Privacy Policy

1. Controller and contact

The data controller is SALA Labs, operated by Francesco Sala, registered at Temporary pre-launch information — registered address to be confirmed, VAT/tax number Pending — to be replaced before accepting paid subscriptions. Privacy contact:francescosala2002@gmail.com. The address and tax details are temporary pre-launch information and will be replaced when the final registration data is available.

2. Data we process

• Account data: email, account identifiers, verification state, plan, Terms and Privacy versions and timestamps when accounts are enabled.
• Service data: material settings, operational status and pseudonymous request identifiers. The current MVP processes selected DXF files in the browser and does not upload them.
• Contact data: name, company, work email, optional phone number and message when you contact us.
• Analytics data: page and product events only after consent; no email, DXF content, DXF filename or direct user identifier is intentionally sent.
• Subscription data: provider customer/subscription identifiers and status when payments are enabled; no card number or CVV is stored by SOFTNEST.

3. Purposes and legal bases

We process data to provide and secure the service and take requested pre-contractual steps; to meet legal obligations; and, where required, on the basis of consent for analytics and separate marketing communications. Consent can be withdrawn at any time.

4. DXF files and confidentiality

The current browser-based MVP does not transmit selected DXF files to SOFTNEST servers. A future server-processing feature is designed to use random, non-public object identifiers, private Cloudflare R2 storage and automatic deletion after a configurable period (default 24 hours), unless the user explicitly selects a future “Save project” option.

DXF contents and filenames are excluded from application logs and analytics events.

5. Providers

• Cloudflare: hosting, delivery, security, optional rate limiting, and—once provisioned—D1 database, R2 object storage and Turnstile.
• Google: Google Tag Manager and Google Analytics only according to your optional cookie choices.
• Authentication provider: [AUTHENTICATION PROVIDER — NOT YET SELECTED].
• Payment provider: Stripe is planned but not currently enabled.
• Email delivery: Cloudflare email infrastructure is used for current contact/subscription requests.

6. Retention

Temporary DXF retention is planned at 24 hours after server processing is enabled. Account deletion uses a planned 30-day grace period. Technical logs are targeted for 30 days. Contact records, subscriptions and invoices are retained only as required for the relationship and applicable legal obligations. Actual provider-side retention must be confirmed before launch.

7. Cookies and analytics

Necessary browser storage remembers your consent choice. Optional Analytics and Marketing categories are denied by default. Google code is not loaded until a relevant category is accepted. Details are in the Cookie Policy; preferences can be changed from the footer.

8. International transfers and security

Some providers may process data outside your country. The controller must verify the applicable transfer mechanism and provider agreements. Technical measures include HTTPS, restrictive security headers, origin checks, size and input validation, rate-limiting hooks and separation of secrets from source code. No system is completely risk-free.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent. You may also complain to your competent supervisory authority. Use francescosala2002@gmail.com; authenticated account export and deletion workflows are planned but are not yet active.

10. Changes

Material changes will be reflected by a new version and date. Where required, account holders will be asked to accept updated Terms or acknowledge an updated notice.