Privacy policy

Andreas Ebner — DeFactory, Hansjakobweg 13, 76275 Ettlingen, Germany Email: contact@nextstitch.app · Phone: +49 7243 7403920

We have not appointed a data protection officer; we are not required to.

Designing and previewing stitches runs in your browser. The stitch engine is downloaded once and computes previews on your device; your artwork is not sent to us for that.

Some functions do need our servers: importing and converting files, lettering, cloud projects and machine-file export. Those are described individually below.

We deliberately load no third-party content in your browser: no external fonts, no advertising, no social media plugins, no error-tracking service, no embedded video or maps. The website comes straight from our server; Cloudflare only resolves the name nextstitch.app for us and forwards email sent to our addresses (see "Recipients").

This website sets one cookie, and only when you sign in: the sign-in cookie nextstitch_refresh, which keeps you signed in. It expires 30 days after it was last used and at the latest 90 days after you signed in, and it is deleted when you sign out. It is marked HttpOnly, so no script on the page can read it, and your browser sends it only to our sign-in service under /api/auth. Besides it, for the functions you request, NextStitch stores data in your browser — in its local storage and, for fonts, in its IndexedDB database:

• your language and theme choice;

• a marker that you are signed in (it holds no token) and, during registration, a short-lived value for the sign-up flow;

• your licence key, if you use one;

• your local projects — the design documents themselves, plus the project index and the design you last had open;

• embroidery fonts you add yourself — the letters read from the font's zip, its name and the spacing you set for it;

• editor preferences and your recently used colours;

• an opt-out flag for usage statistics, but only if you have opted out.

All of these are required to provide functions you have expressly requested, so under § 25 para. 2 no. 2 TDDDG they do not require consent; no consent banner is shown. None of them is used to track you across websites.

You can delete this data at any time via your browser settings. Note that this also deletes your local projects and the fonts you added — see the terms of service, § 8.

You can try the editor without an account. Saving designs, downloading files, cloud projects, subscriptions and licensed functions need one.

We process your name, email address, password (stored only as a hash), language setting and account status (plan, subscription status) in order to establish and administer the account and to authenticate you. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Authentication runs on a separate service of ours, which this website reaches under /id. It sends you the email about your account: address verification, password reset and a notice when your password changes, a welcome after your first sign-in and — when you change your sign-in address — a confirmation to the new address and a notice to the previous one, in which the new address appears only shortened. The address changes only once the link is confirmed; sessions opened under the previous address then end. We keep a record of active sessions (a hashed refresh token per session family) so that you can be signed in on several devices and so that sessions can be revoked.

Email our service sends on its own account (the welcome, for instance) waits in a queue until it is sent: the recipient's address, the language and the details the email contains. Sent entries are deleted after 30 days; entries that could not be delivered, 30 days after the last attempt. Legal basis: Art. 6(1)(b) GDPR.

You also receive email about your plan: the confirmation of a plan, of its change, cancellation, continuation or end, as well as invitations to a team and the end of team access. Receipts and invoices are sent by Link to the address Link holds for you; when you change your sign-in address, we pass the new one on to Stripe.

If you save a project to the cloud, we store on our server the design document (the complete design data as you created it), its name, the folder structure you have set up, its size and version, and the link to your account. Legal basis: Art. 6(1)(b) GDPR — this is the requested service.

Projects you keep locally are not transmitted to us. Copying to the cloud is always an explicit action on your part.

When you delete a cloud project, it first goes to your trash, where you can restore it for 30 days; after that it is deleted for good. You can delete it for good earlier, or empty the trash, at any time. Deleting your account removes your projects at once, including those in the trash.

If you add machines under Account → My machines, we store for each one the name you give it, its make and model, the hoops you own, the file formats it reads and the default values you set, linked to your account. If you keep thread collections under Account → My threads, we store each collection's name and the threads in it (thread line, colour code, name and colour value). We use them to offer your machine's hoops, formats and settings in the editor and your threads as a palette. Legal basis: Art. 6(1)(b) GDPR — this is the requested service. You can change or delete them at any time; they are included in your data export.

When you import a file (SVG or DXF artwork, an embroidery machine file such as PES or DST, or an embroidery font sold as a zip of letter files), upload a colour palette or generate a machine file, that file and the resulting stitch data are transmitted to our server, processed there and returned to you. Legal basis: Art. 6(1)(b) GDPR.

Bitmap images (PNG, JPEG) are traced into shapes on your device and are not transmitted.

Files that are only read or converted — machine files, font zips, palettes — are processed transiently and not stored permanently as a separate copy. A font you add is kept in your browser, not on our server. Only projects that you save as cloud projects, and the machines and thread collections you keep in your account, are stored persistently.

For imported vector artwork, NextStitch can suggest which region should become which stitch type. This function is switched off by default and only runs if you enable it for a given import, and only if we have configured it on the server side. It is available to signed-in accounts with the Pro trial or a paid plan.

To keep the function within its limits, we count per account and calendar day how often you used it, together with an estimate of its cost. These counters contain no artwork; they are deleted after 30 days, and with your account.

If you use it, a geometric summary of the recognised regions (dimensions in millimetres, shape properties and, where a region is ambiguous, its outline) is transmitted to the AI provider OpenRouter. The file itself, its name, your name and your account are not transmitted. Responses are cached on our server keyed by a hash of the request so that the same artwork does not need to be sent twice.

OpenRouter is based outside the EU. The transfer is therefore a transfer to a third country within the meaning of Art. 44 et seq. GDPR. Legal basis: Art. 6(1)(b) GDPR for the function you requested.

If reach measurement is enabled for this installation, we use Plausible Analytics — you can tell it is active because an opt-out switch appears at the end of this page. We run Plausible ourselves, on our own server: no analytics provider is involved, and the data are not transferred to a third country.

Plausible works without cookies and stores no data on your device. Recorded are: page visited, referrer, approximate origin at country level, browser and device type, how long and how far down a page was read, and a small number of events — for example that a design was exported or imported, that a form was sent (not its content), that a file was downloaded, or that a link to another website was followed, with that link's address. We deliberately transmit no file, design or project names and no free text. Query parameters are removed from every address transmitted; only campaign parameters in the addresses of our own pages are kept.

Your IP address is used solely to derive the country and a daily, non-reversible visitor hash, and is not stored. The measurement script is delivered from our own domain, and the measurements are sent through it.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is understanding which functions are used and improving NextStitch. You can object at any time — with the switch at the end of this page. The desktop application transmits no usage statistics at all.

When our servers are accessed, connection data are recorded for technical operation and security (IP address, time, requested resource, status, referrer, browser identifier). Legal basis: Art. 6(1)(f) GDPR — secure and stable operation. These data are deleted after a short period or are anonymised. Your browser connects straight to our server. Cloudflare only runs our name resolution (DNS) — the answer to which address our server is at; the connection itself and its content do not pass through Cloudflare.

Paid plans are sold by Link (Link, LLC, a company of the Stripe group) as reseller in its own name (merchant of record). For the purchase, the payment, the invoice and the VAT, Link is an independent controller; its privacy policy applies.

When you choose a plan, we redirect you to Stripe's payment page and pass on your email address, your language and an internal identifier of your account, so Stripe can match the purchase to it. From Stripe we receive the customer and subscription identifiers, the plan and billing period, the subscription's status (active, payment due, cancelled …) and the end of the current period — not your payment details. Legal basis: Art. 6(1)(b) GDPR. Link and Stripe also process data in the USA; Stripe bases such transfers on the EU–US Data Privacy Framework and the EU standard contractual clauses.

The payment page and the billing portal are Stripe's pages, reached by redirect. No Stripe script is loaded on NextStitch's pages; the statement on cookies and consent is unchanged.

We keep what Stripe sends us for as long as your account exists, and Stripe's event records (to avoid processing one twice) for 90 days.

When you invite team members, we process their email address to send the invitation and manage the seat (Art. 6(1)(b) GDPR towards you, (f) towards the invited person). Owners of a team see the names and email addresses of their team members; team members see the name and email address of the person whose team they belong to. An invitation that is not accepted expires after seven days and is deleted within the hour after; the invitation email waits in the queue until it is sent (see "User account").

The contact form lets you send us a question, a feature request or a bug report. We process the kind of message, your email address, your name (optional), the text of your message, the language you use the site in, and a screenshot if you attach one. If you are signed in, we add your account's address and your plan so that we can match the message to it.

The sole purpose is to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns your account or a contract with us, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries.

The message is sent through our mail provider as an email to our support address, which Cloudflare forwards to our inbox, with your address as the reply address. We do not send a confirmation to your address. Until it is sent, the message waits in a queue on our server. The screenshot is deleted once the email has been sent, at the latest after 30 days; the other details 30 days after sending. In the support inbox we keep the message for as long as we need it for your matter and delete it afterwards, unless a statutory retention obligation applies. To protect the form against mass abuse, we count in memory how many messages came from an IP address in the last hour and from an email address in the last 24 hours. Once that period has passed, the count is deleted; it is never written to a file or database.

We use the following processors under Art. 28 GDPR, each under a data processing agreement:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — operation of our servers in a data centre in Nuremberg;

• Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France — sending our email;

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — name resolution (DNS) for our domain, and forwarding email sent to our addresses; Cloudflare also processes data in the USA, based on the EU–US Data Privacy Framework and the EU standard contractual clauses;

• our email provider, where the messages forwarded to us are kept.

Link receives the details named under "Subscriptions and payment" as an independent controller. The AI provider named above receives data only in the case described there. We do not sell data and do not pass it on for advertising purposes.

Account data are retained for as long as your account exists. Cloud projects, machines and thread collections are retained until you delete them or your account; a deleted cloud project stays in the trash for a further 30 days unless you delete it for good sooner. Log data are retained briefly, as described above. Beyond that we retain data only where statutory retention obligations require it — in particular obligations under commercial and tax law, which will become relevant once paid contracts exist.

You have the right to obtain access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw consent at any time with effect for the future.

You can view and change your data in the account area, and under Data & privacy you can download a copy of it as a JSON file (your profile, plan, sessions and the details of your cloud files). The designs themselves are not in that file — you can download each one individually under My files. You can also delete your account there yourself; for security reasons deletion requires your password and your own email address. When you do, we delete or anonymise the associated data, subject to statutory retention obligations.

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). This applies in particular to the usage statistics and the log data described above. For the usage statistics you can exercise the objection directly using the switch at the end of this page.

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. The AI-assisted import described above makes suggestions for your design; it does not make decisions about you.

Traffic is transport-encrypted. Passwords are stored only as hashes. Access to production systems is restricted to the controller.

We update this policy when the processing described here changes — for example when payment processing starts or a new processor is added. The date of the current version is shown at the top of this page.