SCULPTRO

Privacy Policy & Personal Data Protection

This Privacy Policy explains how SCULPTRO (operated by Javor Vatchkov, Amsterdam / European Union) collects, processes, stores, and protects your personal data under the EU General Data Protection Regulation (GDPR), and how you can exercise your right to erase your personal data at any time.

Local-First Studio Privacy

Your generated WAV audio files, Spider Diagram projects, local neural weights, and Bring-Your-Own-Key (BYOK) API keys are stored locally on your computer (~/Music/Sculptro/) and are never uploaded to our servers.

Minimal Cloud Account Data

In our cloud database, we only store your email address, bcrypt-hashed password, optional display name, optional profile photo, license entitlement, and your Terms acceptance timestamp.

1. Data Controller

The data controller responsible for your personal data is Javor Vatchkov / SCULPTRO. You can reach our privacy contact at [email protected].

2. Personal Data We Collect & Legal Basis (GDPR Art. 6)

  • Account & Authentication Data: Email address, optional display name, and a salted bcrypt password hash. Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR) to provide your 14-day trial and license sync.
  • Terms & Privacy Acceptance Record: The timestamp (terms_accepted_at, privacy_accepted_at) and version (terms_version) when you created your account. Legal Basis: Legal obligation & legitimate interest (Art. 6(1)(c)/(f) GDPR) to maintain proof of consent.
  • Optional Profile Avatar: If you upload a profile picture in the app or on the web, it is stored in our private Cloudflare R2 bucket under avatars/<userId>/. Legal Basis: Consent (Art. 6(1)(a) GDPR).
  • License & Order Entitlements: License key (SCULP-...), trial start/expiration dates, and Polar checkout order references. Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).

3. Sub-Processors & Third-Party Services

We use a minimal set of GDPR-compliant infrastructure providers to operate SCULPTRO:

  • Neon (PostgreSQL): Cloud database storing user accounts and license entitlements.
  • Cloudflare R2: Object storage for desktop app installer releases and optional user profile avatars.
  • Polar.sh: Merchant of Record handling checkout, VAT/tax compliance, and payment processing. SCULPTRO never sees or stores your credit card details.

4. Your EU GDPR Rights (Access, Portability & Erasure)

Under the EU General Data Protection Regulation, you have the right to access your personal data, rectify inaccurate details, export your data, object to processing, and request immediate erasure (Right to be Forgotten, Art. 17 GDPR).

GDPR Article 17 • Right to Erasure

Delete Your Account & Personal Data

You can permanently delete your SCULPTRO account and all personal data from your account page, from this page, or inside the desktop app (Settings → Profile & Account).

What is permanently erased when you confirm deletion:
  • Your user record (email, display name, password hash, and Terms acceptance record)
  • Your uploaded profile photo in Cloudflare R2 storage
  • Your cloud license association, AI credit key ledger, and password reset codes
  • Your email address on any Polar order records in our database (anonymized)

Note: Local WAV samples and projects saved in ~/Music/Sculptro/ on your computer are never deleted by cloud account erasure.

Sign in to delete your data from the account page, or email [email protected] from your registered email address.

View Terms & Conditions →