Legal
Privacy policy
Elementarium handles structural models — the kind that are commercially sensitive long before they are personal data. This is what we collect, what we do not, and what you can demand of us.
Last updated 14 October 2026
Who is responsible
The controller of your personal data is Elementarium — the trading name of Jan Vorisek, registered entrepreneur (OSVČ) in the Czech Republic, IČO: 08090441, registered seat Hudečkova 1094/7, 140 00 Prague, Czech Republic. In this notice "we" and "us" mean that controller. Full registration details are on the imprint page.
We have not appointed a data protection officer, as none of the criteria in Art. 37 GDPR apply to what we do. Privacy requests and questions about this notice go to [email protected], which is monitored on working days.
What this covers
This notice covers the Elementarium marketing site and the Elementarium application — modeling, solving, design checks, reporting, sync and collaboration. It does not cover sites we link to, which have their own policies.
What we collect and why
We collect what the product needs to function, and the law obliges us to keep for billing. There is no advertising network here, no data broker, and nothing is sold.
| Category | What | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Account | Email address, display name, password hash — or, if you sign in with Google, the account id and email Google returns — language and interface preferences. | To create your account, sign you in and keep it secure. | Contract | While the account exists, then 30 days. |
| Project data | Models, geometry, sections, materials, loads, results, file names and the edit history the document is built from. | To store, sync, back up and — if you share a project — show it to your collaborators. | Contract | Until you delete it; purged from backups within 30 days. |
| Billing | Name, billing address, VAT ID if you give one, plan, invoices, and the card’s last four digits and expiry. Stripe holds the card number — we never receive it. | To take payment, issue invoices and satisfy Czech accounting and tax law. | Contract and legal obligation | Invoices for as long as tax law requires, currently up to 10 years. |
| Support | Emails and bug reports you send, including any model you attach to them. | To answer you and to fix the defect you found. | Legitimate interests — running a supportable product | 3 years from the last message. |
| Technical logs | IP address, browser and OS version, timestamps, error traces. Errors in the app are reported to Sentry with your numeric account id only. | To keep the service available and secure and to diagnose faults. | Legitimate interests — security and reliability | 90 days. |
| Site analytics | Pages viewed on elementarium.app and in the app, referrer, approximate region, device type. | To see which pages are worth writing and where people get stuck. | Consent | 14 months. |
Where we rely on legitimate interests, we have weighed them against your rights and concluded they do not override them. You can object — see your rights — and we will stop unless there is a compelling reason not to.
Your models
Your models are yours. Three commitments follow from that, and they are the ones we would want in writing if the positions were reversed:
- Solving does not upload anything. The finite element core runs in your browser, on your own CPU. A model is not sent to a compute server to be solved — there is no compute server. Project data leaves your machine only to sync, back up and share, and only when you are signed in.
- We do not train anything on your work. Your geometry, loads and results are not used to build models, statistics or datasets, ours or anyone else's.
- We do not read them. Nobody opens your projects unless you ask for help with a specific one, or unless we are legally compelled to — and in the support case only for as long as it takes to answer you.
If you never sign in, nothing about your model reaches us at all.
Cookies and analytics
Essential cookies keep you signed in and remember your theme and your cookie choice. Google Analytics runs only if you accept it — decline and the script is never loaded, so no _ga cookie is set. The full list, and a button to change your mind, is on the cookie notice.
Who else processes it
These are our processors. They act on our instructions under a data processing agreement, and each one is here because the product needs it.
| Processor | What they do | Where |
|---|---|---|
| DigitalOcean, LLC | Application hosting, project storage, backups | European Union |
| Stripe Payments Europe, Ltd. | Subscription payments, invoicing, fraud prevention | Ireland (EU), with onward transfers under Stripe’s own safeguards |
| Plus Five Five, Inc. | Account email — sign-in links, receipts, service notices | European Union |
| Google Ireland Limited | Google Analytics on this site and in the app — only after you consent | Ireland (EU), with transfers to the USA under Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error reports from the app — the error, the browser and your numeric account id; no email, IP address or model content | Germany (EU data region); a US company, with transfers under Standard Contractual Clauses |
Beyond that, we disclose data only where the law requires it, or where it is necessary to establish or defend a legal claim. If the business is ever transferred, you will be told before your data moves, in time to delete your account first.
Where it is stored
Accounts, projects and backups are hosted in the European Union. The one routine exception is Google Analytics, which may transfer data to the United States under Standard Contractual Clauses — and which only runs at all if you consented. Decline analytics and your data stays in the EU.
How long we keep it
Per-category periods are in the table above. Two general rules: deleting a project removes it from live systems immediately and from backups within 30 days; closing your account deletes everything except invoices, which tax law obliges us to keep.
How it is protected
- Everything travels over TLS; stored project data and backups are encrypted at rest.
- Passwords are stored as salted hashes and cannot be recovered, only reset.
- Access to production data is limited to the operator named above, is used only for support and maintenance, and is not granted to anyone else.
- Backups run continuously and are held in the EU alongside the primary data.
No system is perfect. If a breach ever puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly.
Your rights
Under the GDPR you may ask us to:
- Access — confirm what we hold and get a copy of it.
- Correct — fix anything inaccurate or incomplete.
- Erase — delete it, where we have no obligation to keep it.
- Restrict — pause processing while a dispute is resolved.
- Port — receive your data in a machine-readable format. Projects can be exported from the app at any time, without asking us.
- Object — to anything based on legitimate interests, on grounds relating to your situation.
- Withdraw consent — for analytics, at any time, with no effect on what happened before you withdrew it.
Write to [email protected] and you will get an answer within one month. Exercising these rights is free unless a request is manifestly excessive.
You can also complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz. We would rather you came to us first, but it is your right either way.
Age
Elementarium is a professional engineering tool and is not directed at children. Accounts are for people aged 16 or over. If we learn that an account belongs to someone younger, we will delete it.
Changes to this notice
The product is in public beta and will change; this notice will change with it. The date at the top always reflects the current version, and material changes — a new processor, a new purpose — will be announced by email to account holders before they take effect.
Contact
Privacy questions, access requests and complaints all go to [email protected], or by post to Elementarium — Jan Vorisek, Hudečkova 1094/7, 140 00 Prague, Czech Republic.
Something here unclear, or wrong? Tell us — we read every message, and a document that confuses its reader is a defect like any other.
[email protected]