What we keep,and why.

This notice covers plurafusion.com, the application for the PluraFusion closed beta, your PluraFusion account and the services behind it — account.plurafusion.com, api.plurafusion.com and view.plurafusion.com — and what the PluraFusion application sends over the internet. The files you work on in the application stay on your computer unless you use a feature that sends something; each one is described here.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is Benjamin Tanzer, PluraFusion, Bienerstraße 20, 6020 Innsbruck, Austria — see the Impressum. Write to office@plurafusion.com about anything on this page, or to beta@plurafusion.com about your beta application.

We have not appointed a data protection officer. The GDPR requires one only of public bodies and of businesses whose core activity is large-scale monitoring of people or large-scale processing of special categories of data (Art. 37 GDPR); neither applies to us.

When you visit this site

This site is a set of static pages served by Cloudflare. When your browser asks for a page, Cloudflare necessarily receives your IP address, the time, the address of the page and what your browser sends with every request — such as its type and version, your operating system and language, and the page you came from. Cloudflare uses this to deliver the page and to protect the site against attacks, and keeps it in its logs for a limited time.

Legal basis: our legitimate interest in delivering the site and keeping it secure (Art. 6(1)(f) GDPR).

This site uses no analytics, no tracking, no advertising and no social-media plug-ins, and it sets no cookies. Its fonts, pictures and films come from this site itself. Apart from the bot check on the beta form (below), reading these pages contacts no one else.

What is stored in your browser

On this site: no cookies — two small entries in your browser's own storage. Nothing in them is sent to us.

• pf-theme, in local storage: only once you use the light/dark switch. It remembers your choice (light or dark) on this device until you clear this site's data in your browser.
• pf-intro, in session storage: on the home page, so the opening animation plays once per visit. Your browser deletes it when you close the tab.

Neither needs your consent: each serves only a function of the site you are using (§ 165(3) TKG 2021).

On the account page and in the browser viewer (account. and view.plurafusion.com) there are two cookies, both only for signing in:

• pf_session: set when you sign in, so that you stay signed in — for 30 days, or until you sign out. It holds a random key; we store only a fingerprint (hash) of it. It is valid on every plurafusion.com address so that one sign-in works for the account page and the viewer; your browser therefore also sends it to this site, which does not use it.
• pf_oidc: only while you sign in with Google or Microsoft, for at most 10 minutes. It makes sure the sign-in comes back to the browser that started it.

The browser viewer also keeps its settings and your working state in this browser's own storage: the name you show in shared projects, the address you last signed in with, the last team you opened, a short random id for this browser, edits not yet sent while you are offline, which version of a project you last looked at, and drawings you keep in the browser. They reach us only as part of using the viewer — your name and your edits, when you work in a shared project.

None of these needs your consent either: each is needed for a service you asked for (§ 165(3) TKG 2021).

When you apply for the closed beta

What you give us

• Required: your name, your email address, the field you work in, and that you accept the beta terms.
• Optional: your company, the workspaces you would test, your graphics card, your website, a few words about your work, and whether you also want the monthly build log.

What we add

When you applied and when you confirmed, which version of the beta terms and of this notice you agreed to, our decision and the wave we invite you to, and any notes we make while reviewing your application.

Why, and on what basis

To review your application and, if you are in, to run the closed beta with you. Legal basis: steps taken at your request before taking part in the beta (Art. 6(1)(b) GDPR). The required fields are needed to apply; without them we cannot consider an application. Everything else is up to you.

How it works

1. When you start filling in the form, the page loads Cloudflare Turnstile, a check that tells people from bots (see bots and abuse).
2. When you send the form, it goes to api.plurafusion.com, our service on Cloudflare Workers, which stores it in a database that Cloudflare runs and keeps within the European Union.
3. We email you a link. It opens a page with a button, and only pressing that button confirms your application — and the build log, if you asked for it. If you do not confirm, the application is deleted after 7 days.
4. Once you have confirmed, we receive an email with your application. Mail to plurafusion.com addresses — this notification, and anything you write to us — is forwarded by Cloudflare Email Routing to the operator's mailbox at Google (Gmail).
5. We read every application ourselves; nothing is decided automatically. We email you our decision.

If the form is sent again for an address that has already applied, nothing changes, and that address gets at most one short note a day saying we already have the application.

Our emails are sent through Cloudflare Email Service. For each one we keep the address it went to, its subject, the time and whether it was sent, together with your application — not its text.

Your account

Your PluraFusion account holds your beta licence, your computers, your reports and your teams. In the closed beta, only an address whose application we approved can have one.

What we keep

• Your email address and your name. The name is what you enter, or what Google or Microsoft tell us if you sign in with them; you can change it on the account page.
• When the account was created and when it was last used.
• If you sign in with Google or Microsoft: which of the two, and the identifier it gives your account there — not your password, and no access to anything in that account.
• Your sign-ins: for each browser and each copy of the application that is signed in, when it started, when it was last used and a label — the kind of sign-in, or for the application the name it gives itself, “PluraFusion on” followed by your computer's name. The sign-in keys themselves are never stored, only fingerprints (hashes) of them.

How signing in works

• By email: we send a link that works once, for 15 minutes. An address that is not in the beta gets a short note instead, so the form tells no one who is in. Every mail is recorded as described under applying.
• With Google or Microsoft: your browser goes to their own sign-in page. They tell us your email address, whether they have verified it, your name and the identifier of your account there; we accept the address only if they have verified it. That sign-in itself is between you and Google or Microsoft, under their privacy policies (see who else).
• In the application: it shows a code and opens account.plurafusion.com/device, where you confirm it. Until the code is used or expires — 10 minutes — we keep it with the application's label and the country the request came from, which Cloudflare derives from the IP address, so that the page can warn you if the request came from another country than you are in.
• A browser stays signed in for 30 days, the application for 180 days, unless you sign out. The account page lists every sign-in, and you can end any of them there.

Why, on what basis, and where

To give you the account and the beta you take part in (Art. 6(1)(b) GDPR). The single-use links, the country warning and the rate limits protect your account from misuse: our legitimate interest in keeping accounts secure (Art. 6(1)(f)). Everything is stored in our database at Cloudflare, kept within the EU.

Your licence and your computers

Your beta licence lives in your account. When you sign in to the application, it asks for a certificate: a small file, signed by us, that lets that computer use the beta, offline too.

• What the application sends: an identifier for the computer, a label for it and the application's version. The identifier is calculated on your computer from the identifier Windows gives its installation, by a one-way function (SHA-256); the Windows value itself never leaves your computer. It stays the same for that Windows installation, so we treat it as personal data.
• What we keep for each computer: that identifier, the label, the application's version, and when it first and last asked — for up to 3 computers per account.
• The certificate names your account's internal number, the edition, the computer's identifier and its dates. It stays on your computer.
• While you are signed in, the application renews the certificate regularly. If it cannot for 14 days, it runs as the free Viewer until it can.
• The account page shows your computers. Remove one there and it gets no new certificate: at its next check it falls back to the free Viewer.

Legal basis: providing the beta licence you take part with (Art. 6(1)(b) GDPR). Stored in our database at Cloudflare, within the EU.

Reports, crashes and feedback

The application has a Feedback button for problems and ideas, and after a crash it can offer to send a crash report. Nothing is sent until you press Send, and both dialogs show exactly what will be sent before you do.

What a report contains

• What you write: a title, what happened, the steps, what you expected.
• The application's version and build.
• Your system: Windows version, number of processor cores, memory, graphics card, its driver, its Vulkan version and video memory, and the render quality and stereo mode in use.
• The end of the session's log, at most 48 KB. Before it leaves your computer, the application replaces your Windows user name, your computer's name and your home folder in it. A problem report includes it unless you untick it; an idea does not.
• With a report you write: a screenshot of the application's window, attached unless you remove it.
• With a crash report: what the application was doing, how long it had been running, the error, anything you add, a longer log file (up to 2 MB, cleaned in the same way) and a crash dump — a snapshot of the application's memory at the moment it stopped. A crash dump is not cleaned. It can contain fragments of anything the application had open: file and folder names, your user name and parts of your data.
• Your email address, only if you allowed us, in the application's privacy settings, to write to you about your reports.
• If you are signed in, the report belongs to your account and appears on your account page. If not, it carries an install identity: a random number, not derived from your computer, that the application creates when you turn crash reports on — or, without one, for that single report. You can see, copy and reset it in the application's settings.

We add a reference (PF-…), a status, the version that fixed it and our own notes.

Why, and on what basis

• Crash reports: your consent (Art. 6(1)(a) GDPR). Crash reports are off until you turn them on; even then the application asks after each crash whether to send that report. You can turn them off in the application's settings at any time.
• Problems and ideas you send: to run the beta with you (Art. 6(1)(b)). Sent without an account: our legitimate interest in fixing what you reported (Art. 6(1)(f)).
• Being written to: if you are signed in, we may email your account address about your report, and always do when it is fixed (Art. 6(1)(b)). Without an account, only if you gave us an address for that (Art. 6(1)(a)).

Where it goes

Reports go to api.plurafusion.com and are kept in our database; screenshots, crash dumps and log files in Cloudflare's file storage (R2). Both stay within the EU. Only we read them, and our replies go out through Cloudflare Email Service. No other crash-reporting service is involved.

Updates and downloads

• The update check: once you have answered the application's privacy question, it asks api.plurafusion.com at each start whether there is a newer version. It sends its own version number and its update channel (stable, beta or dev); if you are signed in, the request also carries your sign-in, which the check does not use. Apart from the technical logs, we keep nothing about it. You can switch the check off in the application's settings, under Updates.
• The solver check: if you installed the photogrammetry solver COLMAP through the application, the application also asks GitHub, at most once every six hours, which version of it is the newest. GitHub (GitHub, Inc., USA) then receives your IP address, under its privacy statement. The same switch turns this off.
• Downloads: installers come from api.plurafusion.com, and only to a signed-in account with a beta licence — on the account page or through the application's updater. Apart from the technical logs, we do not record who downloaded what.

Legal basis: for the checks, our legitimate interest in keeping your copy of PluraFusion working and secure (Art. 6(1)(f) GDPR) — switching them off is your objection; for downloads, providing the beta (Art. 6(1)(b)).

Teams, shared projects and live sessions

Every account has a team of its own. You can invite others into it, be invited into theirs, publish projects from the application and share them.

• Teams: the team's name, its members and their roles, and open invitations — the invited address, the role, who invited and until when. Each invitation is sent by email.
• Projects: what you publish — the project's files (models, point clouds, pictures and whatever else you put in) and its versions, with their names and messages, who published them and when. The files are kept in Cloudflare's file storage (R2), the rest in our database; both within the EU.
• Share links: who made a link, its role, label and expiry, an optional password (kept only as a hash), an optional list of allowed addresses, a watermark text, and how often it was opened. Anyone with a link can open what it shares, within the limits it was given.
• Comments: the author's name (a guest who came through a link types one), the text, where in 3D it is pinned and the view it was made from, its status, assignee, due date and labels, and an optional picture.
• Activity: a feed of what happened in the team — who published, commented or shared what.
• Live sessions: when people open a project together, everyone in it sees your name, a colour, where you are looking and what you select; this is passed on, never stored. Edits are kept as a change log, so that people who join later or were offline catch up. Cloudflare keeps that log within the EU, like our database and file storage.
• Direct connections: for streaming between devices, the application and the viewer may connect directly to each other, which shows each device the other's IP address. Where that is not possible, Cloudflare relays the connection. A session shared with a code passes messages on only; it ends after at most 24 hours and keeps nothing.
• Webhooks: a team's admins can send its activity — names and short summaries, which can quote the first words of a comment — to a service the team chooses, such as Slack or Microsoft Teams.

Members of a team see its projects, comments and activity, with the members' names; people with a link see what the link allows, names on comments included.

Legal basis: for account holders, providing the team features you use (Art. 6(1)(b) GDPR); for a guest who opens a link, our and the team's legitimate interest in letting a team share its work with the people it chooses (Art. 6(1)(f)).

What the application sends by itself

The PluraFusion application has no analytics and no usage reporting. By itself it sends only the update check and, if you installed the solver, the solver check (both under updates). While you are signed in, it also keeps your sign-in and your licence up to date.

Everything else happens only when you use a feature that needs it: sending a report, signing in, publishing or sharing a project. A few features fetch from services you choose — map and world tiles, place search, an online AI provider for the assistant, downloads of optional tools. Each runs only when you turn it on or use it, and connects from your computer straight to that service, under its terms; we receive nothing from them.

Protection against bots and abuse

• Cloudflare Turnstile loads only once you start filling in the form. It reads technical signals from your browser — your IP address, browser and connection characteristics (user agent and TLS fingerprint) and which site the check runs on — to tell people from bots. Cloudflare does this for us as our processor. According to its Turnstile Privacy Addendum, Cloudflare also uses these signals as a controller in its own right, on its legitimate interest, to improve its bot detection.
• Rate limits: our services use your IP address to limit how many requests — forms, sign-in mails, reports, live sessions — can be made per minute, and pass it to Turnstile for the beta form's check. They do not store your IP address, with your application or anywhere else.
• Technical logs: Cloudflare keeps our services' error messages, and the notes they write about their own work (such as how many old records the nightly clean-up removed), for at most 7 days. We write no email addresses and no page addresses into them, so no sign-in or share link ends up there.
• Our own admin pages, where we read applications and reports, are open only to us: Cloudflare Access checks our identity before anything there loads.

Legal basis: our legitimate interest in protecting the form and our systems from abuse and spam (Art. 6(1)(f) GDPR). The check is needed to send the form you asked to send, so it needs no separate consent (§ 165(3) TKG 2021).

The monthly build log

If you tick the box, we also send you a monthly email about the builds. It is optional and separate from the beta. Legal basis: your consent (Art. 6(1)(a) GDPR; § 174(3) TKG 2021), which you give by ticking the box and confirm with the same email link.

You can withdraw it at any time, through the link in every build log or by writing to us; this does not affect what was sent before. We use your address for it until you withdraw or your application is deleted.

Who else handles your data

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — hosts this site and runs all our services: the beta form and its bot check, accounts and sign-in, our database and file storage, live sessions and their relay, the access check on our admin pages, and sending and forwarding our email. Cloudflare is our processor under its Data Processing Addendum.
• Google — hosts the operator's mailbox (Gmail), which receives the notifications about applications and any email you send to a plurafusion.com address. If you choose “Continue with Google”, Google also handles that sign-in, under its privacy policy.
• Microsoft — only if you choose “Continue with Microsoft”: Microsoft handles that sign-in, under its privacy statement.
• GitHub — only the solver check described under updates.
• People you share with — members of your teams, people you give a link, and services your team connects by webhook — see what you share with them, your name on comments, versions and in live sessions included.

We do not sell your data, and we do not share it with anyone for advertising.

Outside the EU. Cloudflare's network is worldwide and Google may store mail outside the EU, so your data can be processed in the USA. Cloudflare, Inc. and Google LLC are certified under the EU–US Data Privacy Framework, for which the European Commission decided on 10 July 2023 that it ensures an adequate level of protection. Cloudflare's addendum adds the EU Standard Contractual Clauses as a fallback. Our database, our file storage and the change log of live sessions stay in the EU.

How long we keep it

Your rights

You can ask us for access to your data (Art. 15 GDPR) and have it corrected (Art. 16) or deleted (Art. 17); restrict how we use it (Art. 18); receive it in a portable format (Art. 20); and object to processing based on our legitimate interests (Art. 21). Where you gave consent, you can withdraw it at any time (Art. 7(3)). Write to office@plurafusion.com.

Much of this you can do yourself:

• The account page (account.plurafusion.com) shows your computers, your sign-ins and your reports. There you can remove a computer, sign out anywhere, change your name — and delete your account. That deletes your account, your sign-ins, your computers, the reports you sent while signed in (with their screenshots, crash dumps and logs), our record of the mails sent to your account, and the teams you own alone with their projects. A team you share with others passes to one of them.
• It does not delete your beta application (with the mails about it), reports sent without an account, or what you wrote in other people's teams (your comments there keep your name). Write to us for those.
• In the application's settings you can turn crash reports and the update check off, withdraw permission to write to you, and reset your install identity.
• A copy of your data in a portable format (Art. 20): on request by mail. There is no export button yet.

If you think we handle your data unlawfully, you can complain to the Austrian data protection authority, or to the authority of the EU country where you live or work:

Changes

When what we do changes, we update this page and its date. The version you agreed to when you applied is stored with your application.