This privacy policy covers the website www.autolay.com, including the planner and all other pages.

It explains in plain words which personal data we process, why, on what legal basis and for how long. Personal data is any information that relates to you as a person.

Who is responsible

Autolay is run by Dr. Florenz Graf. He is the controller responsible for processing your data on this website (“we”):

Dr. Florenz Graf Oelschlaegerstraße 26 70619 Stuttgart Germany

The fastest way to reach us is our contact form or an email to info@autolay.com.

We are not required to appoint a data protection officer. Dr. Florenz Graf answers all privacy questions himself.

Where your data is stored

Our data is stored within the EU.

There are two exceptions. Both involve Google, and both happen only when you trigger them: Google Analytics runs only after you turn statistics on (“Accept all” in the cookie banner or the statistics switch in “Cookie settings”), and Google sign-in starts only when you click “Continue with Google”.

In both cases Google Ireland Limited is involved, and data may be transferred to Google LLC in the United States. Google LLC is certified under the Data Privacy Framework between the European Union and the United States. The European Commission has decided that this framework ensures an adequate level of protection (Article 45 General Data Protection Regulation).

Who receives your data

We share your data only with these service providers, and only as far as each purpose requires:

Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany – runs our servers. The servers are located in Germany.
IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany – sends and receives our email: messages from the contact form, emails about your account, and the newsletter.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – only for Google Analytics (after your consent) and Google sign-in (if you choose it).

We find out which country you visit from with the DB-IP country database. The lookup runs on our own server; your IP address is not passed on for it.

We do not sell data. Authorities receive data only when a law obliges us to provide it.

What we process, why, and for how long

For each purpose we list the data, the legal basis and how long we keep it. Articles cited are those of the General Data Protection Regulation of the European Union unless another law is named.

Visiting the website (server logs)

Each time a page is loaded, our server automatically writes an entry to a log. We need it to run the website securely, find errors and fend off attacks.

Data: IP address, date and time, the address requested, the page you came from, browser and operating system, status code and amount of data transferred.
Legal basis: Article 6(1)(f). Our legitimate interest is a secure and stable website.
How long we keep it: 14 days, then the logs are deleted automatically.

Visitor statistics from the server logs

On our own server we compile statistics from the server logs, for example how often a page is visited. No cookies are set for this and no data is passed to anyone else.

Data: The information from the server logs, with the IP address shortened.
Legal basis: Article 6(1)(f). Our legitimate interest is knowing which pages are used.
How long we keep it: The statistics contain only totals and shortened addresses. We keep them as long as we need them to compare over time.

Google Analytics (only with your consent)

If you turn statistics on (“Accept all” in the cookie banner or the statistics switch in “Cookie settings”), we use Google Analytics to understand how visitors use the website. Google Analytics sets cookies for this and recognizes your device on later visits. Without your consent, Google Analytics is not loaded. You can withdraw your consent at any time: click “Cookie settings” at the bottom of any page.

Data: Pages viewed, time on page, where the visit came from, approximate location (country and region), device type, browser, operating system, screen size, language, a random identifier stored in a cookie, and actions such as creating a layout plan. For technical reasons Google receives your IP address.
Legal basis: Article 6(1)(a) (consent), and for the cookies § 25 (1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (the German law on data protection in telecommunications and digital services).
How long we keep it: Google keeps the data for 14 months and then deletes it automatically.

Strictly necessary storage in your browser

We store a few items in your browser because the website does not work without them: your choice in the cookie banner, your sign-in token, your guest identity, your chosen units, and a snapshot of your session so your plan is not lost when you reload the page.

Data: The items listed. They stay on your device and go to our own server only when a function needs them.
Legal basis: § 25 (2) number 2 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, because the storage is strictly necessary for the service you asked for; for any further processing, Article 6(1)(b) and (f).
How long we keep it: Until you delete them in your browser. The sign-in token is removed when you sign out.

Your account

To open an account we need a few details. Without them we cannot create an account.

Data: User name, email address, password (stored only as a value that cannot be turned back into the password), whether you plan privately or professionally, your role (for example homeowner or contractor), language, units and currency, optional profile details such as name, phone and address, your two-step sign-in settings, your choices on the newsletter, on notification emails and on the use of your uploads for training our recognition models, when you registered and accepted our terms, whether you have confirmed your email address, and, if you sign in with Google, your Google identifier.
Legal basis: Article 6(1)(b) (the contract for using your account).
How long we keep it: Until you delete your account. You can do that yourself at any time on your account page.

Signing in with Google

Instead of a password you can sign in with your Google account. A connection to Google is made only when you click “Continue with Google”. Google then confirms to us who you are.

Data: From Google we receive your email address, your name and a Google identifier. Google learns that you are signing in to our website.
Legal basis: Article 6(1)(b).
How long we keep it: Until you delete your account.

Devices you sign in with

Whenever you open the website while signed in, we update a short record of the device you use. It helps us protect your account and make the planner display correctly on common devices.

Data: Country, device type, browser and operating system with their version numbers, browser language, how often you have visited and when you last visited. Time zone and screen size only if you agreed in the cookie banner. We never store your IP address for this.
Legal basis: Article 6(1)(f) (protecting your account); for time zone and screen size, Article 6(1)(a) (consent).
How long we keep it: Until you delete your account.

Plans and uploads with an account

When you are signed in, we store your plans and uploaded files (for example floor plans, photos, building models or laser scans) so you can keep working on them.

Data: Your plans, room dimensions, material details and uploaded files.
Legal basis: Article 6(1)(b).
How long we keep it: Until you delete the plan or your account.

Plans of guests without an account

You can also use the planner without an account. Your plan is then linked to a random guest identity stored in your browser.

Data: Your plan, your uploaded files and the guest identity.
Legal basis: Article 6(1)(f). Our legitimate interest is offering the planner without sign-up and keeping your plan for you.
How long we keep it: We delete the plan and the files 24 months after your last visit.

Improving our recognition

We place a copy of uploaded files on our development computer in Germany. We use it to train our recognition models (for example recognizing walls in a floor plan) and to improve our products.

Data: Copies of your uploaded files.
Legal basis: Article 6(1)(f). Our legitimate interest is better recognition. You can object at any time by email to info@autolay.com, without giving reasons. Objections you have already made remain in effect.
How long we keep it: The copy is deleted when you delete your account, when your guest plan expires, or when you object. One exception: if you are signed in and upload a file you never save, we remove the original after 24 hours but keep the copy for 24 months to improve our products, then delete it. If you object, we delete this copy at once as well.

Contact form, email and content reports

When you write to us through the contact form or by email, or report content, we process your message to answer it and to check the report.

Data: Name, email address and your message; for reports, also the link to the reported content and the reason you give.
Legal basis: Article 6(1)(b) when your message concerns a contract or a request for one; otherwise Article 6(1)(f) (answering your message and checking reports).
How long we keep it: 24 months after you sent the message or report.

Backups

Every night we make an encrypted backup of our database so nothing is lost if a server fails.

Data: All data listed above that is stored on our server.
Legal basis: Article 6(1)(f). Our legitimate interest is protection against data loss.
How long we keep it: 14 days. Whatever you delete therefore disappears from the backups as well, 14 days later at the latest.

Security

All pages are transmitted encrypted. We store passwords only as a value that cannot be turned back into the password. Backups are encrypted.

Your rights

Under the General Data Protection Regulation you have these rights at any time. Just write to us through the contact form or to info@autolay.com:

Access to the data we process about you (Article 15)
Correction of wrong data (Article 16)
Deletion of your data (Article 17)
Restriction of processing (Article 18)
Data portability: your data in a common, machine-readable format (Article 20)
Withdrawal of consent, effective for the future (Article 7(3))

Your right to object (Article 21 General Data Protection Regulation)

Where we process data on the basis of our legitimate interest (Article 6(1)(f)), you may object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You can object to the use of your uploads for training our recognition models without giving any reason.

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Heilbronner Straße 35 70191 Stuttgart Germany

We do not make automated decisions, including profiling, within the meaning of Article 22.

You are not obliged to give us any data. Without the details an account needs (user name, email address, password), however, we cannot open an account for you. You can use the website and the planner without an account.

Changes to this privacy policy

When our website or the law changes, we update this privacy policy. The date at the top shows the current version.