LASVIEWER / LEGAL
Privacy Policy
LasViewer processes point clouds entirely on your own device. Your files, coordinates, projects and filenames are never transmitted to us: there is no storage for them on our side and no code that would send them. The only data that leaves your device is what licensing and billing of the Android direct edition cannot work without, plus whatever you type into the contact form yourself. There is no analytics, no advertising tracker, no usage counter and no automatic crash reporting in the product.
1. Who controls the data
The controller is IE Dmitri Predeyn, Apt. 105, Building 3, 1st Microdistrict, Gldani, Tbilisi, Georgia. Privacy questions, consent withdrawal and deletion requests may be sent to [email protected]. We respond within the period required by the law that applies to you.
2. Scope
This policy covers four different situations, and the amount of data differs in each.
- The lasviewer.com website and browser demo. Static pages and a demonstration viewer running on point clouds we prepared. The demo does not accept your own files and uploads nothing to a server.
- The contact form. The only place on the website where you voluntarily give us your details.
- LasViewer for Android (direct edition). The only build that contacts our licensing server, and only for account activation, signed entitlement refresh, management of up to two devices, sign-out and Paddle billing.
- LasViewer for iOS and macOS from the App Store. These editions have no LasViewer account and never contact our server: the subscription is verified on the device through Apple StoreKit. Purchases, refunds and the related data are governed by Apple's notices.
3. What never leaves your device
This is a property of the product architecture rather than a statement of intent: neither the code nor the server-side storage for it exists. LasViewer never sends us, and never uploads anywhere:
- point clouds or any fragment of them —
.las,.laz,.e57,.ply, the internal.lvocformat or any other; - point coordinates, bounding boxes, the geographic centre of a project, coordinate reference systems, rasters, vectors or terrain models;
- local filenames and paths, project names or layer names;
- device location or GPS/GNSS data — the app never requests a location permission;
- which tools you use or how often you use them;
- crash reports and diagnostic logs — Sentry, Firebase Crashlytics, Firebase Analytics, Google Analytics, PostHog and any equivalent are not used in the product and are not planned.
The signed entitlement that the server issues to the Android app carries, by contract, no email address, no personal name and no Paddle identifier: only opaque identifiers, subscription state and validity dates.
4. Information we receive
| Category | What it includes | Where it is stored | Purpose |
|---|---|---|---|
| Contact form enquiry | First name, last name and email are required; company, phone, platform and message are optional. Plus the page language, a submission identifier and a timestamp. | A Cloudflare D1 database, with a copy emailed to our service mailbox. | Answer your request. |
| Consent records from the form | Acceptance of the legal documents, the separate marketing checkbox, the version of the consent text, the locale and the time. | Cloudflare D1. | Evidence of which text you accepted and when. |
| Form abuse prevention | A Cloudflare Turnstile token and the sender's IP address are passed to Cloudflare for verification. We store only the "verified" outcome; the IP address is not written to our database. | Processed by Cloudflare, not retained by us. | Keep automated submissions out of the form. |
| Account verification (Android direct only) | Normalized and display email, verification time, locale, accepted document versions, the hash and expiry of the one-time confirmation link, and the last-seen time. The link itself is never stored in plaintext. There is no password. | Cloudflare D1. | Passwordless sign-in and binding of the licence to an account. |
| Device and activation (Android direct only) | The device binding hash, the installation device public key and its SHA-256 thumbprint, the device signature, the PKCE challenge, hashes of the activation state and one-time activation code, hashes of the refresh credential and of one-time nonces, opaque account, licence and device identifiers, the platform marker, a generic device label, and activation and last-seen times. | Cloudflare D1. | Issue the signed offline entitlement and enforce the limit of two active devices. |
| Trial | Status, start and end dates, and a marker that a device has already consumed a trial. | Cloudflare D1. | Exactly one trial per account and per device. |
| Subscription and billing | Paddle customer, subscription and transaction identifiers, plan, status, amount and currency, period and next-billing dates, the cancellation flag, and bookkeeping records of Paddle events: event identifier and type, time and a hash of the notification body. | Cloudflare D1. | Grant and renew access, handle cancellation, refunds and payment disputes. |
| Service email | Recipient address, locale, message content (plan, amount, renewal date, management link) and delivery status. | Cloudflare D1 and Cloudflare email infrastructure. | The mandatory renewal warnings seven days and 24 hours ahead, and sign-in confirmation. |
| Connection technical data | IP address, browser version and request headers are processed by Cloudflare infrastructure to deliver the page and repel attacks. | Processed by Cloudflare. We keep no access logs of our own and write no visitor IP addresses into our databases. | Availability and security of the website. |
About the Android device identifier. What reaches the server is not the identifier itself but an irreversible SHA-256 hash of a LasViewer domain separator, the application package name and the app-scoped ANDROID_ID. The raw ANDROID_ID is never received or stored by the server. Device model and manufacturer, Android version, application version, IMEI, serial number and advertising identifier are not transmitted at all: each device slot in the account is labelled generically, without a model name.
About logs. We keep no access logs of our own. The technical error messages our code emits carry only a submission identifier and an error code — no name, address or message text.
About billing. Paddle acts as merchant of record. Card details, billing address, tax status and payer country are handled by Paddle under its own notice — we neither receive nor store them. You type your email into the Paddle checkout directly; the application does not pass it there.
5. Legal bases
- Performance of a contract and steps taken at your request before one — activation, licensing, subscription, and answering a contact-form enquiry.
- Legitimate interests — protecting the service against automated abuse, enforcing the device limit, preventing repeat trials, and resolving payment disputes.
- Legal obligation — retention of billing and tax records, and the mandatory advance renewal warning.
- Consent — marketing email only. The checkbox is off by default and independent from the required acceptance of the legal documents.
6. Cookies and local storage
There are no advertising cookies, no page counters and no behavioural analytics. There is no cookie banner because only strictly necessary mechanisms are used.
- Strictly necessary activation cookies. During Android direct activation the site sets short-lived technical cookies marked
HttpOnly,SecureandSameSite=Lax. Their lifetime is capped at 15 minutes for the activation context and 30 minutes for the browser session. They are not used for cross-site tracking. - Cloudflare protection. Turnstile and attack protection may use short-lived technical storage necessary to deliver and defend the site.
- Browser demo local storage. Your chosen language and chosen demo cloud are kept in your own browser (
localStorage/sessionStorage) and are never sent to a server. Clearing the site data removes them.
7. Service providers and international processing
- Cloudflare — website hosting, serverless functions, D1 databases, Turnstile, outgoing service email, and the R2 bucket that serves our own demonstration point clouds. No user files are held in R2.
- Paddle — merchant of record: checkout, tax, payment and the customer portal for managing a subscription.
- Apple — distribution and payment for the iOS and macOS editions, under Apple's notices.
Providers may process data outside your country of residence; such transfers rely on the applicable contractual and legal safeguards. We do not sell personal information and do not share it for advertising profiling.
8. Retention
- Email confirmation link — 15 minutes; activation session — 15 minutes; browser activation session — 30 minutes; the one-time activation code — 5 minutes, and it is consumed on first use.
- Licence refresh credential — up to 400 days, revoked immediately on sign-out or device deactivation.
- Account, device and subscription records — for as long as the account exists; after account deletion they are erased or anonymized.
- Contact-form enquiries — no longer than 24 months after the last meaningful interaction.
- Consent records and accepted document versions — up to five years after last use, as evidence that processing was lawful.
- Billing records — for the period required by tax, accounting and consumer law and by payment-dispute rules.
Expired material loses effect immediately and cannot be reused; physical deletion follows during database maintenance or on your request.
9. Your rights
Depending on where you live, you may request access, correction, deletion, restriction of processing, portability, or object to processing, and you may withdraw consent at any time. We do not restrict your use of the service for exercising these rights, and we may ask for reasonable information to confirm that a request comes from the data subject.
You may complain to a supervisory authority: in Georgia the Personal Data Protection Service of Georgia, in the European Economic Area your national authority, and in the United Kingdom the ICO.
10. Marketing messages
The marketing checkbox in the form is off by default, optional, and has no effect on your ability to contact us or use the product. You may withdraw consent at any time by replying to a message or writing to [email protected]. Withdrawal does not affect processing that was lawful beforehand. Mandatory service email — sign-in confirmation and advance renewal warnings — is not marketing and is sent regardless of this checkbox.
The Android application may additionally show the upcoming-renewal warning as a system notification. It is composed on the device itself from dates the app already holds and sends nothing to us. The notification permission is optional, and refusing it affects neither your licence nor your access.
11. Security and automated decisions
We use encryption in transit, separation between production and preview environments, data minimization, and hashing of sensitive values. No system is perfectly secure, but the architecture itself bounds the damage: your files and coordinates are not in our systems at all.
We make no automated decisions producing legal or similarly significant effects on you. The only automated checks are technical: validity of the device signature, entitlement expiry, payment state, and the two-device limit. Any of them can be disputed by writing to us.
12. Age of users
LasViewer is a professional tool for laser-scanning data, and the apps themselves contain nothing that calls for an age restriction: they work offline and send us no data at any age. An age limit applies only where we receive data or enter into a contract with you — the contact form, a LasViewer account and a paid subscription for the Android direct edition. Use those on your own only if the law that applies to you allows you to enter into a contract; where that law sets an age of consent for online services (13 to 16 in the EU, depending on the country), a parent or guardian acts for anyone below it. We do not knowingly collect children's data; if you believe a child has provided us with data, write to [email protected] and we will delete it.
13. Account and data deletion
Write to [email protected] from the account address with the subject "LasViewer account deletion". We may send a one-time confirmation link to establish that the request comes from the address owner. We then deactivate devices, revoke issued credentials, erase or anonymize account data, and confirm completion. Deleting the account ends access to paid features but does not by itself cancel a subscription — cancel it in the Paddle customer portal, or tell us so in the same message.
Minimal billing records, consent evidence and records needed to prevent abuse or resolve disputes may be retained where the law requires it.
14. Changes to this policy
When this policy changes we publish a new version and effective date in the header above. The document version you accepted at activation or checkout is recorded together with the time of acceptance, so it can always be established which text applies to you.
15. Contact
For privacy questions, consent withdrawal, deletion or any other rights request, email [email protected].