Replanar Privacy Policy

As of: November 3, 2026.

1. Controller and contact

The controller for Replanar is Softmax AI GmbH, Kantstr. 6, 84032 Altdorf, Germany, represented by Dr. Denise Vandeweijer and Christoph Gerlinger.

Privacy requests: info@softmax-ai.com, phone +49 (0)69-34868224.

This policy covers the Replanar website and the web app that uses automation to convert technical drawings into editable CAD files. Replanar is offered exclusively to businesses and self-employed professionals. Because we are established in Germany, the EU General Data Protection Regulation (GDPR) applies to our processing, including for users outside the European Union; Section 11 contains additional information for them.

2. Website, hosting and necessary storage

To deliver and secure our service, we process IP addresses, access times, requested addresses, status messages and technical browser and device details. Short-lived IP-based counters limit abusive sign-in and contact requests; we delete them after two hours at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a working and secure service.

We run the website, app, database, file storage and backups at Hetzner Online GmbH, Germany. Uploaded drawings and results are stored in Hetzner object storage in Nuremberg. Hetzner processes this data on our behalf.

We serve fonts ourselves. We do not embed external analytics, advertising or font services and do not set tracking cookies.

For anonymous audience measurement we use the self-hosted open-source software Umami at analytics.softmax-ai.com. It records the pages visited, referring page, browser, operating system, device type, screen size, language and the country derived from the IP address. Umami sets no cookies, stores no IP addresses and forms only a visitor identifier that changes daily and cannot be traced back; visitors are not recognized across days or websites. We do not use this data for profiling and do not pass it on. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to understand and improve the use of our service.

We use only necessary cookies and browser storage:

• Login cookies keep you signed in to the app. A session ends when you sign out, and at the latest seven days after your last use.
• replanar_locale remembers the language you chose for one year.
• sidebar_state remembers for seven days whether the sidebar in the app is open.
• In local browser storage, replanar.sidebar.view and replanar.sidebar.expanded remember the sidebar view and its expanded folders; we also store your choice of light or dark display there. These entries stay in your browser until deleted.

This access to your device is based on Section 25(2) no. 2 of the German TDDDG. The processing that follows serves the function you requested under Art. 6(1)(b) GDPR or secure operation under Art. 6(1)(f) GDPR. The payment service may use its own necessary storage and security functions during checkout.

3. Account, organizations and members

For your account we process your name, your email address and its confirmation status, a password hash, your language for emails, the version of the Terms you accepted at sign-up, and sign-in and session data including IP address and browser identifier. After sign-up, we ask, on a voluntary basis, what you want to use Replanar for and how you heard about it. Your password is not stored in plain text. We cannot set up an account without a name, email address and password.

When you sign up, we create a personal workspace. For organizations we process their name, members and roles, as well as invitations with the invited person's email address, the intended role and the inviting member. All members of an organization see its conversations, drawings and results and can edit, move or delete them. Administrators also see, per member, the number of conversions, credits used, and token and model costs, and can set monthly credit limits.

Each person receives the free trial credits only once. To prevent repeat claims, we store a hash of the normalized email address, even after an account is deleted.

The legal basis for accounts, organizations and trial credits is Art. 6(1)(b) GDPR. Invitations, abuse prevention, the limit on trial credits and the voluntary information after sign-up are based on Art. 6(1)(f) GDPR; our interests are the collaboration in organizations that you want, a secure service that can be used fairly, and a service that meets our customers' needs.

4. Drawings, instructions and results

When you use Replanar, we process uploaded files (PNG, JPEG, WebP, GIF and PDF) and image data derived from them, your instructions and follow-up messages, the results including intermediate states, previews and exports, and suggested document titles ("Content"), as well as status and error messages and usage data such as processing effort, costs and credits. We need this information to convert drawings, show progress and results, provide downloads, refine results on request and bill for use.

Technical drawings can contain personal information, such as names and addresses of building owners and plan authors, or signatures in the title block. We process personal data in Content on behalf of our customer under the Data Processing Agreement (Art. 28 GDPR), which is part of our Terms. The controller of this processing is the customer for whom you use Replanar. If you are asking as a data subject about this Content, please contact that customer. We support the customer in responding. Upload only drawings you are entitled to use, and avoid personal information you do not need. We do not need special categories of personal data.

We are the controller of status, error and usage data. The legal basis is Art. 6(1)(b) GDPR; technical troubleshooting and abuse prevention are also based on Art. 6(1)(f) GDPR.

5. Automated conversion through OpenRouter, OpenAI and Anthropic

For conversion we use OpenRouter, Inc., USA. Depending on the processing option selected, OpenRouter routes our requests exclusively to OpenAI or Anthropic as the executing AI provider; fallback routes to other providers are excluded. We do not use direct interfaces of OpenAI or Anthropic for this data flow. This limit concerns the executing AI provider; OpenRouter, OpenAI and Anthropic may also use technical subprocessors, for example for hosting and security.

We transmit the drawing, any detail views, image crops and previews of the reconstruction, your instructions and, for follow-up requests, the earlier instructions, summaries and the previous working state. Names, email addresses, file names, document titles, and account and payment data are not part of these requests. The providers may also process job identifiers and technical connection data.

OpenRouter is our processor and, for our customers' Content, our subprocessor; OpenAI and Anthropic are engaged as subprocessors of OpenRouter. The roles and legal bases are the same as in Section 4. More information: OpenRouter Data Processing Agreement.

We do not use your drawings and results to train AI models and do not make them available to other customers. Our requests are routed only to providers that neither use transmitted data for training nor publish it.

We do not promise end-to-end zero data retention. OpenRouter, OpenAI and Anthropic, including their subprocessors, may store requests and responses to the extent and for the period needed for provision, security, abuse detection, troubleshooting or legal obligations. This retention permits neither model training nor passing your Content to other customers.

6. Payment and billing

For subscriptions and credit purchases we use Stripe Payments Europe, Limited, Ireland. Stripe processes the information given at checkout, in particular name or company, billing address, email address, tax ID and payment details, and calculates the applicable tax. We receive the customer number, subscription and payment status, invoices and transaction identifiers, but do not store full card details. For each organization we keep records of the plan, the number of members, and credit grants and usage.

The legal bases are Art. 6(1)(b) GDPR and, for tax and commercial-law obligations, Art. 6(1)(c) GDPR. Stripe acts partly on its own responsibility, in particular for legal obligations and fraud prevention. More information: Stripe Privacy Policy.

7. Emails, contact requests and other recipients

We send automated messages through Resend, Plus Five Five, Inc., USA: email confirmation, password reset, email address change, invitations, and notifications of finished or failed conversions with the document title and a link. The necessary recipient data, messages and delivery information are processed. We do not use open or click tracking. Resend data processing

Through the contact form for business inquiries we process your name, email address, company, optional phone number and your message. If you are signed in, we prefill known account and billing details. The request is sent through Resend to our sales mailbox. The legal bases are Art. 6(1)(b) GDPR for contract-related communication and Art. 6(1)(f) GDPR for answering other inquiries.

Within our company, only people who need access for their tasks receive it. Accounting, tax advisers and, where applicable, their software providers receive the necessary receipts and contract data. Authorities, courts and legal advisers may receive data where a legal obligation or the protection of legal claims requires it. The legal bases are Art. 6(1)(c) and (f) GDPR respectively. We use processors under the required agreements.

8. International processing

In particular at OpenRouter, OpenAI, Anthropic, Resend and Stripe, including their subprocessors, processing may take place outside the European Economic Area, including in the United States. We do not promise exclusively European processing of conversions. Our own hosting infrastructure is in Germany.

For transfers to third countries we rely on an applicable adequacy decision or on appropriate safeguards under Art. 46 GDPR, in particular EU Standard Contractual Clauses and any necessary supplementary measures. An adequacy decision for certified US companies is used only where the specific recipient and processing are covered by it. You can get information about a specific transfer and a copy of the relevant safeguards through our privacy contact.

9. How long we keep data

We keep data as long as it is needed for the purpose described and then delete it, unless a statutory retention duty or a required legal record prevents this. The main criteria are:

• Account data stays until your account is deleted. We then delete organizations of which you are the only member, with all their drawings and results. Content in organizations with other members belongs to the organization and stays there.
• Conversations, drawings and results stay stored until a member deletes them or the organization is deleted. There is no automatic deletion based only on a general inactivity period. We delete files that were uploaded but not sent after 24 hours.
• So that an interrupted conversion can resume, we store its intermediate states, including the AI provider's responses, separately in our database. We delete these intermediate states automatically seven days after the conversion ends, even if the conversation was deleted earlier, and the data of an adjustment of results made without AI after one day.
• The hash for trial credits stays as long as we offer one-time trial credits.
• Temporary working data, technical logs and security data are cleaned up once the purpose of processing, troubleshooting or security no longer applies. Data about specific incidents or attacks may be needed until they are resolved. For retention at OpenRouter, OpenAI and Anthropic, Section 5 applies.
• Contract, invoice and billing data stays as long as performance of the contract, open claims or legal obligations require. Under German law, statutory retention periods are in particular six years for business letters, eight years for accounting records and ten years for books and annual financial statements. The statutory start of these periods and any extensions remain decisive.
• Completed contact requests are deleted once the purpose of handling them and keeping a record no longer applies.
• Our servers, including the database, are backed up several times a day. Deleted data may remain in these backups until it is overwritten in the limited backup cycle. It is not used for other purposes and is deleted again if a backup is restored.

10. Your rights

Under the conditions set by law, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future; this does not affect the lawfulness of earlier processing.

Where processing is based on legitimate interests, you can object on grounds relating to your particular situation. You can object to direct marketing at any time without giving a reason.

A message to info@softmax-ai.com is enough. We ask for reasonable proof of your identity only if needed. You can change your name, email address and password in the account settings, where you can also delete your account.

You can complain to a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de.

11. Users outside the European Union

This policy applies wherever you are. In addition, for users outside the European Union, in particular in the United States:

• We do not sell personal data and do not share it for targeted or cross-context behavioral advertising.
• Your data is processed in Germany and, as described in Sections 5 to 8, also in the United States.
• You can exercise any additional rights you have under the law of your place of residence, such as rights to access, correct or delete personal data, as described in Section 10. We do not discriminate against you for exercising such rights. For personal data in Content, Section 4 applies.
• Replanar is not directed at anyone under 18. We do not knowingly collect data from children.

We update this policy when the processing it describes changes.