EN
Privacy policy
A circular string art portrait displayed above a children’s sofa, adding a soft, personal touch to a modern kids’ room.

Privacy policy

This Privacy Policy explains how Fuel Wood Spatar GmbH collects, uses, and protects personal data across spatar.de, the Spatar String Art blog, and the online store, in accordance with GDPR.

Last updated: September 14, 2026

Fuel Wood Spatar GmbH (“we”, “us”, “our”) operates spatar.de, including the blog at spatar.de/blog, the String Art generation and account services, and the online store at shop.spatar.de (collectively, the “Services”). This Privacy Policy explains how we collect, use, store and disclose personal information when you browse the Services, upload photos, generate or save projects, use assembly instructions, contact us, subscribe to communications or make a purchase. Where processing requires consent, we request it separately; using the Services does not, by itself, constitute that consent.

1. What Is Personal Information

“Personal information” means information that identifies, or can reasonably be linked to, an identifiable individual. This can include account details, identifiable photographs, online identifiers and activity associated with an account. Information that has been irreversibly anonymized so that individuals cannot reasonably be identified is not personal information.

2. Personal Information We Collect

  • Account and contact information: your name, email address, preferred language, account settings, messages and support inquiries. For password-based accounts, we store a password hash rather than your password in plain text. Where you use Google or Apple sign-in, we receive the account identifier and information made available by that provider for authentication.
  • String Art content and project information: uploaded photographs and any embedded metadata, cropped images, generated previews, generation settings, project names, assembly instructions, saved progress and generation status. We also record relevant project activity timestamps to operate the retention rules described below. Generation information may be processed for both guests and registered users.
  • Technical and transaction information: IP addresses, browser and device information, request and error logs, authentication and session identifiers, cookie preferences and relevant usage timestamps. When you purchase from the store, order, billing, shipping and payment-related information is processed through the store and its payment providers.

3. Cookies and Browser Storage

We use cookies and similar browser storage for functions such as authentication, remembering preferences, recording consent choices and maintaining temporary generator or project state. This may include local storage and IndexedDB. Optional analytics and third-party content are subject to consent where legally required. When analytics consent is given, the Website may load Google Tag Manager to manage measurement tags; loading Google-hosted resources can transmit technical information, including your IP address and browser request information, to Google. You can manage available consent choices through the cookie settings. Browser settings also allow you to restrict or clear cookies and local data, although doing so may affect functionality or remove locally stored drafts.

4. Uploaded Images, Projects and Public Content

We process uploaded images and related project information to generate the String Art results you request, save projects and provide assembly instructions. You should upload only materials you are entitled to use and share for these purposes. Blog comments are a separate form of submitted content and may be publicly visible. Uploaded and generated image files may be accessible through direct file links; a person who obtains such a link may be able to view or download the image without signing in. Account authentication should therefore not be treated as a guarantee that direct image links are private. Avoid sharing image links or posting sensitive personal information in public comments.

5. Newsletters and Service Emails

We send newsletters and marketing emails with your consent. Newsletter addresses and subscription information are managed through our self-hosted Listmonk installation. You may unsubscribe from newsletters at any time using the unsubscribe link. Separately, we send service-related emails necessary to operate your account and provide requested services, such as account verification, password recovery, assembly instructions and important account or service notices. This includes one reminder approximately seven days before an inactive saved project is scheduled for deletion. These service messages are not marketing emails and are separate from newsletter subscriptions. Email delivery involves the mail infrastructure and providers used to transmit those messages.

  • Providing requested services: we process information to create and manage accounts, generate artwork, save projects, provide instructions, resume assembly progress, process purchases and send related service communications. Where necessary to perform a contract with you or take steps at your request before entering a contract, the legal basis is Article 6(1)(b) GDPR.
  • Operating and protecting the Services: we process information for security, fraud and abuse prevention, troubleshooting, appropriate comment moderation and service administration. Where applicable, we rely on our legitimate interests under Article 6(1)(f) GDPR, taking account of your interests and fundamental rights.
  • Consent-based activities: where required, newsletters, optional analytics and optional third-party technologies rely on your consent under Article 6(1)(a) GDPR and applicable rules governing access to or storage of information on your device. You may withdraw consent without affecting the lawfulness of earlier processing.
  • Legal obligations: we process and retain information where necessary to comply with legal, accounting, tax or regulatory duties under Article 6(1)(c) GDPR. Automated processing is also used to generate requested artwork and administer project retention; project activity timestamps help determine when a reminder or cleanup is due.

7. Platforms and Service Providers

  • Shopify: the online store uses Shopify and its integrated payment services to process store visits, orders, payments and fulfilment information. Shopify’s processing depends on the services used. Further information is available in Shopify’s Privacy Policy.
  • Ghost: the blog uses Ghost, hosted under our control, for content delivery, comments, subscriptions and associated technical functions.
  • Listmonk: newsletter subscriptions are managed through our self-hosted Listmonk installation. Hosting or email-delivery infrastructure may additionally process information needed to operate and deliver newsletters.
  • Google and Apple: where you use their sign-in services, these providers process authentication information under their own policies. Google services may also be involved when consented analytics or YouTube content is loaded. See Google’s Privacy Policy and Apple’s Privacy Policy.
  • Infrastructure providers: hosting, email delivery, content delivery, security and backup providers may process information necessary to operate their services. Where a provider acts as our processor, the required data-processing arrangements apply.

8. Disclosure of Personal Information

We disclose personal information where necessary to provide the Services, including to relevant hosting, authentication, payment, email and other operational providers. Information may also be disclosed where required by law, in response to a valid legal request, to establish or defend legal claims, or in connection with a lawful business restructuring or transfer, subject to applicable safeguards. Public comments and shared or accessible image links may disclose information as described in Section 4. We do not sell personal information.

9. Third-Party Links and Embedded Content

The Services may contain links to independent websites and embedded content, such as YouTube videos. Loading or interacting with those services may transmit technical information directly to their providers. Their own privacy policies govern their independent processing. We do not control those independent services; this does not exclude our responsibilities under applicable data protection law.

10. Children’s Data

The Services are intended for adults and are not directed at children. Please take particular care when uploading images or other information concerning children and ensure that you have the necessary rights and lawful permissions. If you believe a child has provided personal information without appropriate authorization, contact us so that we can investigate and take appropriate action, including deletion where required.

11. Data Retention

We retain personal information for the purposes described in this policy and any applicable legal obligations. The following project-retention rules apply to existing and new projects, subject to mandatory rights and any separately agreed longer access period:

  • Unsaved generations: completed guest results are eligible for deletion 72 hours after completion. Completed results generated while signed in are eligible for deletion seven days after completion if they have not been saved to an account.
  • Failed or cancelled generations: these are eligible for deletion 72 hours after processing and any retries have ended. Invalid or rejected uploads may be discarded immediately.
  • Original uploaded photos: these may be deleted seven days after a project is saved, provided they are no longer required for processing, retries or another retained generation or project. Images required for a retained saved project remain subject to that project’s retention period.
  • Saved projects: each project, its required images and assembly instructions are retained for 365 days after its last qualifying activity. We send one reminder approximately seven days before scheduled deletion. Automatic deletion occurs only after the inactivity period has elapsed and at least seven days after that reminder has been sent. A delayed reminder postpones deletion accordingly.
  • Qualifying activity: while signed in and connected to the service, opening the saved project or its online instructions, opening or downloading its PDF instructions, saving progress, editing the project or requesting its instructions by email renews that project’s retention period. Signing in, viewing the project list, reading an earlier email or using a previously downloaded file does not, by itself, renew online retention.
  • Other personal information: account information is generally retained while the account exists and afterwards only where needed for a lawful purpose. Support correspondence is retained as necessary to handle the request and related legitimate or legal needs. Newsletter information is retained for subscription management; minimal records may be kept where necessary to respect an unsubscribe request. Purchase, accounting and other mandatory records follow applicable statutory retention requirements.
  • Backups and cached copies: where backups are maintained, deleted information may remain until the relevant backup expires or is overwritten. Backup retention is determined by service-recovery needs and applicable legal requirements. Cached copies may remain until the relevant cache expires or is cleared. These copies do not guarantee recovery or continued availability of a deleted project.
    Deletion is performed through scheduled cleanup rather than at an exact instant. You may delete saved projects earlier through your account or exercise your data-protection rights below. Project expiry does not automatically delete your account, and deletion from our Services does not remove files you have downloaded or emails already delivered to you.

12. Your Data Protection Rights

Depending on the applicable law and circumstances, you may request access to your personal information, correction, deletion, restriction of processing or portability. You may object to processing based on legitimate interests and to processing for direct marketing. Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. You may also lodge a complaint with a competent supervisory authority, including in your place of habitual residence, work or the alleged infringement. Contact us using the details below to exercise your rights. We may request proportionate information to verify your identity, and statutory exceptions may apply to particular requests.

13. International Transfers

Some service providers may process personal information outside your country of residence, including outside the European Economic Area. Where GDPR restrictions on international transfers apply, the relevant transfer must be supported by an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses and supplementary measures where necessary. You may contact us for information about the safeguards relevant to your personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, our processing practices or legal requirements. The revised version will be published with an updated “Last updated” date. Where required, we will provide additional notice of material changes or obtain consent before introducing processing that requires it. A revised policy does not remove your statutory data-protection rights.

15. Contact Information

Fuel Wood Spatar GmbH, Gautinger Straße 3, 82131 Stockdorf, Germany. Email: info@spatar.de. Phone: +49 172 390 27 57. Fuel Wood Spatar GmbH is the data controller for processing carried out under its responsibility as described in this Privacy Policy.