Privacy

Last updated 2026-05-13

This page explains what data Cyanograph collects, why, where it goes, and how you can change or remove it. We try to keep it short and concrete.

Who we are

Cyanograph (cyanograph.com) is an EU-based service that turns CAD models into engineering drawings. The data controller is:

Full imprint information (incl. VAT ID, GISA, regulatory authority) is on the imprint page.

What we collect

• Account. Your email address (used as your login identifier and for magic-link sign-in) and a display name if you supply one.
• Uploaded CAD files. STEP and IGES files you upload are stored in Convex object storage. They are never shared, are used only to generate drawings for the uploading account, and are retained until you delete the project.
• Generated artefacts. SVG sheets, glTF meshes, and PNG thumbnails produced from your uploads. Same retention as the uploaded files.
• Analytics. Only with your consent. Google Analytics 4 (Measurement ID G-QSB2871RYP) records page views and basic interactions; IP addresses are anonymised per GA4 defaults. No advertising signals are sent.
• Server logs. Standard HTTP request logs (IP, user agent, timestamps) kept around 30 days for abuse prevention and debugging.

Why

Our legal bases under the GDPR:

• Contract (Art. 6(1)(b)). Delivering the service: storing your account, processing your CAD files, returning drawings.
• Consent (Art. 6(1)(a)). Analytics. You can grant or withdraw it at any time via the Cookies link.
• Legitimate interest (Art. 6(1)(f)). Security, abuse prevention, and short-lived diagnostic logs.

Sharing

We use the following sub-processors. We do not sell data and we do not share with ad networks.

• Convex — application hosting and object storage (your account, projects, generated sheets).
• Hetzner — compute for the CAD worker.
• Resend — transactional email for magic-link sign-in.
• OpenRouter — routes AI model calls used to plan views and dimensions. CAD files are not sent; only short text summaries and small preview PNGs of the projected views.
• Google (Analytics) — only after you accept analytics cookies.

Where data sits

• Convex deployment: eu-west-1.
• Hetzner compute: FSN1 (Falkenstein, Germany).
• Other sub-processors per their own data-processing agreements.

Your rights (GDPR)

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise any of these, email cw@christianweinmayr.com. You also have the right to lodge a complaint with your local supervisory authority.

The Cookies link in the footer of this site (and inside the app) re-opens the consent banner so you can change or withdraw analytics consent at any time.

Cookies

Two categories of cookies are used: Convex authentication cookies (essential session cookies, no consent required) and Google Analytics cookies (_ga, _ga_*) which only activate after you accept analytics.

Children

The service is not directed at people under 16. If you believe a child has created an account or uploaded files, email us and we will delete the data.

Changes

We will update this page and bump the "Last updated" date whenever the practices described here change materially.