Lapas is operated by Pro Sistemos, MB, a company registered in Lithuania ("we", "us", "our"). This Privacy Policy describes what information we collect when you use lapas.io, how we use it, and the choices you have. It applies to all users worldwide, including residents of the United States and the European Union.

1. Who we are

Company: Pro Sistemos, MB
Service: Lapas - browser-based 2D nesting software (lapas.io)
Contact: [email protected]

2. Information we collect

Information you provide

Account registration: email address and password (stored as a cryptographic hash)
Billing: payment is processed by Stripe - we never see or store your card number
Support: any information you include when contacting us

Information collected automatically

Usage data: nesting jobs run, features used, session duration, error events
Log data: IP address, browser type and version, pages visited, referring URL, timestamps
Cookies: strictly necessary cookies (login session, preferences) and, only with your consent, analytics and advertising cookies. See section 10 for the full list and how to opt out.

Files you upload

DXF and SVG files you upload are processed in-session to perform nesting. Files are not stored beyond your session unless you explicitly save a project. We do not use your design files to train AI models or share them with any third party.

3. How we use your information

To create and maintain your account
To perform nesting calculations and return results to you
To process payments and manage your subscription
To send transactional emails (account confirmation, password reset, billing receipts)
To respond to support requests
To monitor for abuse, security threats, and service errors
To improve the product using aggregated, de-identified usage patterns

We do not sell your personal information. With your consent, we share limited usage events and hashed identifiers with our analytics and advertising partners (see sections 4 and 10) so we can measure how our campaigns perform. You can withdraw this consent at any time.

4. Information sharing

We share information only in these limited circumstances:

Service providers: Stripe (payments), transactional email provider, cloud hosting - each bound by data processing agreements
Analytics and advertising partners (consent-based): Google (Google Analytics and Google Ads), Meta Platforms (Meta Pixel and Conversions API), and Microsoft (Clarity). With your consent we share usage events and hashed identifiers with these partners to measure traffic and advertising performance. These cookies and the related server-side events activate only after you accept them in our cookie banner.
Legal compliance: when required by law, court order, or to protect the rights and safety of users or the public
Business transfer: if Pro Sistemos, MB is acquired or merges, your data may transfer as part of that transaction - we will notify you in advance

5. Data retention

We retain account information for as long as your account is active. If you delete your account we remove your personal data within 30 days, except where retention is required by law (e.g., financial records). Free-plan session files are not retained after the session ends.

6. Security

We use HTTPS for all data in transit, bcrypt-hashed passwords, and access controls on our infrastructure. No system is completely secure - if you believe your account has been compromised, contact us immediately at [email protected].

7. Children

Lapas is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

8. Your privacy rights

All users

Regardless of where you are located, you can:

Access and update your account information at any time from your account settings
Delete your account by emailing [email protected]
Opt out of any marketing emails using the unsubscribe link in those emails

California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

Know what personal information we collect, use, disclose, and sell
Delete personal information we hold about you (subject to certain exceptions)
Correct inaccurate personal information
Opt out of sale or sharing - we do not sell personal information; we "share" advertising identifiers for cross-context behavioral advertising only with your consent, and you can opt out at any time via our cookie banner or your browser settings
Limit use of sensitive personal information - we do not collect sensitive personal information as defined by the CPRA
Non-discrimination - we will not discriminate against you for exercising any of these rights

To exercise your California rights, email [email protected] with the subject line "California Privacy Request." We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf.

Categories of personal information collected in the past 12 months: identifiers (email, IP address), internet or other network activity (usage data, log data), and commercial information (subscription plan, transaction history). We do not sell any of these categories. With your consent, we share identifiers and internet activity with our advertising partners for cross-context behavioral advertising; you can withdraw consent at any time.

EU / EEA residents (GDPR)

If you are located in the EU or EEA, Pro Sistemos, MB is the data controller. Our legal bases for processing are: contract performance (to provide the service), legitimate interests (security, product improvement), legal obligation (financial records), and consent (marketing emails). You have the right to:

Access, rectify, or erase your personal data
Restrict or object to processing
Data portability
Withdraw consent at any time
Lodge a complaint with your national supervisory authority or the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt)

To exercise GDPR rights, email [email protected]. We respond within 30 days.

9. International data transfers

Our infrastructure is hosted within the EU. Where we use third-party processors outside the EU (such as Stripe), we rely on Standard Contractual Clauses or adequacy decisions approved by the European Commission to ensure your data is protected.

10. Cookies

We use the following categories of cookies and similar technologies:

Strictly necessary (always on): session management and login state. The service cannot function without these.
Functional (always on): remembering your preferences.
Analytics (consent-based): Google Analytics and Microsoft Clarity, to understand how visitors find and use Lapas.
Advertising (consent-based): Google Ads and the Meta Pixel / Conversions API, to measure campaign performance and show relevant ads. With your consent we may also send hashed event data to these partners server-side.

Analytics and advertising technologies load only after you accept them in our cookie banner. You can change or withdraw your choice at any time by clearing the lapas_consent_v2 cookie (which re-opens the banner) or by adjusting your browser settings. Declining these does not affect login.

11. Changes to this policy

We will post changes to this page and update the "last updated" date. For material changes we will notify you by email at least 14 days in advance. Continued use of the service after the effective date constitutes acceptance.

12. Contact us

For any privacy questions, rights requests, or concerns:
Pro Sistemos, MB
Email: [email protected]