Legal

Privacy Policy

Last updated: 30 August 2026

This Privacy Policy explains how Filamantra s.r.o. (“we”, “us”, “our”) processes personal data when you use SUBMERG3D, including this website, your account, downloads, Build Assistant, and paid Builder’s Membership checkout.

We process personal data in line with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on the processing of personal data.

1. Who is the controller

The data controller is:

Filamantra s.r.o.
Jaurisova 515/4, 140 00 Praha 4 – Michle, Czech Republic
Company ID (IČO): 11674831
VAT ID (DIČ): CZ11674831
Registered at the Municipal Court in Prague, file C 352712

SUBMERG3D and Anty Beobachtung are projects operated by Filamantra s.r.o.

For privacy requests, email andrej@filamantra.cz or write to the address above.

2. What we collect

We collect only what we need to run the site and deliver the service.

Account

When you register, we store your name, email address, and a hashed password. We also store your account status (for example whether the email is confirmed) and whether you have a Builder’s Membership.

We send a confirmation email with a one-time token so you can activate the account. If you request a password reset, we store a time-limited reset token and send the reset link to your email.

Session

We keep a session so you stay signed in and the site can remember whether you are logged in. The session cookie is described below.

Billing and payments

If you buy a Builder’s Membership, we collect invoice details: billing name, optional company name and company ID, VAT number, address, country, and invoice email. We also store a Stripe customer identifier so we can create invoices and complete checkout.

Card numbers and other payment-instrument data are collected and processed by Stripe. We do not store your full card details on our servers.

Downloads

When you download a protected file while logged in, we record which file was downloaded, your user ID, the access type (free or membership), your IP address, and your browser user agent. We use this to enforce access rules, prevent abuse, and support the service.

Build Assistant

If you use the Build Assistant, we may store your build progress (completed steps) against your account so you can continue where you left off.

Security checks

On registration and password-reset forms we may use Google reCAPTCHA. Google then receives the captcha response and technical data such as your IP address to tell us whether the request looks like a bot.

Technical data from using the site

Like most websites, our servers may process technical data needed to deliver pages: IP address, date and time, requested URL, and browser type. We do not run advertising or analytics cookies on this site.

What we do not collect

We do not sell personal data. We do not run marketing newsletters from this site unless we clearly ask you first. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

3. Why we use it and on what legal basis

GDPR requires a legal basis for each purpose. We rely on the following.

Purpose Data Legal basis
Create and run your account, sign-in, email confirmation, password reset Name, email, password hash, tokens, session Art. 6(1)(b) GDPR — contract (providing the service you request)
Give access to free and paid files, Partbase, and Build Assistant Account, membership, download and progress records Art. 6(1)(b) GDPR — contract
Process Builder’s Membership purchase and invoicing Billing profile, Stripe customer and payment events Art. 6(1)(b) GDPR — contract; Art. 6(1)(c) — legal obligation (tax and accounting)
Keep the site secure, stop abuse, and enforce download access IP address, user agent, download logs Art. 6(1)(f) GDPR — legitimate interest in a secure, working service
Load Google reCAPTCHA on registration and password reset Captcha token, IP address, Google cookies Art. 6(1)(f) GDPR — legitimate interest in a secure, working service
Load Bootstrap, fonts, icons, and the 3D model viewer so the site can render IP address processed by jsDelivr, Google, cdnjs, and esm.sh Art. 6(1)(f) GDPR — legitimate interest in delivering the site
Answer privacy or support requests Whatever you send us Art. 6(1)(f) GDPR — legitimate interest; Art. 6(1)(c) where we must respond to a rights request

You may object to processing based on legitimate interest. See Your rights. Some processing (for example invoicing records) cannot be stopped while we still have a legal duty to keep them.

4. Cookies and similar technologies

A cookie window on this site explains what we use. After you tap OK, we store a first-party cookie named submerg3d_consent for 180 days so we do not show the notice again. You can open the details later via Cookies in the footer.

We use a session cookie that is necessary for the site to work. It stores a session identifier so we can keep you logged in and remember your visit. This cookie is a first-party cookie set by us. It is required to operate the service and is not used for advertising. If you tick Stay logged in on the login form, the cookie lasts 30 days. Otherwise it lasts until you close the browser or sign out.

With the page we also load Bootstrap from jsDelivr, Google Fonts, Font Awesome from cdnjs, and the 3D viewer libraries from esm.sh, so the site can render. Those providers may process your IP address.

If Google reCAPTCHA is shown on a form, Google may set its own cookies in that context. See Google’s Privacy Policy and cookie information.

We do not place marketing or tracking pixels on this site. You can delete or block cookies in your browser. If you block the session cookie, login and some features will not work.

5. Who we share data with

We share personal data only with processors and partners who need it to run the service, or where the law requires it.

  • Stripe — payment processing and invoicing for Builder’s Membership. See Stripe’s Privacy Policy.
  • Google — reCAPTCHA (when enabled) and Google Fonts. See Google’s Privacy Policy.
  • Email delivery — our mail server sends confirmation and password-reset messages to the address you give us.
  • Hosting and content-delivery networks — to serve the website, files, fonts, and libraries.

We may also disclose data if required by Czech or EU law, or to protect our legal rights.

Related software such as Dolphin Cloud at cloud.submerg3d.eu is operated by us. If you create an account there, that service processes data for that product under this controller. This policy describes SUBMERG3D as provided on this website.

6. Transfers outside the EEA

Some providers (in particular Stripe and Google) may process data in the United States or other countries outside the European Economic Area. Where that happens, we rely on appropriate safeguards under GDPR Chapter V, typically the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework for certified organisations.

7. How long we keep data

  • Account data — for as long as the account exists. If you ask us to delete the account, we remove or anonymise personal data that we no longer need.
  • Email confirmation and password-reset tokens — until they are used or they expire.
  • Session data — until you sign out, close the browser (unless you chose Stay logged in), or the 30-day login cookie expires.
  • Billing and payment records — for as long as Czech tax and accounting rules require (typically up to 10 years for invoicing records).
  • Download logs — while needed for security, support, and access control, and then deleted or anonymised.
  • Build progress — while your account exists, unless you ask us to delete it.

Where we must keep records by law, we restrict them to that purpose after the original service relationship ends.

8. Your rights

If you are in the EU/EEA (or otherwise covered by GDPR), you may:

  • access your personal data (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have data erased in the cases set out in Art. 17;
  • restrict processing (Art. 18);
  • receive data you provided to us in a structured, commonly used format and transmit it to another controller (Art. 20);
  • object to processing based on legitimate interests (Art. 21);
  • withdraw consent, where we rely on consent, without affecting processing already carried out.

To use these rights, email andrej@filamantra.cz. We may need to verify that the request comes from you. We will respond within one month, or tell you if we need more time as allowed by GDPR.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů):

Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
uoou.gov.cz

You may also complain to the authority in your EU/EEA country of residence, workplace, or place of the alleged infringement.

9. Security

We hash passwords, restrict admin access, and use encrypted connections (HTTPS) in production. No method of transmission or storage is completely secure. Please choose a strong password and keep it private.

10. Children

SUBMERG3D is aimed at adults. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, contact us and we will delete it.

11. Changes

We may update this policy when the service or the law changes. The “Last updated” date at the top will change. The current version is always available at this page.

12. Contact

Filamantra s.r.o.
Jaurisova 515/4, 140 00 Praha 4 – Michle, Czech Republic
Email: andrej@filamantra.cz
Phone: +420 776 646 884