1. Controller and contact
This notice covers the sketchup.cutlisttools.com account portal and its connected CutlistTools SketchUp extension. Public operator details appear at the top of this document. Use the contact email for privacy enquiries, access requests or account deletion.
2. Data processed
Account data includes your name, email address, password hash, registration time and the time you accepted the terms. Name, email and password are required to create an account.
Access data includes enabled or blocked status, expiry date, model-library permission and the computer username linked to extension access.
Technical data includes registration IP, latest web sign-in time and IP, web sign-in count, and latest extension use time and IP. The hosting server may also maintain access and error logs.
Optional billing data includes billing name and address, company name and tax identifiers. The current account portal does not automatically initiate payments or issue invoices.
Processing requests may transmit part names, dimensions, material names, edge banding, fittings and layout or shape data to the server. Endpoints use these requests to prepare their response; the reviewed code does not save the entire SketchUp model. Do not submit personal or confidential information that is unnecessary for the calculation.
3. Purposes and legal bases
Creating an account, providing requested access and processing calculations relate to delivering the service; the proposed legal basis is GDPR Article 6(1)(b).
Computer linking, sign-in limits and security data protect the service and accounts and help investigate misuse. The proposed basis is the operator’s legitimate interest under Article 6(1)(f); the final interest assessment and retention arrangements still need documenting.
The registration checkbox records acknowledgement of the privacy notice and acceptance of the terms. It is not general marketing consent. The new registration form does not automatically subscribe users to a newsletter.
4. Retention and deletion
Account and access data is retained on the basis of the account and service relationship continuing. When an account ends, further retention must be assessed separately; information required for legal obligations or specific legal claims may need separate retention. Account deletion can be requested from the administrator; it is not an automatic self-service feature.
The web activity table stores the latest successful sign-in and a counter, rather than a complete history. Extension usage fields also store the latest use.
Authentication attempts older than 15 minutes are removed during the next authentication attempt. Optimizer sessions are valid for at most one hour; deletion arrangements for these records, server logs and backups still need finalising.
5. Cookies and sessions
The portal uses server-side sessions and necessary session cookies for sign-in, language selection and form protection: CLTNext_User, CLTNext_Superadmin and CLTNext_Snapin. Superadmin and public-user sessions are separate.
These are session cookies. Superadmin sessions expire after 20 minutes of inactivity or at most eight hours. The reviewed portal code contains no analytics or advertising tracking code. External websites opened separately may have different privacy practices.
6. Recipients, hosting and transfers
The service administrator manages account data. Hosting personnel may access technical information when operating the infrastructure. The hosting provider, processing location, any additional processors and details of international transfers still need to be supplied.
Server processing and external resources used in PDFs must be reviewed alongside the final processor list. This draft does not claim that all information is located exclusively in Hungary or the EU.
7. Your rights and complaints
Subject to applicable conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests. Consent for any separate consent-based processing may be withdrawn. Requests generally require a response within one month; complex cases may justify an extension.
You can complain to the competent data protection authority. In Hungary this is the National Authority for Data Protection and Freedom of Information (NAIH); current contact information is available at naih.hu. Judicial remedies may also be available.
8. Completing this draft
The Hungarian operator address, registration and tax information, hosting details, retention arrangements and necessary processor safeguards are still being confirmed. This document describes the reviewed software and provides an editable starting point; it is not a final compliance document.