Entwurf – vor dem Start prüfen (siehe PLAN.md, Rechtliches); danach LEGAL_REVIEWED=true in .env. Draft – to be reviewed before launch.

Privacy policy

We only process the data the converter technically needs. You do not need an account. There is no advertising, no tracking cookies and no third-party content on the site itself: fonts and scripts (including the 3D preview) are served from our own server.

1. Controller

Luca Wenin Dienstleistungen
Inhaber: Luca Wenin (Einzelunternehmen)
Riemenschneiderstraße 4
92224 Amberg
Deutschland
Phone: +49 1514 6525882
E-Mail: [email protected]
Website: www.wenin.eu

2. Servers and encryption

The website runs on the controller's own servers in Germany; no external hosting provider is involved.

A reverse proxy (Microsoft IIS) accepts the encrypted connections (HTTPS/TLS) and forwards them to the application server.

3. Cloudflare (protection against attacks)

Our server is protected by Cloudflare, operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. All requests to the website pass through Cloudflare's servers. Cloudflare protects the site against overload attacks (DDoS) and automated access (bots) and creates aggregated statistics from the requests for us. In doing so, Cloudflare processes in particular your IP address, date and time, the requested address, technical information about your browser and device, and the transmitted content – including uploaded files, because Cloudflare accepts the encrypted connection and forwards it to us.

If a request looks automated, Cloudflare may show a short check in the browser. For this, Cloudflare sets technically necessary cookies (for example “__cf_bm” for up to 30 minutes and “cf_clearance” after a passed check) and runs a script for bot detection. This is strictly necessary for secure operation; no consent is required (§ 25(2) no. 2 TDDDG).

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare (Art. 28 GDPR). Cloudflare may transfer data to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR); the EU standard contractual clauses apply in addition. More: cloudflare.com/privacypolicy.

4. Server logs

The reverse proxy (IIS) logs every request: IP address, date and time, requested address, response status, amount of data transferred and browser identifier (user agent). This serves operation, troubleshooting and defence against attacks (Art. 6(1)(f) GDPR). Logs are deleted after 7 days. The application server itself does not store access logs.

5. Uploaded files

We process your uploaded file (.litematic, .stl or .obj) only to convert it (Art. 6(1)(b) GDPR). It is stored under a random identifier, not under its file name; the file name is only used to name the finished file. The upload and the result are deleted automatically after 60 minutes. Litematica writes the creator's name into the file; we do not evaluate it.

6. Abuse protection

To prevent overloading the service, we count uploads and conversions per IP address. For this, the IP address is kept in the server's memory for at most 24 hours (Art. 6(1)(f) GDPR).

7. Anonymous usage statistics

To see how many people use the converter, we count page views, uploads and conversions per day. To count different visitors, the IP address is irreversibly encrypted (hashed) with a random key that changes daily and is kept only in memory; key and values are discarded after one day at the latest. Only the daily totals are stored, without any link to individual persons. No cookies are used for this and visitors are not recognised across days or other websites. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

8. Cookies

We only set one technically necessary session cookie (“session”). It protects the site against forged requests (CSRF) and is deleted when you close your browser. In addition, there are Cloudflare's security cookies (section 3). No consent is required for these cookies (§ 25(2) no. 2 TDDDG).

9. Obligation to provide data, no automated decisions

You are not obliged to give us any data. Without the technically necessary processing (such as the IP address), however, the website cannot be displayed. There is no automated decision-making or profiling.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to the e-mail address above.

Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), www.lda.bayern.de.

11. Changes

If we add advertising, accounts or payments, we will update this policy beforehand. Last updated: October 2026.