Summary
Clapi3D builds 3D-printable models from your descriptions on iPhone, iPad and Mac. It is published by Clapilot GbR. To use it you create an account. Your requests, and photos you attach to them, are processed on our server and by the AI provider of the agent you use, and your models and conversations are stored with your account until you delete them. Requests use credits, which you buy as in-app purchases through Apple’s App Store; Apple handles the payment. Models you choose to share with the community are public to other members, without your account details. There is no analytics, advertising or tracking in the app, and we do not sell data.
Who is responsible
Controller within the meaning of the EU General Data Protection Regulation (GDPR):
Clapilot GbR
represented by Luca Sonntag
Georgenstraße 97
80798 München
Germany
Email: luca@clapilot.com
Further provider details: Legal notice (Impressum)
Your account
- Email address and password. We never store the password in plain text, only as a salted scrypt hash.
- Account details: when you created the account and last signed in, the language of the app, and session tokens that keep you signed in (stored only as hashes).
Legal basis: Art. 6(1)(b) GDPR (providing the app you signed up for).
Your models and conversations
- Models: title, the model itself (shapes, dimensions, parameters), check results such as size and estimated weight, and a preview image.
- Conversations: what you ask the agent and its replies, one conversation per model.
- Requests: for each request the time, the agent used, its status, the steps it took, how much AI processing it used (tokens), the credits it cost and error messages, so we can run, charge and fix the service.
Only you see your models and conversations in the app. Our administrators can see them in the server’s dashboard, only to run the service, fix problems and prevent misuse. Legal basis: Art. 6(1)(b) GDPR.
Photos and camera
You can attach a photo to a request so the agent builds a model of the object in it. This is optional.
- Camera and photos: The app opens the camera only when you tap the camera button, and asks for your permission the first time. From your photo library or your files it receives only the image you pick.
- Before sending: The app scales the photo down to at most 2048 pixels and saves it as JPEG. This removes the photo’s metadata, such as where and when it was taken and the camera model.
- Processing: The photo goes with your request to our server and from there to the AI model that answers it (see AI agents).
- Not stored: We do not store the photo. With the request we only record that a photo was attached.
Where you can, photograph only the object, and no people or things the model doesn’t need. Legal basis: Art. 6(1)(b) GDPR.
Credits and purchases
Each new model or change uses credits. You get a few credits when you sign up and can buy more in the app as in-app purchases.
- Payment: purchases are made through Apple’s App Store with your Apple Account. Apple processes the payment; we never receive your payment details, your name or your Apple ID.
- Purchase confirmation: for each purchase the app passes Apple’s signed confirmation on to our server: the credit pack, a transaction number, the purchase date, the App Store country and environment, and a random code that links the purchase to your Clapi3D account.
- Credit history: your balance and its history: welcome credits, purchases, the credits each request used, refunds, and credits we add, for example as a goodwill gesture.
- Refunds: refunds are handled by Apple. Apple informs our server about a refund, and we take the refunded credits back.
Legal basis: Art. 6(1)(b) GDPR (selling and providing the credits you buy).
Sharing with the community
When you create a model you can choose to share it with the community. Sharing is optional; models you don’t share stay private.
- What others see: the shared model’s title, the model itself, its preview image and how many members liked it. Every Clapi3D member can view it in 3D and save a copy to their own library. They don’t see your email address or any other account details.
- How long: a shared model stays public until you delete it or we remove it.
- Likes: we store which shared models you liked; others only see the number of likes.
- Reports and hidden creators: if you report a model, we store your report and the reason you give; if you hide a creator’s models, we store that so you no longer see them. The creator is not told.
- Moderation: we review reports and can remove models from the community and block accounts that break the community rules.
Legal basis: Art. 6(1)(b) GDPR (the community you choose to use); for reviewing reports and moderation Art. 6(1)(f) GDPR (our legitimate interest in a safe community).
AI agents
The agents are automated, not people. They can make mistakes; check the dimensions before you print. For each request we send your request, any photo you attached, the earlier messages of the conversation and the model concerned to the AI model that answers it:
- Clapilot agent: to the AI model provider we use for this agent.
- Codex: to OpenAI, through OpenAI Codex.
These providers process the data on our behalf. Please don’t include personal details about yourself or others in your requests that the model doesn’t need. Legal basis: Art. 6(1)(b) GDPR.
Our server and service providers
- Server: the app talks only to our server at 3dapp.clapilot.com, which we operate ourselves in Germany. It logs technical errors. To protect against misuse, it briefly counts sign-in and password reset attempts per IP address in memory.
- Cloudflare: connections to the server pass through Cloudflare (Cloudflare, Inc., USA), which protects and delivers the connection. Cloudflare also sends our emails.
- Emails: we only email you when you ask for a new password (a one-time link that works for 24 hours) or when you contact us.
Legal basis for logs and abuse protection: Art. 6(1)(f) GDPR (our legitimate interest in a secure service).
Transfers outside the EU
OpenAI and Cloudflare are based in the USA. Where personal data is transferred there, we rely on the EU-US Data Privacy Framework or on the EU Commission’s Standard Contractual Clauses.
Crash reports shared by Apple
If you have turned on Share With App Developers in your device settings, Apple may pass crash reports and anonymous diagnostic data about Clapi3D on to us. Apple does not tell us who you are. You can turn this off at any time in Settings → Privacy & Security → Analytics & Improvements.
When you email us
If you contact us by email, we process your email address, the content of your message and anything you choose to include (for example your device model or screenshots) only to answer your request.
Legal basis: Art. 6(1)(b) GDPR where your request concerns the app you use, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries). We delete your messages once your request has been dealt with, unless statutory retention obligations require us to keep them longer.
No tracking, no selling
Clapi3D contains no analytics, advertising or tracking SDKs and does not track you across apps or websites. We do not sell or share personal data for advertising.
Storage and deletion
- We keep your account, models and conversations as long as your account exists.
- Delete your account in the app (Account → Delete account, confirmed with your password). We delete the account and all models, conversations, requests, likes, reports and credits right away; unused credits are lost, and your shared models leave the community.
- You can delete single models in the library at any time; a shared model then leaves the community. Copies other members saved belong to them.
- Unused password reset links expire after 24 hours.
- Apple keeps its own records of your purchases, under Apple’s privacy policy.
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing based on our legitimate interests (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)).
To exercise your rights, email luca@clapilot.com from the address of your account. You can export your models yourself in the app.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de
Children
Clapi3D is not directed at children.
Changes to this policy
If the app or this policy changes, we will publish the updated version on this page and update the date.
Last updated: 11 October 2026
Contact
Questions about privacy in Clapi3D? Email luca@clapilot.com.
This policy covers the Clapi3D app and its server. The clapilot.com website is covered by the separate website privacy policy (in German). Terms of use: Apple’s standard Licensed Application End User License Agreement.