1. Who is the controller of your personal data
The controller of personal data is:
Josef Kocurek
Company ID (IČO): 06431119
Business address: Halenkov 31, 756 03 Halenkov, Czech Republic
Email: hi@onemorestud.com
Website: onemorestud.com
We do not appoint a Data Protection Officer (DPO) — the scope of processing does not trigger this obligation.
2. What personal data we process and why
2.1 Registration and sign-in
Data processed: email address.
Purpose: identity verification via a one-time code (OTP) or link sent by email; operation of the user account.
Legal basis: performance of a contract — Article 6(1)(b) of Regulation (EU) 2016/679 (GDPR). Without an email address, we cannot provide you with an account.
Retention period: the email is retained for as long as the account exists. Sign-in tokens are valid for 15 minutes; after use or expiry they are deleted.
2.2 Account and project data
Data processed: email; optional author name (handle) and profile URL; project name; uploaded model file (.ldr/.mpd); optional description, cover image, and PDF instructions.
Purpose: display and sharing of interactive instructions; project management in the dashboard.
Legal basis: performance of a contract — Article 6(1)(b) GDPR.
Retention period: for as long as the project or account exists. Files are removed from primary storage immediately upon deletion; backup copies (data backup and replication for recovery purposes) are removed within 30 days of deletion — see Section 5.1 of the Terms of Service.
Data provision: optional fields (handle, description, image, PDF, profile URL) are not required to use the service and may be deleted at any time.
Public display: for models published in public or commercial mode, the creator’s handle, author name, and profile URL are publicly visible on the model page (they form part of the /one/{handle}/{model} address). After the community gallery is launched, if the creator has enabled community sharing, this information will also be displayed there. Publication is a consequence of the creator’s decision to publish the model; for private models, the data is not displayed publicly.
2.3 Payments for the commercial subscription via Creem
Payments for the commercial subscription (Section 3.3 of the Terms of Service) are processed by Armitage Labs OÜ (Estonia), operating the Creem platform (hereinafter “Creem”), which acts as Merchant of Record — you enter into the purchase contract directly with Creem, not with us. Creem is an independent controller of your payment and billing data and is governed by its own privacy policy.
From Creem we receive only the data necessary to fulfil our part of the service: payment confirmation, subscription identifier, and email for transactional notifications.
Legal basis (our processing): performance of a contract — Article 6(1)(b) GDPR (activation of the commercial model based on payment confirmation). Retention of transaction records: compliance with a legal obligation — Article 6(1)(c) GDPR (Act No. 235/2004 Coll. on Value Added Tax, Section 100; Act No. 563/1991 Coll., Section 31).
Retention period: we retain transaction records for the commercial subscription for 10 years in accordance with tax regulations.
Micro-donations (Ko-fi): the “Support on Ko-fi” button (Section 3.4 of the Terms of Service) leads to the external platform Ko-fi (ko-fi.com/onemorestud), outside the Operator. The Operator does not process this payment, receives no data about the donor or the transaction from Ko-fi, and no personal data arises on our side from this flow. By opening the link you leave the OneMoreStud website and become subject to Ko-fi’s privacy policy (ko-fi.com/privacy), not this policy.
2.4 Transactional emails
Data processed: email address.
Purpose: delivery of the sign-in code; notification of an approaching end to the trial period or expiry of commercial subscription.
Legal basis: performance of a contract — Article 6(1)(b) GDPR.
Processor: we send emails via Resend Inc. (USA). We have a data processing agreement (DPA) with Resend; transfers to the USA are based on standard contractual clauses (SCC) approved by the European Commission.
Retention period: we do not retain the content of sent emails; delivery logs are subject to Resend’s retention policy.
2.5 Security and abuse prevention
Data processed: IP address (during the sign-in process and during attempts to access a password-protected model); date and time of sign-in and access attempts; server (access) logs of the infrastructure — IP address, time, and request target.
Purpose: limiting the number of attempts (max. 10 / IP / hour), protection against brute-force attacks; operational diagnostics and server security audit.
Legal basis: legitimate interest — Article 6(1)(f) GDPR (ensuring the security and integrity of the service). The balancing test is documented internally and available on request at hi@onemorestud.com.
Retention period: IP address during the sign-in process for a maximum of 30 days; access attempt records for a maximum of 30 days; server logs for a maximum of 30 days; then deleted on an ongoing basis.
2.6 Web analytics — Google Analytics
Data processed: anonymised IP address, device and browser type, pages visited, visit duration, visit source — collected via analytics cookies.
Purpose: measuring traffic and user behaviour for the purpose of improving the service.
Legal basis: consent — Article 6(1)(a) GDPR for cookies and visitor identification. Without your consent, your browser only sends an anonymous technical signal with no cookies and no identifier, on the basis of legitimate interest in verifying the measurement tool is working (Article 6(1)(f) GDPR); cookies and identification of your visit only begin after you consent in the cookie banner.
Processor: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. For data transfers from Google Ireland to Google LLC (USA), standard contractual clauses (SCC) under Article 46(2)(c) GDPR apply.
Retention period: in Google Analytics we configure data retention to 14 months (GA Admin → Data Settings → Data Retention).
Risk of data transfer to the USA: we are aware that several European supervisory authorities (e.g. the Austrian DSB, French CNIL, and Italian Garante, 2022) have previously found that SCCs alone, without additional technical measures, may not be sufficient for data transfers to the USA in connection with Google Analytics in light of the CJEU’s Schrems II ruling. We have considered and accepted this risk in view of IP anonymisation and the limited scope of data processed (see above); we monitor the situation on an ongoing basis and will add further safeguards if necessary. Without your consent, only an anonymous signal with no cookies and no identifier is sent, which further reduces the transfer risk.
Withdrawal of consent: cookie settings can be changed at any time via the cookie banner, the “Cookie settings” link on the home page, in the dashboard, on the model page, or on the Cookie Policy page. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
2.7 Browser storage (localStorage and IndexedDB)
Data processed: localStorage — preference settings (oms_locale, oms_new_part_view, oms_cookie_consent, oms_guest_save_ack_*); IndexedDB — in anonymous preview (preview mode), the uploaded model file and its metadata (name, description, and optionally author name).
Purpose: preserving user preferences (language, part display, cookie consent) and local storage of the model during anonymous preview without transferring data to the server.
Legal basis: legitimate interest — Article 6(1)(f) GDPR (ensuring functionality and personalisation of the interface). Data in IndexedDB is processed exclusively locally on your device and is not automatically transferred to the server.
Retention period: until manual deletion of site data in browser settings or until deletion of the project in the application.
2.8 Access to a password-protected model
Data processed: the model_access_* cookie — an identifier confirming successful password entry for the given model; we do not process any personal data of the builder beyond this identifier.
Purpose: to allow the builder repeated access to a password-protected model without having to re-enter the password on every visit.
Legal basis: legitimate interest — Article 6(1)(f) GDPR (providing access to a feature configured by the creator, without requiring builder registration).
Retention period: 30 days from password entry.
3. Recipients of personal data
We do not sell your data or share it for third-party direct marketing purposes. We disclose it only to the extent necessary for operation:
| Recipient | Relationship | Purpose | Location |
|---|---|---|---|
| Armitage Labs OÜ (Creem) | Controller (MOR) | Payment processing for the commercial subscription | Estonia (EU) |
| Resend Inc. | Processor (DPA in place) | Email delivery | USA (SCC) |
| Hetzner Online GmbH | Processor (DPA in place) | Hosting and server infrastructure | Germany (EU) |
| Google Ireland Ltd | Processor (DPA in place) | Web analytics (identification only after consent) | Ireland (EU) |
Data processing agreements under Article 28 GDPR are in place with all processors.
4. Transfer of personal data outside the EU/EEA
| Recipient | Transfer mechanism | Note |
|---|---|---|
| Resend Inc. (USA) | Standard contractual clauses (SCC) — Commission Decision (EU) 2021/914 | A copy of the clauses is available on request at hi@onemorestud.com |
| Google LLC (USA), via Google Ireland Ltd | Standard contractual clauses (SCC) under Article 46(2)(c) GDPR | For our assessment of the risk of this transfer, see Section 2.6; a copy of the clauses is available on request at hi@onemorestud.com |
Armitage Labs OÜ (Creem), processor of commercial subscription payments (see Section 3), is based in Estonia (EU/EEA) — this is not a transfer of personal data outside the EU/EEA, so it is not listed here.
5. Retention periods overview
| Data category | Retention period |
|---|---|
| Email (user account) | Until account deletion |
| Project data and uploaded files | Until project or account deletion |
| Data and files after account termination | Up to 30 days after termination (except where legal obligations apply) |
| Sign-in tokens (OTP, magic link) | 15 minutes; deleted after use or expiry |
Session cookie oms_session |
7 days (fixed expiry) |
Model access cookie model_access_* |
30 days |
| Google Analytics data (only after consent) | 14 months (GA Admin setting) |
| localStorage / IndexedDB (preferences, anonymous preview) | Until manual deletion of site data or project deletion |
| IP address (sign-in process and access attempts) | Maximum 30 days |
| Server (access) logs | Maximum 30 days |
| Transaction records (commercial subscription payments) | 10 years (tax obligation) |
6. Your rights
As a data subject, you have the following rights (Articles 15–22 GDPR):
- Access — request an overview of the personal data we process about you and obtain a copy.
- Rectification — request correction of inaccurate or completion of incomplete data.
- Erasure — request deletion of your account and all associated data; data is deleted within 30 days of receiving the request or account termination. Erasure does not apply to data we are required to retain by law (in particular tax records).
- Restriction of processing — request suspension of processing in situations prescribed by law.
- Data portability — obtain your data in a structured, machine-readable format (JSON or CSV).
- Objection — see the paragraph below.
- Withdrawal of consent — consent to analytics cookies may be withdrawn at any time in cookie settings.
Right to object (Article 21 GDPR): Where we process your personal data on the basis of legitimate interest (Article 6(1)(f)), you have the right to object at any time. Upon receiving an objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.
Obligation to provide data: Providing an email address is a contractual requirement necessary to create an account; without an email, the service cannot be used. Other data (handle, profile URL, project description, cover image, PDF) is voluntary.
How to exercise your rights: Send requests to hi@onemorestud.com. We will respond within one month; in complex cases we will extend the deadline by a further 2 months and inform you in advance. The response is free of charge — a fee may only be charged for manifestly unfounded or repetitive requests.
7. Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with:
Office for Personal Data Protection (ÚOOÚ)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
Website: www.uoou.cz
Email: posta@uoou.cz
A complaint may be lodged in the country of your habitual residence or place of work, or in the place where the alleged violation occurred.
8. Security
We apply appropriate technical and organisational measures to protect your data:
- Session tokens are stored as
HttpOnlycookies (not accessible to JavaScript in the browser). - Sign-in tokens are stored in the database as SHA-256 hashes, never as readable text.
- Model access passwords (optional protection set by the creator) are stored as bcrypt hashes; the system does not use user sign-in passwords — sign-in is exclusively via a one-time code (OTP) sent by email.
- All communication is encrypted via HTTPS/TLS.
- Database access is restricted to server infrastructure.
9. Cookies
Detailed information about the cookies we use is in a separate document: Cookie Policy.
Summary overview:
| Type | Cookie | Consent | Validity |
|---|---|---|---|
| Essential (session) | oms_session |
Not required | 7 days |
| Essential (model access) | model_access_* |
Not required | 30 days |
| Analytics | Google Analytics (_ga, _ga_*) |
Required | 2 years |
10. Automated decision-making and profiling
We do not carry out automated decision-making with legal effects under Article 22 GDPR. If Google Analytics is activated, analytical profiling (aggregated behaviour statistics) takes place on the basis of your consent; this profiling has no legal effects or other significant impact on your personal situation.
11. Age restriction
The service is intended for persons aged 18 and over. We do not knowingly collect personal data from persons under 18. If we discover that we have inadvertently processed such data, we will delete it without delay.
12. Changes to this policy
We will inform you of material changes by email or notice on the website at least 14 days before they take effect. The current version is always available at onemorestud.com/legal/privacy. The date of the last update is stated in the document header.
This policy is effective from 10 July 2026.
Controller: Josef Kocurek · IČO: 06431119 · hi@onemorestud.com · onemorestud.com