email address. The hash is retained for 12 months after account deletion, then deleted automatically.

17. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legal requirements or service changes. The current version is always available on our website.

For significant changes, we will notify you by email.

18. Contact

For questions about data protection or to exercise your rights, contact us at: Email: support@spooly.eu We will respond to your request as soon as possible, at the latest within one month.