Your data, treated with care.

1. Data controller

The controller is Filip Marchal, Business ID 86902245, Staroměstská 2261/6, České Budějovice 3, 370 04, Czech Republic. Privacy requests can be sent to filipmarchal@gmail.com.

2. Data we process

• Account information, including your email address, account identifier and, when you choose Google sign-in, the basic profile information Google makes available, such as your name and profile picture.
• Authentication and security information, including session identifiers, sign-in times, IP address, browser and device information, and technical logs created when the service is used.
• Thangs connection and access information, including whether your account is connected, whether an eligible membership is active and when that status was last checked. The credentials needed to verify your Thangs membership are stored in encrypted form.
• Your cookie and privacy choices stored in your browser.
• Information you voluntarily include when contacting marchal.
• If you consent to analytics, usage events, device information, approximate location and online identifiers processed through Google Analytics.
• If you consent to marketing measurement, page views, campaign events and online identifiers processed through Meta Pixel. Google advertising tools are not currently active.

marchal. does not store the STL or ZIP files you generate and does not keep a history of your generator downloads.

3. Purposes and legal bases

Account and generator access

To create your account, keep you signed in, connect Thangs, verify membership and provide access to eligible generators. This processing is necessary to provide the service you request and perform the related agreement.

Security and misuse prevention

To protect accounts, generators and infrastructure, investigate errors and prevent fraud or attempts to bypass access controls, based on marchal.'s legitimate interests.

Enquiries and legal obligations

To reply to you, meet legal obligations and establish or defend legal claims, based on contractual necessity, legal obligations or legitimate interests as applicable.

Optional analytics

To understand website use and improve content. Google Analytics is used only after your consent, which you may withdraw at any time through Cookie settings.

Optional marketing measurement

To measure campaigns and relevant audiences through Meta Pixel. Any future Google advertising services will require separate activation. These tools are used only after your consent, which you may withdraw.

4. Where the data comes from

Data comes directly from you, from the device and browser you use, from Google when you choose Google sign-in, and from Thangs when you ask to connect your membership. Optional analytics or marketing providers supply data only if their tools are enabled and you consent.

5. Service providers and recipients

Personal data may be handled by the following providers where needed:

• Vercel, for website hosting, delivery, security and technical logs.
• Supabase, for authentication, account data, database services and access control.
• Brevo, for delivery and technical logging of one-time sign-in emails.
• Seznam Email Profi, for operating the marchal. contact mailbox and handling messages you choose to send to marchal.
• Google, when you use Google sign-in.
• Thangs, to connect your Thangs account and verify membership. Your Thangs account, membership and payments remain subject to the Thangs privacy notice and terms.
• Google Ireland Limited, if you consent to Google Analytics. Google receives online identifiers, device and usage information needed to provide aggregate website statistics.
• Meta Platforms Ireland Limited and related Meta entities, if you consent to marketing measurement through Meta Pixel. For certain collection and transmission activities, marchal. and Meta may act as joint controllers under Meta's terms.
• Professional advisers or public authorities where required by law or necessary to protect legal rights.

These providers may use their own approved sub-processors. A current internal provider record is maintained and reviewed when the service changes.

6. International transfers

Some providers or their sub-processors may process data outside the European Economic Area. Where required, transfers are protected by an adequacy decision, the EU–US Data Privacy Framework, Standard Contractual Clauses or another lawful safeguard. Primary Supabase project data is hosted in the Central EU (Frankfurt) region, while support, security and sub-processor operations may still involve other locations under the provider's safeguards.

7. Retention

• Account information, access status and the encrypted Thangs connection are kept until you delete your marchal. account or the service is closed, subject to limited provider backup and deletion cycles.
• Brevo transactional delivery logs are automatically deleted after one month. Email previews are not stored, and tracking of future opens and clicks is anonymised.
• On the current plans, Vercel runtime logs are available for one hour and Supabase product and authentication logs are available for one day. Providers may retain limited security, account or backup records for separate periods under their terms.
• Your cookie preference is renewed no later than 12 months after it is saved.
• Google Analytics identifiers may remain in your browser for up to two years. Event-level data is retained for the shortest period configured in Google Analytics. Meta Pixel identifiers may remain in your browser for up to three months and are not created unless you separately consent to marketing measurement.
• Contact messages held in the Seznam Email Profi mailbox are kept only as long as needed to answer and follow up, normally no longer than three years and deleted earlier where they are no longer needed.
• Provider backup and deletion cycles may take a limited additional period.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

9. Delete your account

You can delete your marchal. account from the Account page after a recent sign-in. This removes the account and its linked access records, subject to limited backup cycles. It does not delete your separate Thangs account or cancel your Thangs membership; those actions must be completed directly with Thangs.

10. Automated access decisions

The service automatically allows or refuses generator access according to the membership status returned through the Thangs connection. This is a technical application of your membership entitlement, not profiling intended to produce legal or similarly significant effects. If the displayed status is wrong, contact marchal. so it can be checked.

11. Changes to this policy

This policy will be updated when the service, providers or legal requirements materially change. Google Analytics and Meta Pixel remain disabled until you consent to their respective categories. Any additional marketing tool requires a policy update, separate technical activation and your prior marketing consent.