Privacy Policy

When you sign up for The Laser Workshop, we ask for identifying information such as your name and email address. That's so you can personalize your new account, and we can send you product updates and other essential information.

Authentication: We use Supabase for secure authentication. OAuth providers (Google, etc.) may share your name, email, and profile picture when you sign up using their services.

If you choose to join the Community Map, we collect location data (such as address or zip code) and workshop details.

• We use third-party geocoding services (OpenStreetMap/Nominatim) to convert addresses into map coordinates.
• By default, your location is displayed as approximate (Zip code center) unless you explicitly opt-in to show your exact address.
• Information you provide for the Maker Map profiling (bio, services, featured equipment) is public to other registered users.
• If you enable "Lead Intake," we process and store client messages to deliver them to you, but we do not use the content for marketing purposes.

• Maker pages: Your maker page at /makers/your-username is public. It shows your username and display name, the projects, settings and makes you have shared, your bio and avatar, your badges and awards, and the profile links, machines and city and state you choose to show.
• Automated screening: When you share a project, comment, make note, challenge entry note or similar post, its text and images may be sent to Anthropic (Claude) to check it against our community guidelines. Anthropic processes it to return a result to us; moderators make the final decision.
• View counts: We count project views without storing your IP address: the address is turned into a one-way hash for the day, then discarded.
• Copyright notices: If you send a copyright notice or counter-notice, we keep it, and the law may require us to share it (including your name and contact details) with the other party.

If you sign up for a paid subscription, you will be asked to provide your payment information.

• Stripe: Stripe processes payments and manages subscriptions, invoices, and the billing portal. Credit card information is submitted directly to Stripe (our payment processor) and doesn't hit The Laser Workshop servers. See Stripe's Privacy Policy.
• We store a record of the payment transaction for account history and billing support.
• If you participate in our Affiliate Program, we collect your PayPal email address solely for commission payouts.
• If you sign up or subscribe through an affiliate's link or code, we record that referral so we can pay their commission. The affiliate sees that a referral happened, when, and what they earned from it, but not your name, username, email or any other details about you.

We store on our servers the content that you upload or create in your account (such as material profiles, machine settings, SVG files, and project logs).

• Supabase: Database and authentication. Data is encrypted at rest and in transit. See Supabase's Privacy Policy.
• Cloudflare: Hosting and content delivery for the website, and file storage (R2) for avatars, SVG files, and project images. See Cloudflare's Privacy Policy.
• We keep this content as long as your account is active. Upon account deletion, content is deleted within 60 days.
• AI apps you connect: If you connect an AI app (such as Claude or ChatGPT) to your account through our MCP server, we record which app you approved, when, and when it was last used, and store its access tokens only in hashed form. The app can read your lasers and saved settings and create private settings and project drafts; it can't publish, change your account or see billing. What you tell the app and what it receives from us are also handled under that app's own privacy policy. You can disconnect an app any time at /ai.

We collect information about your browsing activity for analytics and statistical purposes. This helps us improve the service.

• Google Analytics: We use Google Analytics to understand site usage patterns. Google may use cookies to collect data. In California it runs only if you choose "Allow all". You can opt-out using the Google Analytics Opt-out Browser Add-on. See Google's Privacy Policy.
• Umami Analytics: Privacy-focused analytics hosted by Umami Cloud. Umami doesn't use cookies or collect personally identifiable information. See Umami's Privacy Policy.
• PostHog: Product analytics and feature flags. We use PostHog to understand feature usage and improve the product. PostHog stores this data in the United States and doesn't sell it or use it for advertising. Session recording is off. See PostHog's Privacy Policy.
• Data collected includes browser type, operating system, pages visited, time on page, and referring URLs.

We use cookies to store preferences, authentication, and perform analytics. See our Cookie Policy for details.

• Essential Cookies: Required for authentication and site functionality (Supabase auth tokens).
• Analytics Cookies: Google Analytics and PostHog use cookies to measure site usage; Umami doesn't use cookies. In the United States and in Canada outside Quebec, analytics run unless you opt out (Google Analytics in California only after you allow it). Everywhere else, they run only after you accept. Global Privacy Control and Do Not Track always opt you out. Details are in our Cookie Policy.
• Affiliate Cookies: We store referral codes in cookies to track affiliate commissions (30-day expiry).
• Signup Source Cookies: A first-party cookie records how you first reached our site (campaign tags on the link you followed, the referring website's domain, and the page you landed on; 90-day expiry). It is not shared with third parties, and we read it only if you create an account, to learn which channels bring new members. If you answer "How did you hear about us?" at signup, we store that answer too. Declining cookies, or sending Do Not Track or Global Privacy Control, stops and removes the signup source cookie.
• You can disable cookies in your browser settings, but some features may not work correctly.

• AWS SES: We use Amazon Web Services Simple Email Service to send transactional emails (password resets, notifications, receipts) and, if you opt in, our newsletter. Amazon tells us when an email bounces or is marked as spam, and we stop emailing addresses that bounce permanently or report spam. See AWS Privacy Notice.
• Newsletter open and click tracking: Newsletter emails may include a tiny invisible image and links that pass through our own domain. They tell us whether you opened an email, which links you clicked and when, and your email provider's domain (for example, gmail.com). We use this to measure each newsletter, send to engaged readers first, and pause a send if too many emails bounce or are reported as spam. We don't sell this data, we don't track transactional emails such as password resets, and the unsubscribe link is never tracked. Blocking images in your email app stops open tracking.
• UserJot: User feedback widget for authenticated users. UserJot may collect your email, name, and feedback messages. See UserJot's Privacy Policy.
• We do not use your email for marketing without explicit consent.

Sentry (Optional): If enabled, we use Sentry for error tracking and performance monitoring. Sentry may collect error messages, stack traces, user IDs, and browser information. See Sentry's Privacy Policy.

• All data is encrypted via SSL/TLS when transmitted from our servers to your browser.
• Database backups are encrypted at rest.
• We use industry-standard security measures including password hashing (bcrypt), secure session management, and regular security audits.
• Access to customer data is restricted to authorized personnel only.

When we access or share your information:

• Third-Party Processors: We use the following third-party subprocessors who may access your data: Supabase (database/auth), Stripe (payments and subscriptions), Cloudflare (hosting, content delivery, and R2 file storage), AWS SES (email), Google Analytics, Umami, PostHog (analytics), Sentry (error tracking), UserJot (feedback), Anthropic (automated screening of community posts).
• To help you troubleshoot: We will ask for your consent before accessing your content for support.
• When required under applicable law: We will only share customer data if compelled by a government authority with a legally binding order.
• We do not sell your data: We will never sell, rent, or trade your personal information to third parties for marketing purposes.

Data retention:

• We keep your information for the time necessary for the purposes for which it is processed.
• Active accounts: Data retained indefinitely while account is active.
• Deleted accounts: Content deleted within 60 days. Billing records retained for 7 years for tax/legal compliance.
• Analytics data: Aggregated and anonymized data may be retained indefinitely for product improvement.

Your rights (GDPR & CCPA):

• Access: Request a copy of your personal data.
• Deletion: Request deletion of your account and data.
• Portability: Export your data in JSON/CSV format from settings.
• Correction: Update your profile information anytime in settings.
• Opt-out: Unsubscribe from marketing emails anytime from account settings or any marketing email.
• To exercise these rights, email us at support@thelaserworkshop.com or delete your account from settings.

International data transfers:

• Our services are hosted in the United States (Supabase, AWS, Cloudflare).
• By using our services, you consent to the transfer and storage of your information in the United States.
• We rely on Standard Contractual Clauses (SCCs) and adequacy decisions for international transfers where applicable.

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us at support@thelaserworkshop.com.

If you have any questions about this policy or wish to exercise your privacy rights, please contact us at support@thelaserworkshop.com.

We will respond to your request within 30 days.