Lapas is operated by Pro Sistemos, MB, a company registered in Lithuania ("we", "us", "our"). This Privacy Policy describes what information we collect when you use lapas.io, how we use it, and the choices you have. It applies to all users worldwide, including residents of the United States and the European Union.

1. Who we are

Data controller: Pro Sistemos, MB · Lithuania
Service: Lapas - browser-based 2D nesting software (lapas.io)
Contact: [email protected]

2. Information we collect

Information you provide

Account registration: email address and password (stored as a cryptographic hash)
Billing: payment is processed by Stripe - we never see or store your card number
Support: any information you include when contacting us

Information collected automatically

Usage data: nesting jobs run, features used, session duration, error events
Log data: IP address, browser type and version, pages visited, referring URL, timestamps
Cookies: strictly necessary cookies (login session, preferences) and analytics and advertising cookies, which need your prior consent in the EEA, UK and Switzerland and run by default with an opt-out elsewhere. See section 10 for the full list and how to opt out.

Files you upload

DXF and SVG files you upload are processed in-session to perform nesting. Files are not stored beyond your session unless you explicitly save a project. We do not use your design files to train AI models or share them with any third party.

3. How we use your information

To create and maintain your account
To perform nesting calculations and return results to you
To process payments and manage your subscription
To send transactional emails (account confirmation, password reset, billing receipts)
To respond to support requests
To monitor for abuse, security threats, and service errors
To improve the product using aggregated, de-identified usage patterns

We do not sell your personal information. We share limited usage events and hashed identifiers with our analytics and advertising partners (see sections 4 and 10) so we can measure how our campaigns perform: with your consent in the EEA, UK and Switzerland, and unless you opt out elsewhere. You can withdraw consent or opt out at any time.

4. Information sharing

We share information only in these limited circumstances:

Service providers: Stripe (payments), transactional email provider, cloud hosting - each bound by data processing agreements
Analytics and advertising partners (consent in the EEA, UK and Switzerland; opt-out elsewhere): Google (Google Analytics and Google Ads), Meta Platforms (Meta Pixel and Conversions API), and Microsoft (Clarity). We share usage events and hashed identifiers with these partners to measure traffic and advertising performance. In the EEA, UK and Switzerland these cookies and the related server-side events activate only after you accept them in our cookie banner; elsewhere they are active unless you opt out (section 10).
Legal compliance: when required by law, court order, or to protect the rights and safety of users or the public
Business transfer: if Pro Sistemos, MB is acquired or merges, your data may transfer as part of that transaction - we will notify you in advance

5. Data retention

We retain account information for as long as your account is active. If you delete your account we remove your personal data within 30 days, except where retention is required by law (e.g., financial records). Free-plan session files are not retained after the session ends.

6. Security

We use HTTPS for all data in transit, bcrypt-hashed passwords, and access controls on our infrastructure. No system is completely secure - if you believe your account has been compromised, contact us immediately at [email protected].

7. Children

Lapas is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

8. Your privacy rights

All users

Regardless of where you are located, you can:

Access and update your account information at any time from your account settings
Delete your account by emailing [email protected]
Opt out of any marketing emails using the unsubscribe link in those emails

California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

Know what personal information we collect, use, disclose, and sell
Delete personal information we hold about you (subject to certain exceptions)
Correct inaccurate personal information
Opt out of sale or sharing - we do not sell personal information; we "share" advertising identifiers for cross-context behavioral advertising, and you can opt out at any time with the Do not sell or share my personal information link in the footer, via our cookie banner, or through your browser settings
Limit use of sensitive personal information - we do not collect sensitive personal information as defined by the CPRA
Non-discrimination - we will not discriminate against you for exercising any of these rights

To exercise your California rights, email [email protected] with the subject line "California Privacy Request." We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf.

Categories of personal information collected in the past 12 months: identifiers (email, IP address), internet or other network activity (usage data, log data), and commercial information (subscription plan, transaction history). We do not sell any of these categories. We share identifiers and internet activity with our advertising partners for cross-context behavioral advertising unless you opt out, which you can do at any time with the footer link.

EU / EEA residents (GDPR)

If you are located in the EU or EEA, Pro Sistemos, MB is the data controller. Our legal bases for processing are: contract performance (to provide the service), legitimate interests (security, product improvement), legal obligation (financial records), and consent (marketing emails). You have the right to:

Access, rectify, or erase your personal data
Restrict or object to processing
Data portability
Withdraw consent at any time
Lodge a complaint with your national supervisory authority or the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt)

To exercise GDPR rights, email [email protected]. We respond within 30 days.

9. International data transfers

Our infrastructure is hosted within the EU. Where we use third-party processors outside the EU (such as Stripe), we rely on Standard Contractual Clauses or adequacy decisions approved by the European Commission to ensure your data is protected.

10. Cookies

We use the following categories of cookies and similar technologies:

Strictly necessary (always on): session management and login state. The service cannot function without these.
Functional (always on): remembering your preferences. While we test a new version of this website, a cookie named lapas_site holding a single letter keeps you on the same version for 30 days. It identifies nothing about you and is not shared with anyone.
Analytics (consent in the EEA, UK and Switzerland; on by default with opt-out elsewhere): Google Analytics, Microsoft Clarity and PostHog, to understand how visitors find and use Lapas.
Advertising (same regional rule): Google Ads and the Meta Pixel / Conversions API, to measure campaign performance and show relevant ads. While active, we may also send hashed event data to these partners server-side.

Where you are decides the default. We determine your region from the country of your network connection.

EEA, United Kingdom and Switzerland: analytics and advertising technologies load only after you accept them in our cookie banner. Microsoft Clarity and PostHog are not loaded at all until you accept; Google and Meta tags are present on the page but are held in a consent-denied state and store nothing and send no identifying event data until you accept.
Everywhere else, including the United States: these technologies run by default under an opt-out model and no banner is shown. You can opt out at any time with the Cookie settings or Do not sell or share my personal information link in the footer of any page; opting out takes effect immediately and stops further collection.

Marketing attribution: we record which page you arrived on and which campaign referred you, so we can tell which of our ads and articles actually work. While advertising technologies are active (accepted, or on by default outside the EEA, UK and Switzerland), this record is kept on your device for up to 90 days. If you decline or opt out, the same record is kept only for the current browser tab and is erased when you close it.

Changing your mind: use the Cookie settings link in the footer of any page to reopen the banner and change or withdraw your choice at any time. Withdrawing takes effect immediately, stops further collection, and deletes the 90-day attribution record from your device. Declining does not affect login or any part of the product.

11. Changes to this policy

We will post changes to this page and update the "last updated" date. For material changes we will notify you by email at least 14 days in advance. Continued use of the service after the effective date constitutes acceptance.

12. Contact us

For any privacy questions, rights requests, or concerns:
Pro Sistemos, MB · Lithuania
Email: [email protected]