Skip to content

Legal

Privacy Policy

Draft

ShaperLab Pro — Privacy Policy

DRAFT — to be reviewed by a Portuguese lawyer before publication. Version 1.0 · 11 October 2026

This policy explains what personal data ShaperLab Pro (the "Software") keeps and what Sculpted Chronicles, Lda receives, why, and what your rights are under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Lei n.º 58/2019.

In short. The Software works offline. Your boards and files stay on your computer. The Software contains no analytics, advertising or tracking. Nothing is sent to us unless you choose to send it. Parts marked "When subscriptions start" describe how this will change once paid plans begin; they do not apply yet.

1. Who is responsible

The data controller is Sculpted Chronicles, Lda, NIPC 519412443, Avenida Marcos Marques Rosa, Nº 100 – Fajã da Areia Pico, 9240-040 São Vicente, Madeira, Portugal. E-mail for privacy questions: legal@shaperlab.pro.

We have not appointed a data protection officer, because the law does not require one for what we do.

2. What stays on your computer

The Software keeps the following only on your computer, in its profile folder:

  • macOS: ~/Library/Application Support/ShaperLab Pro;
  • Windows: %APPDATA%\ShaperLab Pro;
  • Linux: ~/.config/ShaperLab Pro.

We cannot see any of it.

  • Licence:

    • your serial number and product key, or your licence file;
    • the licence details (holder name, edition, expiry date, computer binding);
    • the activation date;
    • a deactivation code after you deactivate.

  • Computer ID. An eight-character ID such as 7K3Q-9XD2. The Software makes it from a one-way hash (SHA-256, cut to 40 bits) of an identifier your operating system already provides:

    • IOPlatformUUID on macOS;
    • MachineGuid on Windows;
    • machine-id on Linux.

    If the system has none, the Software uses a random number stored in the profile instead. The original identifier is never stored or shown. The ID is used only to tie a licence to a computer.

  • Your work:

    • the board you have open (saved automatically, so that it can be restored after a crash);
    • copies of your recent boards (up to eight);
    • CNC program history;
    • your blank library;
    • settings and window layout.

  • Shaper Advisor order log. For each board created with the Shaper Advisor, the log keeps:

    • the surfer sheet (weight, height, age, fitness, level, waves, focus);
    • the recommendation and the dimensions of the board as made and as last saved;
    • your rating, if you give one.

    It contains no names or contact details. The log is on by default. You can switch it off or export it from the Advisor panel. To delete it, delete the profile folder (see below). A board created with the Advisor also carries its surfer sheet in the board file (see section 7).

  • Problem information. Crash dumps written by the Electron framework stay in the profile's Crashpad folder and are never uploaded. The Software also keeps:

    • a short list of recent problems, for up to seven days;
    • the steps before a problem, kept only for the current session.

Deleting it. Uninstalling the Software leaves the profile folder in place, so that your settings and licence survive a reinstall. To remove everything, delete that folder. You can also clear the recent boards from File ▸ Open Recent.

3. What we receive, why, and on what legal basis

3.1 Licences and support (today)

When we issue you a licence or help you, we process:

  • your name and e-mail address;
  • the serial number and licence we issued, with its edition and expiry date;
  • an internal note (for example an invoice reference);
  • your computer ID, if you send it to us to tie a licence to a computer or to move it;
  • our correspondence with you.

Why: to issue and manage your licence and to answer you. Legal basis: performance of the contract (art. 6(1)(b) GDPR). How long: while your licence is active, then up to [five] years to deal with claims, unless the law requires longer (for example ten years for accounting records). [OWNER/LAWYER: confirm periods.]

3.2 Problem reports you choose to send

Problem reports are off unless you act. Under Preferences ▸ Problem reports the Software asks before each report ("Ask", the default). You can also choose "Always" or "Never". In the current version, sending a report directly is switched off. You can save a report as a file and send it to us yourself.

What a report contains:

  • app, operating system and graphics card versions;
  • language settings;
  • the error message and where in the program it happened;
  • the last 50 commands used;
  • view settings;
  • the names and sizes of local crash dumps;
  • your comment.

What is removed first: before you see the report, the Software removes file paths (only file names are kept), your user name and computer name, e-mail addresses, licence keys and computer IDs. You see the exact text before it is sent or saved.

Your board is included only if you tick "Attach the current board". It is off by default.

Legal basis: your consent (art. 6(1)(a) GDPR). You can withdraw it at any time by choosing "Never". If you do, reports waiting to be sent are deleted from your computer. How long: we delete reports within 90 days after the problem is solved.

3.3 Update check

The Software can ask our update page whether a newer version exists: once a few seconds after it starts, and when you choose Help ▸ Check for updates…. In the current version no update address is configured, so the check is off and nothing is sent.

When it is enabled, the request carries only:

  • your IP address;
  • the standard technical headers of the request (app and system version).

It carries no licence data or identifiers.

Legal basis: our legitimate interest in giving users security and bug fixes (art. 6(1)(f) GDPR). How long: our web host keeps access logs for [30] days. [OWNER DECISION: host.]

3.4 E-mail

If you write to us, we use our e-mail provider [OWNER DECISION: provider] to receive and answer your message.

Legal basis: the contract, or our legitimate interest in answering you.

3.5 When subscriptions start

The following will apply only once paid plans start. We will update this policy before then.

  • Account and licence server. We will process:

    • your name, e-mail and country, your plan and its renewal date;
    • for the online licence check: a licence identifier, the computer ID, the app version, and the IP address of each check.

    Basis: contract. How long: while you are a customer, plus the periods in 3.1.

  • Payment through a reseller. A merchant of record (for example Paddle or Lemon Squeezy) [OWNER DECISION] will sell the subscription. It collects your payment details and handles tax as an independent controller, under its own privacy policy. We receive:

    • your name, e-mail and country;
    • your VAT number, if you give one;
    • the plan and the transaction reference.

    We never receive card details. Basis: contract and legal obligations (invoicing). How long: ten years for invoicing and tax records.

  • Service e-mails about your account or renewals. Basis: contract. We will send marketing e-mails only if you agree to them, and you can unsubscribe at any time.

4. What we do not do

  • We do not sell or rent personal data.
  • We do not use advertising or analytics.
  • We do not track you.
  • We do not make automated decisions about you.

The Software's window cannot load anything from the internet. Its content security policy allows only the files inside the app. No web fonts or content networks are used.

Links. Links you click open in your own web browser, which has its own privacy terms.

Spell checking. The Electron/Chromium engine inside the Software can check spelling in text fields. On systems where it does not use the operating system's own spell checker, it may download a dictionary for your language from Google's servers. That download reveals your IP address and language to Google.

5. Processors and transfers

We use service providers that process data for us under contract (art. 28 GDPR): our e-mail provider and our web host [OWNER DECISION: names]. When subscriptions start, the licence-server host and the reseller will be added (see 3.5).

If a provider is outside the European Economic Area, we transfer data only with a safeguard recognised by the GDPR, such as:

  • an adequacy decision (for example the EU–US Data Privacy Framework, for certified companies); or
  • the European Commission's standard contractual clauses.

6. Your rights

You have the right to:

  • access your data;
  • have it corrected or erased;
  • restrict its processing;
  • data portability;
  • object to processing based on our legitimate interest;
  • withdraw consent at any time, without affecting what was done before.

Write to legal@shaperlab.pro. We answer within one month.

You also have the right to complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the authority of your country of residence.

7. Data about other people (Shaper Advisor)

The Shaper Advisor uses details about a surfer: weight, height, age, fitness and level. If that surfer is your customer, you decide what to collect and how to use it, and you are responsible for it under data protection law. The data stays on your computer, in the Advisor log and in the board file it creates.

Before you share such a board file, or attach it to a problem report, check its notes: they may contain those details.

8. Children

The Software is a professional tool and is not directed at children. Licences and subscriptions are for adults. We do not knowingly collect data from children under 16. If you believe we have, write to us and we will delete it.

9. Security

Licences are checked offline with digital signatures, and problem reports are cleaned before you see them. We keep our licence records in a private folder that only we can access. No system is perfectly secure. We will notify the CNPD, and you where the law requires, of a personal data breach.

10. Changes

We will update this policy when the Software or our services change, in particular before subscriptions start. The Software will show you the new version. When the change is significant, it will ask you to read and accept it again.

11. Language

The English text governs. The Spanish and Portuguese versions are provided for convenience. If they differ, the English text prevails, unless the law of your country gives you the right to rely on the version in your language.