Legal
Privacy Policy
Last updated 16 October 2026. See also our Terms and Conditions.
This policy explains how Soft Tomato SRL, Trandafirilor, 24, Valea Lupului, Romania, 53271213 / RO54813789 (“Lescut”, “we”, “us”) handles personal data when you visit lescut.com, create an account or use the Lescut nesting service. It is written to meet the EU General Data Protection Regulation (“GDPR”), the UK GDPR and similar laws.
Your files, in short
Your part libraries, patterns, hide scans and results are your trade secrets. This is what happens to them:
- Stored privately in Database and file storage region, EU (Frankfurt), encrypted, in a storage folder and database records that only your Organization’s signed-in members can reach.
- Read only by Lescut’s own software. The app and the nesting engine run on our hosting, database and job machines. Those providers store data and run our software; their contracts forbid them to access or use your files for any purpose of their own.
- Never sent to anyone else. Our payment provider (Stripe), email and bot-protection providers never receive your files, nor does any analytics or advertising service. The table in section 5 shows exactly what each provider receives.
- Never shared, sold or used for training. Other customers cannot see them, we do not use them to train AI models, and we do not show them as examples without your written consent.
- Opened by our staff only when needed: when you ask for support on a specific job or file, to investigate a security incident or a fault, or when the law requires it.
- Yours to delete. Delete a library, batch or job at any time; deleting your Organization deletes all its files at once.
1. Who is responsible
- We are the controller for data we process for our own purposes: website visits, user accounts, billing, support and security.
- We are a processor for the files and data your organization puts into the Service (part libraries, hide scans, batches, jobs, results). Your organization is the controller of any personal data in them, and we process it only on its instructions under the Data Processing Terms in Schedule 1 of our Terms. Questions about that data are best directed to your organization first.
Contact for all privacy matters: hello@lescut.com.
2. Data we collect
| Category | What it includes | Source |
|---|---|---|
| Account | Name, email address, salted password hash (never the password itself), email-verification status, sign-in timestamps | You |
| Organization | Organization name, industry, your role, members, invitations sent and received (with invitee email addresses) | You, your colleagues |
| Customer files and jobs | Part libraries, patterns, hide scans, defect and grade data, batches, hide prices, scanner and cutter profiles, job settings, layouts, cutting files and reports; any names or notes you put in them | You, your colleagues |
| Billing | Plan, subscription status, billing period, trial dates, Stripe customer ID and a card fingerprint used to allow one trial per card. Stripe holds card numbers and billing addresses; we never see or store full card numbers | You, Stripe |
| Usage | Engine minutes used, jobs started, their duration and status, error logs | The Service |
| Support and contact | Messages you send us by email or the contact form, with your name, email and company | You |
| Security and technical | IP address, browser user agent, session records, bot-check results, server logs | Your browser, our bot-protection provider |
| Website statistics | Aggregated page views, referrer, country and device type, without cookies and without identifying individual visitors | Our hosting provider |
You do not have to give us personal data, but without account data we cannot provide the Service. Please do not put special categories of data (such as health data) or unnecessary personal data in files you upload.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account and Organization; storing files; running jobs; delivering results | Performance of a contract (6.1.b) |
| Billing, invoicing, enforcing plan limits and the one-trial-per-card rule | Contract (6.1.b); legal obligation for accounting and tax records (6.1.c) |
| Service emails: verification, password reset, invitations, notices about changes, outages or security | Contract (6.1.b) |
| Answering support and contact requests | Contract (6.1.b) or our legitimate interest in replying to you (6.1.f) |
| Notifying our team of new sign-ups so we can offer onboarding help | Legitimate interest (6.1.f) |
| Preventing fraud, abuse and bots; securing the Service; investigating incidents | Legitimate interest (6.1.f); legal obligation where applicable (6.1.c) |
| Understanding which pages and features are used, from aggregated statistics | Legitimate interest (6.1.f) |
| Complying with law and defending legal claims | Legal obligation (6.1.c); legitimate interest (6.1.f) |
Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (section 9). We send no marketing emails without your consent, and every such email includes an unsubscribe link.
4. What we do not do
- We do not sell or rent personal data or Customer files.
- We do not use your files to train, tune or benchmark machine-learning models, or share them with other customers.
- We do not use advertising trackers, third-party advertising cookies or cross-site tracking.
- We make no decisions about you based solely on automated processing that have legal or similarly significant effects. The only automated checks are bot detection at sign-up and the one-trial-per-card rule, and you can contact us to have a person review either.
- Our staff open your files only as described in section 6.4 of the Terms: when you ask for support on a specific job or file, to investigate a security incident or fault, or when the law requires it.
5. Who receives it
Subprocessors. We use providers in the categories below to run the Service. Each receives only the data it needs for its task, is bound by a data processing agreement, may use the data only to provide its service to us, and must protect it at least as well as we do. We give 30 days’ notice to Organization owners before adding or replacing one. Customers can ask us at hello@lescut.com for the name of each provider.
| Provider | Purpose | Your files? | Location |
|---|---|---|---|
| Cloud hosting and file storage | Runs the website and app; private storage of uploaded files; cookieless page statistics | Yes: stores uploaded files, encrypted, and runs the app that reads them | Database and file storage region, EU (Frankfurt); content delivery worldwide |
| Managed database | Accounts, Organizations, libraries, batches, jobs and results | Yes: stores the parts and hides read from your files, and job results, encrypted | Database and file storage region, EU (Frankfurt) |
| Job compute | Cloud machines that run the nesting engine | Yes: receives the geometry a job needs while it runs; kept in run logs for up to 30 days | EU, USA |
| Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices and tax calculation | No: receives only billing details | Ireland, USA |
| Transactional email | Account and service emails: verification, password reset, invitations, contact-form messages | No: receives only email addresses and the text of the email | USA |
| Bot protection | Checks that sign-ups and sign-ins come from people, not bots | No: receives only browser signals for the bot check | USA, global network |
- Your Organization. Members of your Organization can see its files, jobs and member list, including your name and email.
- Professional advisers such as accountants and lawyers, under confidentiality duties, where needed.
- Authorities when the law requires it. We check each request, disclose only what is required, and tell the affected customer unless the law forbids it.
- A successor in a merger or sale of our business, bound by this policy; we will notify you before your data becomes subject to a different policy.
6. Where data is stored and international transfers
Our database and uploaded files are stored in Database and file storage region, EU (Frankfurt). Some providers, or their support staff, are in the United States, the United Kingdom or other countries outside the European Economic Area. Transfers to the UK rely on the European Commission’s adequacy decision. Transfers to the United States rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses with supplementary measures such as encryption. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data | While you have an account. Ask us to delete your account at any time; Organization members can also be removed by an owner or admin |
| Organization data, files, jobs and results | While the Organization exists. Deleting a library, batch or job deletes it; deleting the Organization deletes all its uploaded files at once and its database records without delay |
| Organizations without a subscription | Deleted after 12 months without an active subscription, with 30 days’ notice to the owner |
| Encrypted database backups | Overwritten within 30 days |
| Job data at our compute provider (run payloads and logs) | Up to 30 days |
| Invoices and payment records | As long as tax and accounting law requires, typically 10 years |
| Support and contact messages | Until the request is resolved, then up to 2 years |
| Security and server logs | Up to 90 days, longer only while investigating an incident |
| Card fingerprint for the trial rule | As long as needed to apply the rule, at most 3 years after the trial |
8. Cookies and similar technologies
| Cookie or technology | Purpose | Duration |
|---|---|---|
| Session cookies | Keep you signed in and protect against forged requests | Until you sign out or the session expires |
| Bot-protection check | Tell people from bots on sign-up and sign-in; may set a cookie or use local storage | Short-lived |
| Stripe | Fraud prevention on checkout and billing pages hosted by Stripe | Set by Stripe on its pages |
| Page statistics | Aggregated page statistics; uses no cookies and no persistent identifiers | None |
All of these are strictly necessary for the Service or set no cookies, so no consent banner is required. You can block cookies in your browser, but signing in will then not work.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data; you can change most account data yourself;
- erase your data, where we no longer need it or have no legal basis to keep it;
- restrict processing while a dispute about its accuracy or lawfulness is resolved;
- port data you gave us to another provider in a machine-readable format; files and results can be downloaded from the Service at any time;
- object to processing based on our legitimate interests, and always to direct marketing;
- withdraw consent at any time, where we rely on it, without affecting earlier processing.
Write to hello@lescut.com from the email address of your account. We may ask you to confirm your identity, and reply within one month (extendable by two months for complex requests, in which case we tell you why). Requests are free unless they are manifestly unfounded or excessive. For data in your Organization’s files, we pass your request to the Organization, which is the controller, and assist it.
You may also complain to a data protection authority, in particular in the country where you live or work. Our lead authority is ANPC. We would appreciate the chance to resolve your concern first.
10. How we protect data
- All traffic is encrypted with TLS; the database and file storage are encrypted at rest by our providers.
- Uploaded files are kept in private storage with a separate folder per Organization and are served only to its signed-in members. Every database query is scoped to the Organization.
- Passwords are stored only as salted hashes; new accounts must verify their email; sign-up and sign-in are protected against bots.
- Nesting jobs run in isolated, short-lived containers that receive only the geometry they need.
- Production access is limited to the people who operate the Service and protected with multi-factor authentication.
- We choose providers with recognized security programmes and keep software dependencies up to date.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we notify the competent authority within 72 hours and affected customers without undue delay, as the GDPR requires. Please report suspected vulnerabilities to hello@lescut.com.
11. Children
The Service is for businesses and is not directed at anyone under 16. We do not knowingly collect their data and delete it if we learn we have.
12. Changes to this policy
We may update this policy as the Service or the law changes. The date at the top shows the current version. We will email Organization owners about material changes at least 30 days before they take effect, and notify you of new subprocessors as described in section 5.
13. Contact
Soft Tomato SRL, Trandafirilor, 24, Valea Lupului, Romania. Email hello@lescut.com, or use our contact form.