Collabrador Privacy Notice

Version 0.6 · 8 October 2026 · Draft for legal review

This notice explains how Collabrador handles personal data when you visit our websites or use our Rhino and Grasshopper plugin and its online collaboration features. Personal data means information about someone who is identified or can be identified. A nickname or a random identifier can still be personal data when it can be linked to a person.

The main data-protection rules are the EU General Data Protection Regulation (GDPR) and Austria's Data Protection Act (Datenschutzgesetz, DSG). Austria's Telecommunications Act 2021 (TKG 2021) also governs storing or accessing information on your device. This notice provides information; it is not a request for consent.

Operator and privacy contact: Alexander Grasser-Parger, Staudgasse 76, 1180 Vienna, Austria. Email: contact@collabrador.live.

In this notice, “we” means the operator above. We are responsible for deciding how personal data is used to operate Collabrador, administer access, protect the service and handle support. The separate position for project content processed on a customer's instructions is explained under Plugin.

Collabrador is intended for people aged 18 or older. This notice covers Free and paid plans, including use by invited collaborators. The purchase information applies when you make a purchase.

The Website section covers browsing, browser features and contact. The Plugin section covers collaboration and related records. The information about providers and international processing, your rights and notice changes applies to both.

Website

Visiting our websites

When your browser requests a page, download or video, Cloudflare receives technical information needed to deliver and protect it. This can include your IP address, request time, requested resource, browser information and connection or security information.

We use this processing to deliver the content you request, maintain a reliable service and prevent abuse. Our legal basis is our legitimate interest in providing and protecting the service under Article 6(1)(f) of the General Data Protection Regulation (GDPR).

Our public pages do not embed advertising trackers, analytics or social-media widgets. Fonts, images and showcase videos are served through our own sites and hosting. Simply reading these pages does not create a Collabrador visitor identifier. Technical hosting and browser caching still take place.

Browser features and storage

The Webviewer lets you view a shared model in your browser. Connecting can involve a workspace reference, access credentials and a random usage identifier. These support authorised access, reconnection and service limits. They are separate from a paid customer's licence and seats. Collaboration data and recipients are described under Plugin.

Pinboard is public. A post or comment can show a name or nickname, message, time, links and other information you choose to publish. When a visitor first submits a non-empty comment, the browser creates a random guest identifier and nickname to keep the discussion consistent in that tab. We also use connection-derived signals to limit abuse. Do not publish passwords, access credentials or confidential project information.

Restoring or duplicating a browser session can preserve session storage. Disconnecting the Webviewer does not clear all browser credentials. You can remove this site's stored data through your browser settings; this may interrupt access or purchase completion and does not delete server records.

The purchase and account cookies are protected from access by page scripts and are sent over HTTPS only to their respective claim or account API routes. They are not used for general visitor tracking. Manage account keeps revealed tokens in page memory, clears them when the page is hidden, and does not save them to browser storage. Tokens you choose to copy or download remain in your clipboard or file until you remove them. Public browsing pages do not load Stripe payment scripts. If you choose to buy a paid plan or manage its cancellation, Stripe's hosted pages have their own cookie information.

Protected administration uses Cloudflare Access authentication and security cookies. Cloudflare protection features can also use security cookies where required by the enabled feature. Their lifetimes depend on the relevant settings and can extend beyond one browser session. See Cloudflare's cookie information.

Under section 165(3) TKG 2021, storing or accessing information on your device requires prior consent unless it is solely needed to transmit a communication or strictly necessary to provide a service you expressly request. This rule applies to cookies, browser storage and corresponding storage or access by the plugin. A GDPR legal basis, such as legitimate interests, does not by itself replace consent where this separate rule requires it.

We use the browser storage listed above for the stated access and session functions, not for optional tracking. Any additional storage or access requiring consent must be subject to a separate choice before it occurs.

Contact and support

If you email us, we receive your email address, the name you provide, your message, any attachments and associated email information. Google Workspace handles delivery and storage of this correspondence. We use it to answer your enquiry, provide support and address problems you report.

Sending an enquiry is voluntary. We need a reply address and enough information to understand your request; without them, we may be unable to answer or provide the requested help.

For support or requested pre-contractual steps that are necessary for a contract with you personally, we rely on Article 6(1)(b) GDPR. For general enquiries or communication with a customer's employees or representatives, we rely on our legitimate interest in answering requests and supporting the service under Article 6(1)(f). Applicable legal obligations may require particular records under Article 6(1)(c).

For technical help, your Collabrador and Rhino versions and a description of the problem will usually be more useful than a complete model. Please do not email passwords, access tokens or confidential model files. We will ask only for additional information needed for the particular request.

Online withdrawal

The online withdrawal form collects your name, the contract description you provide and the email address you choose for your receipt. It does not require a login, access token or reason. Cloudflare receives the declaration and sends a receipt containing it and the receipt time to you, with a copy to our support inbox in Google Workspace. We use these details to acknowledge and handle your withdrawal and meet applicable legal obligations under Article 6(1)(c) GDPR. Supplying enough information to identify the contract and deliver the receipt is necessary to use this form; the email and postal routes remain available.

To prevent duplicate messages and abuse, Cloudflare keeps keyed, pseudonymous request/address identifiers, timestamps and delivery status. Our legitimate interest under Article 6(1)(f) is reliable, secure and proportionate operation of the form. These identifiers are not guaranteed anonymous. The declaration remains in a protected intake record until support confirms delivery of the receipt to your chosen address and the support inbox; provider submission alone does not establish delivery. On confirmed handoff, name, address and contract text are removed from the operational record, and its remaining replay metadata expires after seven days. Unconfirmed declarations are not silently discarded or automatically resent. The support correspondence and any required legal or billing records have separate retention requirements described in this notice. The form keeps its fields and downloadable receipt in the current page's memory, without adding browser storage or analytics.

Purchases and billing

If you purchase a paid plan, Stripe processes the purchase and related payment information. Depending on the transaction, this can include your name, contact and billing details, payment method, tax information, invoice records and payment status. Stripe also processes information for its own financial, security and legal purposes, as described in its Privacy Policy.

Collabrador receives payment and subscription events and stores the references and licence information needed to provide access, enforce the selected plan and support the purchase. A licence can contain several seats. The purchaser's billing identity is different from the identity of each collaborator using a seat. Collabrador's operational licence records do not contain card numbers or full payment-method details.

The billing and contact information necessary for your purchase is required to conclude and perform the contract and, where applicable, meet tax obligations. Without the required information, we cannot complete or administer the purchase. This does not make every optional piece of information compulsory.

We rely on Article 6(1)(b) for necessary processing of your own purchase, and Article 6(1)(f) for necessary administration involving a business customer's representatives. Relevant tax and accounting obligations are handled under Article 6(1)(c). Necessary fraud prevention and protection of legal claims are assessed separately under Article 6(1)(f).

Stopping a subscription, requesting a refund and requesting deletion of personal data are different actions. Some financial records may need to remain after access ends because of applicable legal obligations or a dispute.

Manage account and access recovery

Manage account uses your purchase reference and a fresh code sent to the purchaser contact already associated with that purchase in Stripe. We obtain that address when needed for verification and service messages; we do not maintain a separate customer email directory. A keyed comparison value detects a changed address. A changed contact requires proportionate support verification before access is rebound. An old email link, another person's seat token or a return from Stripe does not authenticate the purchaser.

The verified purchaser can inspect one purchase's plan, seats and dates, retrieve its current tokens, request selected token replacements and enter Stripe's cancellation flow. We retain an encrypted copy of each current token in its existing protected seat record, with a separate service encryption key. Re-download does not issue more seats or reset usage. A committed replacement overwrites the superseded encrypted token. This protects stored credentials; it does not prevent Collabrador from performing an authorised retrieval. A beta invitee's own seat credential permits only a limited date/status view, without purchaser, billing or other-seat powers; reading does not start or extend the allowance.

We process short-lived verification/session records, bounded abuse counters, selected seat references, any short replacement reason you provide, receipt time, the Austrian working-day deadline, outcomes and message-submission status. Cloudflare sends verification, replacement and cancellation emails without seat tokens. Support notifications use request/licence/seat references rather than the purchaser's address; Google Workspace receives support correspondence. Provider submission does not guarantee inbox delivery. Necessary purchase administration uses the contract and business-representative bases above; access protection and abuse prevention use Article 6(1)(f). Legally required cancellation handling or evidence uses Article 6(1)(c) where applicable.

Verification records expire after ten minutes, sessions after thirty minutes and account abuse budgets within twenty-four hours. Ordinary closed replacement and notification detail keeps the current and previous calendar month. Unresolved requests or uncertain delivery require a specific continuing support/legal purpose and regular review; they are not silently discarded at that cutoff. Current encrypted credentials remain while needed for access and recovery. At final closure, verified support can remove recoverable copies after checking access has ended and no continuing recovery need exists. Validation, billing and necessary legal evidence are separate. Failed physical cleanup requires operator follow-up; provider backups and correspondence have their own necessary lifetimes. Rights requests remain available without sign-in.

Providers and international processing

We use Cloudflare to deliver the websites and operate the collaboration service, including computing, storage and transactional email sending. Google Workspace handles support email. Stripe handles payment, billing and hosted subscription cancellation. Their functions differ, and some provider activities are carried out under their own responsibility rather than solely on our instructions.

Relevant information is available in Cloudflare's data-processing terms, Google's data-processing terms and Stripe's Privacy Policy. We may also disclose necessary information to professional advisers or public authorities where justified by a legal obligation, a legal claim or another applicable lawful basis.

These providers and their subprocessors may process data outside the European Economic Area, including in the United States. European storage locations do not mean that all network handling, support access, provider records or email processing stays within the EU. Collaborators and viewers can also receive information in the countries where they use the service.

The providers' published transfer arrangements include applicable adequacy decisions and standard contractual clauses. The EU–US Data Privacy Framework applies only to transfers covered by the relevant recipient's certification. You can contact us for information about the safeguards relevant to your data and how to obtain a copy. Accepting or reading this notice is not consent to international transfers.

Website and support retention

Technical request and security records are subject to the relevant hosting and security arrangements. Their lifetime is separate from a browser tab or a shared model. Browser storage follows the periods explained above.

Support correspondence is used to answer and follow up on the enquiry. Any further retention must have a continuing reason, such as handling a dispute, documenting the outcome of a privacy request or meeting an applicable legal obligation. The information needed for those purposes can differ from the attachments originally supplied.

For accounting records and supporting documents covered by section 132 of Austria's Federal Fiscal Code (BAO), the general retention requirement is seven years from the end of the relevant calendar year. Relevant records must be kept longer for pending tax proceedings; other applicable rules can also require a different period. This duty does not set a seven-year lifetime for models, diagnostic reports or all usage records.

Pinboard visibility, stored content and collaboration records have different lifetimes. These are explained in the Plugin retention section below and also apply when you use the browser features.

Your rights for the website and plugin

You can contact contact@collabrador.live to exercise your data-protection rights. You do not need a paid subscription or an active account. This also applies after your access expires or a subscription ends, and if information about you appears in someone else's shared content.

Depending on the applicable conditions, you can:

• ask whether we process personal data about you and obtain access to it and a copy;
• ask us to correct inaccurate or incomplete personal data;
• request deletion of personal data or restriction of its use;
• receive data you provided in a structured, commonly used, machine-readable form, where the right to data portability applies;
• withdraw consent at any time where processing relies on consent, without affecting the lawfulness of earlier processing; and
• exercise the safeguards that apply to decisions based solely on automated processing with legal or similarly significant effects, including human intervention where the GDPR provides for it.

Your right to object: where we rely on legitimate interests, you can object on grounds relating to your particular situation. We must then assess whether there are compelling legitimate grounds to continue or whether the information is needed for legal claims.

We may ask for proportionate additional information when needed to identify the relevant records or resolve reasonable doubts about identity. We do not routinely require an identity-document copy. A seat or workspace reference does not by itself authorise disclosure of other collaborators' records or deletion of a whole team's work. If we cannot identify your records, we will explain that and consider additional information you can provide.

We respond without undue delay and normally within one calendar month. If the complexity or number of requests justifies up to two further months, we will explain the extension within the first month. We will explain any refusal or partial fulfilment, including necessary retained information and your options for challenging the outcome. Requests are normally free; any exceptional fee or refusal must meet the conditions in the GDPR.

Where an organisation controls project content that we process on its instructions, that organisation is responsible for deciding the request concerning that content. We can help route the request and provide the required assistance. We remain responsible for requests concerning the personal data we control ourselves.

Where required, we notify relevant recipients of corrections, deletion or restrictions. We also assess the required steps concerning personal data we made public. We cannot directly remove independent copies on another person's computer. If information must be retained, we will explain the applicable reason and retention period or criteria.

You can complain to the Austrian Data Protection Authority or another competent supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. You do not have to contact us first. Your right to seek a judicial remedy remains unaffected.

Changes to this notice

We update the version and date when this notice changes. If we intend to use personal data for a new purpose, we must provide the relevant information before that use and establish the required legal basis. A notice update does not by itself authorise additional processing.

Plugin

Connecting and keeping access consistent

Connecting from Rhino and Grasshopper sends requests to Collabrador's service through Cloudflare. These can include your IP address and connection information, a workspace reference, your chosen display name, access credentials, licence or seat information where applicable, and usage identifiers.

The plugin stores a random usage identifier locally so the service can apply limits consistently across connections. The stored identifier persists between sessions and has no time-based expiry. This is different from a licence, a seat, a Rhino process or a workspace. Some identifiers are hashed or replaced with aliases in reports, but they can remain linkable and are not necessarily anonymous. The plugin does not automatically use your operating-system account name as your collaborator name.

Before the plugin's online functions start, it presents privacy information and asks for agreement to the applicable terms. It stores the terms version, agreement time and your separate diagnostic choice for your local Windows user. These settings remain until replaced or removed; they are not stored in shared model files or licences and do not prove another person's agreement. Use the component's “Terms and privacy” menu to review the documents and change diagnostic preferences. The browser viewer and Pinboard ask for their own agreement before connecting or posting.

Essential connection, access and usage information is needed to admit you, keep the collaboration consistent and apply the service limits. If it cannot be processed, the affected online function cannot work. Local storage and service records do not all disappear when you disconnect or uninstall the plugin.

Models and information shared with others

When you publish model content, it travels from Rhino or Grasshopper through the service to the participants in the selected workspace and, where access is granted, to browser viewers. The service stores shared state so collaborators can receive changes and rejoin. Shared information can include geometry, object attributes, names, layers, identifiers, editing information and the metadata included in the published content.

Model content can contain personal data, for example a person's name in an object attribute or information about an identifiable client. Removing particular file-history information does not remove every user-supplied name, property or piece of personal information. Share only content you are entitled to disclose and consider who will receive it.

Other people or organisations can supply information concerning you through invitations, licence or seat labels, shared project content, public posts and support requests. Billing information can also reach us through Stripe events. These are sources of information in addition to what you provide yourself.

Presence sharing, where enabled, can send information such as camera position or a clicked point to other participants. Hide / Show / Isolate and display modes are local-only: they are not synchronized or stored as part of the canonical shared model. An enabled presence feature deliberately shares its selected location information. You can choose whether to use optional sharing and publishing features.

Playground and Pinboard are public. Other people can see and copy contributions. Any Playground participant can Publish the whole shared scene, including others' work; the service also automatically archives completed seasons when rollover conditions are met. Those publications and archives can remain available for later reuse. The Terms explain the Playground CC BY 4.0 licence and collective credit. That copyright permission is not consent to publish someone else's personal information and does not remove personal-data rights. Private workspaces and Pinboard messages are outside this CC policy. A person with legitimate access to a workspace or viewer can also save, capture or reproduce what they can see.

For a content report or review request, we use the location, explanation, necessary contact details and correspondence to assess the issue, take proportionate action, explain the decision and handle review or legal obligations. We use the existing support inbox, not a new public identity record. We do not require an account, a purchase or an identity document by default. We do not publish a reporter's contact details or automatically disclose them to the person reported. Required action and lawful disclosure limits take priority; we retain only records needed for the relevant support, legal or claims purpose. Service restrictions, contractual cancellation and personal-data erasure are different actions.

Why we use service information

We use necessary personal data to provide access and collaboration, maintain correct shared state, apply usage and licence limits, prevent abuse, protect the service, reconcile service usage and costs, provide billing or support, and fix bugs.

For processing objectively necessary to perform our contract with you personally, we rely on Article 6(1)(b) GDPR. Where you use a service obtained by an organisation, necessary processing of your access and contact information relies on our legitimate interests and the organisation's interests in providing and administering that service under Article 6(1)(f). This does not make every employee a party to the organisation's contract.

Necessary security, abuse prevention and service-side operational records rely on our legitimate interests in protecting users, maintaining reliable collaboration and investigating failures under Article 6(1)(f). Optional diagnostic recording and automatic uploads from your device use your separate, withdrawable consent under Article 6(1)(a). Processing a report that you expressly send for support is assessed for that support purpose. Any retention required by a specific legal obligation is assessed under Article 6(1)(c). These purposes do not justify collecting unrelated information.

We do not use diagnostics or usage records for marketing, advertising, sale or AI training. Their purposes are service operation, security, billing and support, and fixing bugs.

Where we handle personal data in a customer's project solely on that customer's instructions, the customer determines the purpose of that project processing and we act as its processor. Our own access, security, billing and support processing has the separate purposes described here.

Diagnostics and automatic restrictions

Optional diagnostic recording and automatic reports are off until you choose to allow them. Declining does not prevent collaboration. If enabled, the plugin keeps recent technical events in memory, bounded to 15 minutes and 3,000 events under the standard settings. These can include versions, event times, error or command information and operation counts. Certain serious errors can trigger a report, including a failed connection attempt after your choice. The active access mode and diagnostics settings further restrict automatic uploads; those settings cannot turn them on without your choice.

You can disable this in the “Terms and privacy” component menu. Future automatic reports stop; withdrawal does not make earlier lawful processing unlawful. The “Send support report” menu action in Session Stats can still send current technical state once for support. With optional diagnostics off, it does not include recorded event history, and a saved or wired Upload Report input cannot trigger it. This manual action does not turn automatic diagnostics on.

Reports are sanitised and encrypted for storage. The reporting process is designed to exclude full model contents, passwords, access credentials, file paths and other unnecessary information. Sanitisation does not make every report anonymous: event times, operational context or error details can still relate to someone.

The service automatically checks credentials, plan validity, usage limits and abuse signals. These checks can reject a connection or stop an affected operation when access is invalid or a limit is reached. They do not involve advertising profiles. If you believe a restriction is wrong, contact us with enough information to locate the affected session or licence; do not send secret credentials.

Protection and local copies

Connections use TLS to protect information in transit. Workspace protection also depends on the selected feature. Licensed workspaces, including Workshop, use password-based encryption for collaboration payloads. Free workspaces can use a workspace password; without one, their payload key is derived from the workspace name, which does not provide the same confidentiality against someone who knows or guesses that name. Playground and Pinboard remain public.

These protections do not mean that every item of service metadata is encrypted in a way only participants can read. Keep access links and credentials secure and choose the appropriate workspace for the information you intend to share.

Purchaser-account processing is separate from collaboration traffic. Purchaser email addresses, verification codes and billing-management sessions are not added to Rhino model messages. A seat credential still links to its licence and permitted use; encryption or an opaque identifier does not make that information anonymous.

Files saved or exported on your computer, and copies made by collaborators or viewers, have separate lifetimes. Server-side deletion does not erase those independent files. A customer's or recipient's own handling of a copy may carry separate data-protection responsibilities.

Collaboration and operational retention

Room expiry, public visibility and deletion of stored records are separate events. The current service uses the following periods and triggers:

The room periods start when the room becomes empty; they are not measured from the age of each object. Continued use and reconnection can affect room expiry. Live Playground changes may become part of a lasting publication or automatic season archive even if their contributor did not press Publish. Restricting a Pinboard item hides its public text while retaining the original under its existing lifetime for review; it does not restart that lifetime. Restricting access to a Playground publication or season does not itself erase stored content or independent copies.

Operational usage, licence, security and support records can remain after a connection ends or a reporting period closes. They are used for access continuity, abuse prevention, reconciliation, support and necessary legal records. Not all of these records have automatic expiry. Hidden Pinboard content and some associated records can likewise remain stored after public visibility ends.

Retention must remain necessary for the particular purpose. Active access, unresolved support or security matters, reconciliation and applicable legal obligations have different requirements. You can request access or deletion using the contact and rights procedure above; we must assess the relevant records and explain any justified continuing retention. Redacting a label does not by itself delete the records or make them anonymous.

Requests about collaboration data

The rights and contact information in the Website section also applies here. Tell us enough to identify the relevant context, such as the affected workspace, licence reference or approximate event time, without sending passwords or access tokens. We assess your own data and protect information belonging to others.

Requesting deletion of your personal data does not automatically authorise deletion of an entire shared model, another person's records or a customer's subscription. Where several actions are requested together, we will distinguish their scope and explain the outcome. Public content, customer-controlled project data, operator records and independent local copies may require different handling.