Privacy policy
Last changed: 9 October 2026
This policy explains which personal data Korpora processes, why, how long we keep it and what rights you have under the General Data Protection Regulation (GDPR).
Who processes the data
Carbon Stealth VCC, a variable capital company (VCC) under Bulgarian law, company number (EIK) 208725180, ul. Samuil 3, 2670 Bobov Dol, Kyustendil Province, Bulgaria, phone +359 877 414 874. For questions about personal data, write to privacy@carbonstealth.eu.
Which data, why and for how long
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email, name, language, password hash (Argon2id) | Your account and signing in to it | Contract, Art. 6(1)(b) GDPR | As long as the account exists; a sign-up whose email is never confirmed is deleted after 7 days |
| Your projects: furniture type, sizes, materials, project name | The service itself: model, cut list, drawings, machine files | Contract | Until you delete them or the account |
| IP address, country derived from the IP address, browser and operating system, result of each sign-in attempt — also for attempts with an email that has no account | Protecting accounts: spotting someone else's sign-in, locking after password guessing, warning about a new sign-in | Legitimate interest, Art. 6(1)(f) GDPR | Sign-in history: 180 days. IP address at sign-up: 180 days after it. Country at sign-up, IP address and country at the last sign-in: as long as the account exists. Active sessions (IP address, country, browser): until you sign out or the session expires, at most 30 days |
| The device: a hash of the device cookie and a short description (system and browser) | Recognising a known device and an email on sign-in from a new one | Legitimate interest | A device not used for 180 days is deleted; the device from sign-up for 180 days after it |
| Device fingerprint (HWID): a hash of the hardware details from the browser and a description (screen size, cores, memory, graphics card, time zone); for the same purpose, also the device cookie | Spotting repeated trials and shared accounts — only if you gave consent with the separate box at sign-up | Consent, Art. 6(1)(a) GDPR — optional; the trial does not depend on it | Until you withdraw consent — then it is deleted at once; otherwise the fingerprint from sign-up for 180 days after it, and the one from sign-ins with the device and the sign-in history, 180 days |
| Two-factor protection: secret key (encrypted with AES-256-GCM) and recovery codes (we keep only their HMAC) | A second factor at sign-in, if you turned it on | Contract | Until you turn the protection off or delete the account |
| Plan, end date, orders (option, price, whether you buy as a consumer or a business, early-start request, version of the terms, message, withdrawal from the contract), plan changes and their amounts; the invoice details you write in the order message (name or company, address and, for businesses, company and VAT numbers), and the payer's details from the bank transfer (name, account, amount) | The trial, the contract for the paid plan, payment, the invoice, activation and the right of withdrawal | Contract; legal obligation for accounting records, Art. 6(1)(c) GDPR | As long as the account exists; invoices and payment details for as long as accounting and tax law requires. If you delete the account, the orders stay with the contract details only (name, email, amount, dates, version of the accepted terms, early-start request and withdrawal from the contract), while their message and the plan changes are deleted; the orders are deleted 5 years after the account is deleted |
| Account blocking: the reason, who blocked or unblocked the account and when, the note on unblocking | Enforcing the terms and conditions (section “Blocking”) and protection in a dispute | Legitimate interest | As long as the account exists |
| Audit log: who did what and when to an account, order or project, and from which IP address | Accountability and protection in a dispute | Legitimate interest | Entries are kept for 5 years and then deleted; the IP addresses in them for 180 days, after which only a keyed hash (HMAC) of the address remains, needed to verify the integrity of the log, until the entry itself is deleted. For customers the log keeps the account number, not the email. When the team deletes an account, a SHA-256 hash of the email stays — it proves which account was deleted without keeping the address itself |
| Database backups: all the data above | Recovery after a failure or a failed software update | Legitimate interest; security of processing, Art. 32 GDPR | The daily backups are encrypted; of them we keep the newest for each of the last 14 days and for each of the last 8 weeks, and delete the older ones — deleted data disappears from them within 8 weeks at the latest. The backup made before each software update is kept until 5 newer ones exist, but no longer than 30 days. If we ever have to restore from a backup, we delete again the accounts deleted in the meantime, and the encrypted snapshot of the database taken before the restore is also kept no longer than 8 weeks |
The email, name and password are needed for an account: without them we cannot create one. The IP address, browser and device are recorded at every sign-in, because without them we cannot protect the account from someone else getting in. The device fingerprint is optional: without consent we do not compute it. Ordering a plan also needs the choices in the order — without them we cannot conclude the contract.
What “HWID” means here
Browsers do not give websites the hardware ID of your computer. So by “HWID” we mean a device fingerprint: a hash of details the browser shows to every website — platform, number of cores, memory, colour depth, touch screen and graphics card (vendor and model). Besides the hash we keep a short description: system, browser, screen size, cores, memory, graphics card and time zone (for example “Windows, Chrome 128, 1920 × 1080, 8 CPU”).
The fingerprint is computed only if you gave consent with the separate box at sign-up — it is not ticked in advance and is not a condition for the account or the trial. It is then computed at sign-up and at sign-in from a browser used only by consenting accounts, and kept on a sign-in with the correct password to such an account (also when a two-factor code is asked for after it); a wrong password keeps none. Without consent no fingerprint is computed or kept, and the device cookie serves only sign-in security — linked accounts use neither the cookie nor a fingerprint. You can withdraw consent at any time under “Security” in your account with one click; we then delete the fingerprint we keep, and device descriptions keep only system and browser. Withdrawal does not affect the lawfulness of processing before it. If JavaScript is off, signing up and signing in work without it.
Cookies
We use only cookies the service cannot work without or cannot be secured without. The one exception is the extra purpose of the device cookie — spotting repeated trials and shared accounts: for it we ask for consent with a separate box at sign-up (see the section on HWID above). We have no advertising, analytics or third-party cookies, so we show no consent banner.
| Name | Purpose | Duration |
|---|---|---|
__Host-rd_sid | Your session after signing in | Until you sign out; at most 30 days (7 days without activity), 24 hours for staff |
__Host-rd_dev | Recognising the device for sign-in security; only with consent, also spotting repeated trials and shared accounts | 180 days from the last sign-in attempt, sign-up or email confirmation |
rd_pre | Protecting the sign-in and sign-up forms against forged requests (CSRF) | 2 hours |
rd_lang | The language you chose | 1 year |
rd_flash | A one-time message after an action (for example “Saved”) | 1 minute |
Who else sees the data
- Hetzner Online GmbH, Germany — the server Korpora runs on, in a data centre in the European Union. The database backups are kept there too.
- Sendinblue SAS (Brevo), France — sending the emails listed under “Emails” below.
- Have I Been Pwned — when you choose a new password, we send only the first 5 characters of its SHA-1 hash to check whether the password has leaked in a breach. The password and the full hash never leave the server.
- The bank the transfer goes through — it receives the payment details (the payer's name and account, the amount) and processes them as a separate controller under its own legal obligations.
The country of an IP address comes from a DB-IP database (IP Geolocation by DB-IP, licence CC BY 4.0) stored on our server — the IP address is not sent anywhere. We do not sell data or share it for advertising. We do not transfer personal data outside the European Union; if a Brevo sub-processor processes data outside the EU, the transfer is protected by standard contractual clauses (Art. 46 GDPR).
Emails
We send only emails about your account and contract: confirming your email and an email change (with a notice to the old address), password reset and password change, sign-in from a new device, wrong sign-in codes, wrong passwords or codes when confirming an action in your account, turning two-factor protection on and off, a reminder 3 days before the trial ends and 7 days before Premium ends, confirmation of an order and of a withdrawal from the contract, plan changes, a notice when someone tries to sign up with your email, an email to set your password when the team creates an account for you, and confirmation that the account was deleted. We do not send marketing emails.
Automated decisions
We make no decisions with legal effects by automated means alone. After 5 wrong passwords or codes, signing in is locked for 15 minutes — a security measure that lifts by itself. If the wrong attempts happen while confirming an action in an open session, all sessions are also ended and we email you. Only a member of our team can block an account, and the reason is shown when you try to sign in.
Security
Connections are HTTPS only. Passwords are stored as Argon2id hashes, two-factor secret keys are encrypted, sessions live on the server and end at once when the password changes or the account is blocked. The admin panel opens only with two-factor protection. Application logs contain no emails, IP addresses or passwords, and the web server keeps no request log — it records an IP address only in its error log, when a request cannot be served.
Your rights
You have the right of access, rectification, erasure, restriction of processing and portability. Much of it works directly from your account:
- “Profile” — correct your name and email;
- “Data” — download all your data as a JSON file (profile, projects, plan and orders, devices, sign-ins, sessions and the audit log entries about you) and delete the account together with your projects (the orders stay with the contract details only — the periods are above);
- “Security” — active sessions, the devices used to sign in and withdrawing consent to the fingerprint.
Right to object. You may at any time object, on grounds relating to your particular situation, to the processing of your data based on legitimate interest — the sign-in history, the device, blocking and the audit log. We then stop, unless we have compelling legitimate grounds that override your interests or the data is needed for legal claims.
For anything else, write to privacy@carbonstealth.eu — we answer within one month. You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or with the supervisory authority of the EU country where you live (in Italy, the Garante per la protezione dei dati personali).
Minors
Korpora is a professional tool and is not meant for people under 16.
Changes
If we change this policy materially, we will tell you by email before the change takes effect. The date of the last change is at the top of the page.