Privacy Policy

1. Data Controller Identification

For the purposes of the EU General Data Protection Regulation (GDPR) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information, the data controller - the party that decides why and how personal data is processed - is:

Morcano, an independent studio operated by an individual creator (sole proprietor) based in Hungary (European Union).
Contact Email: hello@morcano.app

2. Categories of Processed Data and Ephemeral Architecture

The Operator strictly adheres to the principle of data minimization, collecting only the information required to authenticate licenses and execute the generative parameters of the Platform.

• Account Information: The Operator processes email addresses, password hashes (passwords are hashed with scrypt and never stored in plain text), and user identification strings required to provision and secure the account.
• Google Sign-In Data: If the User chooses "Continue with Google", Google returns the User's email address and a Google account identifier so the Operator can authenticate the User and locate or create their account. The Operator does not receive the User's Google password. This is governed additionally by Google's own Privacy Policy.
• Payment Metadata: Paid plans are sold through Lemon Squeezy (Sold through Link, LLC), which acts as the reseller and merchant of record: it takes the payment, collects the billing details it needs (such as name, email, country and payment method), calculates and remits sales tax and VAT, and issues receipts. Lemon Squeezy processes that data as an independent controller under its own privacy policy. The Operator never receives or stores card details; it receives only a Lemon Squeezy customer and order identifier and the plan bought, its status and its end date, in order to grant or revoke access.
• Technical Data: To keep the service secure and available, the User's IP address is processed transiently for rate-limiting and abuse prevention (it is not stored long-term against the account). Where enabled, an error-monitoring service (Sentry) may record diagnostic details of a crash. Aggregated, privacy-preserving usage analytics (Vercel) run on the marketing site.
• Parametric Inputs and Generated Files: When the User uses the Morcano Studio engine, they input sizing selections (e.g. ring size) and design parameters. The exported 3D files (.stl/.3mf) are generated on demand and, together with any reference files the User uploads (e.g. SVG or STL), are stored only temporarily on the server and are automatically deleted a few hours after they are produced.
• Early-Access Sign-ups: If a person joins the waitlist on morcano.app, the Operator stores their email address and the confirmation record of their sign-up. The address is used only to send news about the studio opening and can be removed at any time via the unsubscribe link or by writing to hello@morcano.app. Sign-up is confirmed by a double opt-in email. The referring page (for example, Pinterest) is measured only in aggregate through privacy-preserving site analytics and is not linked to your email address.
• Saved Designs: If the User chooses to save a design to their account ("My designs"), the Operator stores that design's parameters, a small preview thumbnail, and any note, client or order label, and status the User adds to it, linked to the account, until the User deletes the design or their account. Saved designs are visible only to the User.

3. Lawful Bases for Processing (GDPR Article 6)

The Operator processes personal data relying upon the following established lawful bases under Article 6 of the GDPR:

• Contractual Necessity: The processing of Account Information and Parametric Inputs is strictly necessary for the performance of the Terms and Conditions (generating the 3D models and managing subscription access).
• Legitimate Interest: The processing of Technical Telemetry and transactional metadata is executed under the legitimate business interests of the Operator. This includes monitoring infrastructure stability, executing anti-piracy audits, and ensuring strict compliance with the commercial licensing restrictions.
• Explicit Consent: Where mandated by jurisdictional law, the Operator relies upon the User explicit, informed consent for the deployment of non-essential cookies and the processing of data for marketing communications.

4. Three-Category Cookie Consent Framework

The Platform employs a consent management interface to allow users to set preferences regarding cookies and local storage mechanisms.

• Strictly Necessary: Essential for authenticating sessions, enforcing security protocols, and recording the User consent state. These cookies are locked ON and cannot be disabled.
• Functional: Remembers user interface configurations, preferred sizing standards (metric/imperial), and 3D viewport settings. Not intended to load unless the user accepts them.
• Analytics and Performance: Aggregates anonymized telemetry to assess server load balancing, rendering performance, and overall platform optimization. Not intended to load unless the user accepts them.

5. Sub-processors and Infrastructure

The Operator engages a small number of specialized third-party providers to operate the service. Each is bound by a Data Processing Agreement and processes data only as needed to provide its function:

• Hetzner Online GmbH — hosting of the Morcano Studio application and its database (user accounts, saved designs, plan status), on a server in Nuremberg, Germany (EU).
• Cloudflare — DNS, encrypted (TLS) connection handling and protection against abuse for studio.morcano.app, and storage of encrypted database backups (Cloudflare R2).
• Vercel — hosting of the marketing website (morcano.app) and privacy-preserving site analytics.
• Lemon Squeezy (Sold through Link, LLC) — reseller and merchant of record for paid plans (see Payment Metadata above); it processes payment and billing data as an independent controller.
• Google — "Sign in with Google" authentication.
• Zoho Campaigns (Zoho Corporation B.V., Netherlands, EU) — storage of early-access sign-ups and delivery of confirmation and launch emails, processed in Zoho's EU data centre.
• Zoho Mail — delivery of transactional email (such as password-reset links) and handling of support correspondence sent to hello@morcano.app.
• Sentry — error monitoring, where enabled, to diagnose crashes.

6. Data Retention

The Operator keeps personal data only as long as needed for the purpose it was collected:

• Exported and uploaded files (generated 3D files, uploaded reference SVG/STL, temporary session files): automatically deleted a few hours after they are produced.
• Saved designs (parameters + preview thumbnail): kept until the User deletes the design or their account.
• Account data (email, password hash, plan status): kept for the life of the account; erased when the User deletes their account (available self-service in account settings).
• Backups: the database is backed up daily; backups are kept for up to 30 days and then deleted, so data erased from the live service disappears from backups within that period.
• Purchase records: kept by Lemon Squeezy, as merchant of record, for the period required by tax and accounting law.
• Waitlist / marketing contacts: kept until the person unsubscribes or requests removal.
• Security and diagnostic data (transient IP for rate-limiting, error reports): kept only briefly for security and stability.

7. Your Rights Under the GDPR

The Operator extends the following data protection rights to all Users, wherever they are located:

• Access and Portability: The right to request confirmation of processing and obtain a portable, machine-readable copy of personal data.
• Rectification: The right to demand the immediate correction of inaccurate or outdated personal data.
• Deletion: The right to request the erasure of personal data, subject to legal and anti-piracy retention obligations.
• Opt-Out (Sales/Targeting): The absolute right to opt out of the processing of data for targeted advertising, profiling, or data sales.
• Non-Discrimination: The guarantee that exercising privacy rights will not result in service degradation or punitive pricing.

Users may exercise any of these rights by submitting a formal request to hello@morcano.app. The Operator will verify the request and respond within one month; where a request is complex, this may be extended by up to two further months, and the User will be told why.

Users also have the right to lodge a complaint with a data protection supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu; Users in another EU country may contact the authority where they live.

8. International Data Transfers

Morcano is operated from Hungary (European Union), and the Studio application and its database are hosted within the EU (Nuremberg, Germany). Account and design data therefore remain primarily within the EU. Some providers (for example Lemon Squeezy, Cloudflare, Google, and Vercel) may process limited data outside the European Economic Area. Where that occurs, such transfers are protected by legally recognized mechanisms, including the European Commission's Standard Contractual Clauses (SCCs), together with encryption in transit and at rest.