Privacy Policy

Last updated 20 October 2026

This policy explains what personal data Lampcaster collects, why, who else sees it, how long we keep it, and what rights you have. We collect as little as we can. We don't run ads, we don't use analytics or tracking cookies, and we don't sell your data.

1. Who is responsible

The controller of your data under the EU General Data Protection Regulation (GDPR) is:

Niyazi Suluoba
Donáti utca 16.
1015 Budapest
Hungary
[email protected]

Lampcaster is run by one private individual. There is no data protection officer; write to the address above about anything in this policy.

2. What we collect and why

Data	Why	Legal basis (GDPR)
Account: e-mail address, the name you give (optional), your password if you set one (stored only as a salted scrypt hash, never in readable form), plan, plan requests, the terms version you accepted, and when you signed up and last logged in.	To create and run your account and let you log in.	Contract, Art. 6(1)(b)
Sign-in with Google or Facebook (only if you choose it): from Google, your Google account ID, name, e-mail address and whether Google has confirmed that address; from Facebook, your app-scoped Facebook user ID, name and e-mail address (the `public_profile` and `email` permissions). We don't receive your password, and we don't ask for or receive your friends, posts, photos or anything else. We never post on your behalf.	To create your account or log you in without a password, and to recognise you the next time you sign in that way.	Contract, Art. 6(1)(b)
Sessions: a random login token (we store only its hash), the IP address and browser name it was created from, and when it expires.	To keep you logged in, and so we can spot and stop misuse of an account.	Contract, Art. 6(1)(b); our legitimate interest in security, Art. 6(1)(f)
Your artwork: the SVG file you upload and your settings.	To generate your lamp. The file, and the result made from it, are kept only in the server's memory while your design waits its turn and is generated, and are discarded once the result has reached you (at most 10 minutes after the generation ends), unless you save it as a project: then the SVG, its file name and your settings are stored with your account so you can open the design again. We don't look at your artwork or use it for anything else.	Contract, Art. 6(1)(b)
Usage log: for each generation, the time, how long it took, whether it worked (and the error if not), the file's name and size, and the number of sheets.	To apply the generation limit of your plan, and to find and fix problems with the generator.	Contract, Art. 6(1)(b); legitimate interest in running a reliable service, Art. 6(1)(f)
Server logs and abuse protection: IP address, time and address of each request; failed log-in attempts per IP address and e-mail.	To keep the Service secure, block password-guessing and fix faults.	Legitimate interest in security, Art. 6(1)(f)
Messages: what you write when you e-mail us.	To answer you.	Contract or legitimate interest, Art. 6(1)(b)/(f)
Payments: name, billing country and address, what you bought and when, and your subscription's status. Polar (section 4) runs the checkout; card details go straight to it, and we never see them.	To take payment and keep the accounting records the law requires.	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)

You don't have to give us any of this, but without an e-mail address (with a password, or a Google or Facebook sign-in) we can't create an account, and without your artwork we can't generate a lamp. We don't make decisions about you by automated means that have legal or similarly significant effects.

3. Cookies and local storage

We use one cookie, sbx_session, which keeps you logged in. It is strictly necessary, lasts up to 30 days, and is deleted when you log out. When you choose "Continue with Google" or "Continue with Facebook", a second cookie, sbx_oauth, holds a random check value for up to 10 minutes so the reply from Google or Facebook can be matched to your browser; it is deleted as soon as you are signed in. Your browser also keeps your studio settings and layout preferences in its local storage, on your device only; they are never sent to us. Because we only use what is strictly necessary for the Service you asked for, we don't need to ask for cookie consent, and there is no cookie banner.

4. Who else receives data

We don't sell or rent personal data, and we don't share it with advertisers. These providers handle data for us or are involved when your browser loads the website:

Server hosting: our own server in Budapest, Hungary (EU), run by us. Your account data and logs are stored on this server.
Cloudflare Inc. (USA) runs lampcaster.com's network: your browser connects to Cloudflare, which passes each request on to our server through an encrypted tunnel and the answer back. To do that it handles your IP address, browser details and what you send and receive, including uploaded artwork, and keeps short-lived request logs. It doesn't store your account data.
Purelymail (USA) sends our e-mails (account activation, welcome and the messages we write to you) and keeps our mailbox. It handles your e-mail address, your name and what the e-mail says.
Polar (polar.sh, Polar Software Inc., USA) sells the paid plans as our reseller (Merchant of Record): it runs the checkout, takes the payment, charges VAT and issues your invoices. It receives your e-mail address and our account number for you, plus what you give it at checkout; it tells us your plan, what you paid and when. Its own privacy policy covers what it does with your data.
Google (Google Ireland Ltd. / Google LLC, USA) and Meta (Meta Platforms Ireland Ltd. / Meta Platforms Inc., USA), only if you choose "Continue with Google" or "Continue with Facebook": you log in on their page, so they know you are signing in to Lampcaster, and they send us the details listed in section 2. Their own privacy policies cover what they do with your data.
Authorities, where the law requires us to share data, for example with tax authorities or in response to a valid court order.

5. Data outside the EU

Some of the providers above are based in the USA, so data such as your IP address may be processed there. The transfer is based on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for more detail.

6. How long we keep it

Account data, Google/Facebook sign-in details and usage log: as long as your account exists. When your account is deleted, all of it is deleted within 30 days.
Sessions: until you log out or the session expires after 30 days.
Uploaded artwork: not stored, unless you save it as a project. It and its result are held in memory only, and discarded once the result has reached you, at most 10 minutes after the generation finishes.
Saved projects: until you delete them in My projects, or until your account is deleted.
Server logs: no more than 30 days. Failed log-in counters: no more than one hour, in memory only.
E-mails with us: as long as needed to deal with your request, and at most 3 years after it is closed.
Payment and invoice records: as long as tax and accounting law requires (usually 5 to 10 years, depending on the country).

7. Your rights

Under the GDPR you have the right to:

get a copy of the personal data we hold about you (access);
have wrong data corrected (rectification);
have your data deleted (erasure), including deleting your whole account;
have us limit how we use your data (restriction);
receive the data you gave us in a machine-readable format (portability);
object to processing based on our legitimate interests;
withdraw any consent you've given, without affecting what happened before.

To use any of these, e-mail [email protected] from the address on your account. We'll answer within one month. You also have the right to complain to a data protection authority, in particular the one where you live or work. Ours is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

Deleting your account and data

To have your account and everything we hold about you deleted, e-mail [email protected] from the address on your account and ask us to delete it. If you signed in with Facebook and no longer have access to that e-mail, tell us the name on your Facebook account instead. We delete the account, its sign-in details, sessions, saved projects and usage log within 30 days and confirm by e-mail.

If you signed in with Facebook, you can also remove Lampcaster from your Facebook account: on Facebook go to Settings & privacy → Settings → Apps and websites, choose Lampcaster and select Remove. After that, Facebook sends us nothing more about you. For Google, open your Google Account, go to Security → Your connections to third-party apps & services, choose Lampcaster and remove its access.

8. Visitors from the USA and elsewhere

We handle everyone's data the same way, wherever they live, and give everyone the rights listed above. For residents of California and other US states with privacy laws: we collect the categories of data described in section 2 (identifiers such as e-mail and IP address, account and usage information, and commercial information once payments go live), only for the purposes described there. We do not sell personal information and do not share it for cross-context behavioural advertising. You have the right to know, correct and delete your data, and we won't treat you differently for using those rights. Because we don't track you across sites, we don't respond differently to "Do Not Track" or Global Privacy Control signals; there is nothing for them to switch off.

9. Children

The Service is not intended for children. You must be at least 16 to create an account. If we learn that we hold data about a child under 16, we will delete it.

10. Security

All traffic is encrypted (HTTPS). Passwords are stored only as salted scrypt hashes, and login tokens only as hashes, so a copy of our database couldn't be used to log in. Log-in attempts are rate-limited. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

11. Changes to this policy

We'll update this policy when the Service changes, for example when online payment goes live. The date at the top shows the latest version. If a change matters for how we use your data, we'll tell you by e-mail first.