Privacy policy

Last updated: October 12, 2026

Who we are

Fabulayer is run by PE Chetvertak Andrii, registered in Ukraine.

We are responsible for the personal data described in this policy. Contact: support@fabulayer.com.

EU representative under Article 27 of the GDPR: not yet appointed. We will name them here once appointed.

What stays in your browser

Lists and model text stay in your browser. This includes names, the Order name, the Shop name, mark text and logos.

They are processed only in your browser.
They are never sent to our servers.
They never appear in URLs, analytics or logs.

When you share a single model, you can choose Include text. The text then goes into the part of the link after "#t=". Browsers do not send this part of a link to the server. Anyone you give the link to can read the text.

Other data in your browser

Your browser also keeps your Lists and Recent batches, your printer profile, the free-batch count and your export log. They stay in your browser until you clear them. The export log keeps the last 30 days.

What we store on our servers

You need an account only for a Seller plan or a Design pack, and only if you are 18 or older. You sign in with a 6-digit code sent to your email, or with Google. There are no passwords.

If you have an account, we store:

your account: email address, Google id (if you use Google), the time you confirmed you are 18 or older and the version of the age text, and your sessions;
billing records copied from Paddle;
your license number;
a journal of paid exports: the time, a count bucket, the number of models and names, and an optional design id, but never the names or text themselves;
your Design pack designs: the generator, its version and the number, on/off and choice settings, but never text;
your calculator settings;
short-lived sign-in codes, checkout intents and rate-limit records (see Retention);
if you were invited to the beta: a hash of your email address (deleted with your account, and all invites 30 days after public launch).

We also store data that is not linked to a person:

print-feedback answers, keyed by export id;
short-link counters;
aggregated daily analytics counters;
ids of processed Paddle events.

Emails about your account and sign-in come from no-reply@fabulayer.com.

Purposes and legal bases

For each purpose, we list the data and the legal basis under the GDPR:

Account, sign-in and providing your plan — email address, Google id, sessions, designs, paid-export journal, settings — performance of a contract (GDPR Art. 6(1)(b)).
Age confirmation — time and version of the confirmation — legal obligation or legitimate interest (GDPR Art. 6(1)(c) or 6(1)(f)).
Billing records and tax accounting — Paddle records, license number — legal obligation (GDPR Art. 6(1)(c)).
Abuse prevention — IP address hash with a daily salt, geo header — legitimate interest (GDPR Art. 6(1)(f)).
Hosting provider request logs — IP address and request data — legitimate interest (GDPR Art. 6(1)(f)).
Basic counters — aggregated data with no identifiers — legitimate interest (GDPR Art. 6(1)(f)).
Optional analytics — first-seen date, export-history ranges, attribution flags — consent (GDPR Art. 6(1)(a)).
Sign-in and account emails — email address — performance of a contract (GDPR Art. 6(1)(b)).
Beta invites — email address hash — legitimate interest (GDPR Art. 6(1)(f)).
Waitlist — email address — consent (GDPR Art. 6(1)(a)).

Analytics

Our analytics are aggregated daily counters by event, with values grouped into ranges. They contain no user id, IP address, user agent string or cookies that identify a person.

Page views and other basic counters are counted without consent.
Optional analytics, such as the first-seen date, export-history ranges and attribution flags, are collected only if you allow Analytics.
Country is recorded only on checkout events.

Cookies and browser storage

We use two categories of cookies and browser storage.

Necessary (always on): your session, your consent choice, language, Lists and Recent batches, printer profile, free-batch count, export log, and Paddle at checkout.
Analytics (off by default): the optional analytics described above.

There is no marketing category. Fabulayer works fully if you decline Analytics.

You can change your choice at any time in Cookie settings. We ask again when this policy's version changes, or after 6 months.

The session cookie is httpOnly, Secure and SameSite=Lax. Our fonts are self-hosted. No third-party requests are made before you make a cookie choice. Paddle's script loads only when you open checkout.

Rate limiting and security

To limit abuse, we count requests using a hash of your IP address. The hash uses a server-side salt that changes every day. These records are kept only for the length of the limit window. Raw IP addresses are not stored in our database.

Our hosting provider Vercel keeps technical request logs that may include your IP address. They are kept for up to 1 day and used only to run and secure the service.

We do not use a third-party error tracker.

Geographic restriction

Fabulayer does not serve Belarus or Russia, and requests from these countries are refused. We read the country from our hosting provider's geo header. We do not store your IP address for this check. Only the hosting provider's request logs described above may contain it.

Service providers

We use these providers to run Fabulayer:

Vercel: hosting, in Frankfurt (fra1).
Neon: database, on AWS in Frankfurt.
Paddle: Merchant of Record and checkout.
Brevo (EU): account and sign-in emails, and the waitlist form (double opt-in, ages 16+).
Google: sign-in, if you choose it.
Cloudflare: DNS and forwarding of support email.

Where data is stored

Our hosting and database are in the EU, in Frankfurt.

Paddle, Google and Cloudflare process data under their own terms and may do so outside the EU.

Google and Cloudflare may process data in the US under the EU-US Data Privacy Framework or standard contractual clauses. Paddle processes data in the UK, which has an EU adequacy decision.

Retention

Sign-in codes and rate-limit records: until they expire, plus 24 hours.
Checkout intents: 7 days after they expire.
Paddle event ids: 90 days.
Paid-export journal: as long as your account exists.
Aggregated counters and print feedback: kept with no time limit, as they hold no personal data.
Beta invites: deleted with the account, and all deleted 30 days after public launch.
Server logs: up to 1 day (hosting provider).
Billing records for tax and accounting: at least 3 years, as required by Ukrainian tax law.
Browser data: in your browser until you clear it. The export log keeps 30 days.

Deleting your account

You can delete your account from your account page after confirming by email.

If you have an active subscription, it is cancelled at the end of the paid period, with no partial refund. Your account is deleted after that date.

We delete your account, sessions, sign-in records, export journal, designs, calculator settings and any complimentary grant.

We keep billing records for tax and accounting for at least 3 years, without a link to your account. These are subscription, license and pack purchase records and Paddle events. Your license number stays valid for files you exported before.

Unspent Design pack credits are not refunded when you delete your account.

Your rights

You have the right to access, correct or delete your personal data, to restrict its processing, to get it in a machine-readable format (portability), to object to processing based on legitimate interest, and to withdraw your consent to analytics at any time in Cookie settings. Withdrawing consent does not affect processing that happened before.

You can complain to the data protection authority in your EU country of residence, or to the Ukrainian Parliament Commissioner for Human Rights.

We do not make decisions about you based solely on automated processing.

To use these rights, email support@fabulayer.com.

Children

Fabulayer is for ages 14+. People aged 14 to 17 can use it without an account. Accounts and payments are 18+, and every new account must confirm that the person is 18 or older. The waitlist form is for ages 16+.

If you are under 16, please do not turn on optional analytics.

Changes to this policy

We may update this policy. The date at the top of this page shows the current version. When the version changes, we ask for your cookie choice again.

Contact

Questions about privacy: support@fabulayer.com.