1. Introduction
TechSavy SL (we, us, our) operates a SaaS suite designed for CNC workshops. This Privacy Policy explains what personal data we collect, how we use it, and what rights you have under the EU General Data Protection Regulation (GDPR). It applies to all visitors of our website and all users of our ERP 4 CNC and CPQ 4 CNC products.
By using our services you confirm that you have read and understood this policy. If you do not agree with how we handle your data, please do not use the service. We may update this policy from time to time; the last revision date is shown above and we will notify active users by email when material changes occur.
2. Data we collect
When you create an account we collect your name, work email, company name and country. When you use the product we collect quotes, parts, machine configurations and other project data you upload — this content belongs to you and we process it only to deliver the service. We collect basic telemetry (page views, error reports, performance metrics) to keep the platform reliable.
We do not buy data from third parties. We do not run cross-site advertising trackers. Payment information is collected and processed by Lemon Squeezy, our merchant of record (PCI-DSS Level 1, powered by Stripe) — we only ever see the last four digits of your card and the billing country.
3. How we use data
Account and project data are used to operate the service: authenticating you, rendering the dashboards, computing quotes and storing your files. Billing data is used to charge your subscription and produce invoices. Anonymous telemetry helps us prioritise the next bug fix or feature.
We will email you about service incidents, security advisories and material changes to our terms. Marketing emails (newsletter, product announcements) are opt-in and unsubscribable in one click.
4. Legal basis (GDPR)
Under Article 6 GDPR we rely on the following legal bases: (a) performance of the contract you sign when subscribing — this covers account, project and billing data; (b) legitimate interest for fraud prevention, security and product analytics, balanced against your reasonable expectations; (c) explicit consent for marketing emails and non-essential cookies.
Where we rely on consent you can withdraw it at any time without affecting the lawfulness of prior processing. Where we rely on legitimate interest you have the right to object — see Section 6.
5. Data retention
Active account data is retained for as long as your subscription is active. After cancellation, your project files remain accessible in read-only mode for 60 days, then are scheduled for permanent deletion. Billing records are retained for the statutory 6 years required by Spanish tax law.
Anonymised telemetry has no retention limit but cannot be linked back to your identity. Support tickets are retained for 24 months from the last message, then archived in encrypted cold storage for an additional 12 months.
6. Your rights
Under GDPR you have the right to: access your data, request correction of inaccurate data, request erasure (right to be forgotten), restrict or object to processing, request portability of your data in a structured machine-readable format, and lodge a complaint with the Spanish AEPD or your local supervisory authority.
To exercise any of these rights, email dpo@techsavysl.com from the address registered on your account. We respond within 30 days. For complex requests we may extend this by an additional 60 days as permitted by Article 12 GDPR and will tell you so within the first 30 days.
7. International transfers
Our production infrastructure is hosted in the European Union (Frankfurt and Madrid regions). Backups are encrypted and stored within the EU. Some subprocessors (e.g. error monitoring, transactional email) operate outside the EU — in those cases transfers are governed by the European Commission's Standard Contractual Clauses (2021/914) and supplemented by technical measures such as end-to-end encryption.
The subprocessors we currently rely on are:
- Lemon Squeezy — payment processing, subscription billing and invoicing, as Merchant of Record.
- Hostinger — website and application hosting, and database storage, within the EU.
- Our transactional email provider — delivery of account and billing emails (welcome, password reset, notifications).
We will give 30 days' notice before adding a new subprocessor that has access to customer data. A Data Processing Agreement (DPA) compliant with GDPR Article 28 is available to business customers on request at dpo@techsavysl.com.
8. Contact our DPO
TechSavy SL has appointed a Data Protection Officer to oversee compliance with this policy and applicable data protection law. Reach the DPO at dpo@techsavysl.com or by post to our registered office in Castellón, Spain.
If you are not satisfied with our response, you may complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es) or the supervisory authority in your country of residence.