Privacy policy
Last updated: 24 October 2026
Stripnest (stripnest.reba-labs.com) is a web app for strip layouts of progressive dies, run by Računalniške storitve, Kristjan Reba s.p., trading as Reba Labs, Slovenia ("we"; full details in the imprint). This policy explains what personal data Stripnest handles. The short version: we store what the app needs to work, on our own server in the EU, with no ads, no analytics services and no tracking cookies.
For the files and data your company puts into Stripnest, we act as your processor; the data processing agreement covers that. For your account and billing, we are the controller.
What we store and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address and a password hash (scrypt; we never see or store the password itself) | To give you an account and let you sign in | Contract, Art. 6(1)(b) |
| Your plan and subscription status, and the Stripe customer and subscription ids | To know which features your plan includes | Contract, Art. 6(1)(b) |
| Uploaded files (DXF, IGES, STEP), the parts read from them, your layouts, their exports (DXF, PDF), quotes, material tables and shop rates | This is the service: computing and keeping your layouts | Contract, Art. 6(1)(b) |
| API keys (stored as hashes) with their name, prefix and when they were last used | For the API on plans that include it | Contract, Art. 6(1)(b) |
| Sessions (a hash of the session token) and password reset links (a hash of the token, valid one hour) | To keep you signed in, and to reset a forgotten password | Contract, Art. 6(1)(b) |
| Server logs: time, route, status, duration, a request id and your numeric account id. No email addresses, IP addresses, cookies or file contents | To find and fix errors and abuse | Legitimate interest, Art. 6(1)(f) |
| Page-view counts for the landing page: the day, the page and the referring website's host name. No IP address, no browser details, nothing that identifies you | To see whether people find Stripnest | Legitimate interest, Art. 6(1)(f) |
To protect sign-in and uploads from abuse, the server counts recent requests per IP address, per email address and per account in memory only. These counters are never written to disk, stop counting after an hour at most, and are lost whenever the server restarts.
Your uploaded files can contain names or other details your CAD software wrote into them (for example an author field). We do not read or use those details; they are kept as part of the file.
Cookies and browser storage
Stripnest sets one cookie: pleh_session, which keeps you signed in. It is strictly necessary, HttpOnly, secure,
and expires 30 days after you sign in or when you sign out. There are no advertising, analytics or third-party cookies,
so there is no cookie banner.
Your browser also remembers your language, light or dark theme, and the last settings you used for a layout, in its local storage. This stays on your device and is not sent to us.
Where your data is, and who else is involved
Your account and files are stored on a server we rent from Hetzner Online GmbH (Germany) in its data centre in Helsinki, Finland. Connections are encrypted (HTTPS). We use these other providers:
- Cloudflare, Inc. (USA) sits in front of the server for DNS, encryption and protection against attacks. Your requests, including your IP address, pass through Cloudflare's network. Transfers to the USA rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
- Stripe handles subscriptions and payments. When you subscribe, you enter your card and billing details (name, address, VAT number) on Stripe's checkout page; we never see your card number. Stripe acts as an independent controller for payment processing and fraud prevention under the Stripe privacy policy. We receive your plan, subscription status and the customer id, and Stripe keeps invoices.
- Resend, Inc. (USA) sends our emails, such as password reset links. It receives your email address and the message. Transfers rely on standard contractual clauses.
We do not sell or share your data with anyone else, and we do not use your files to train models or for anything other than running Stripnest for you. We may disclose data if Slovenian or EU law requires it.
How long we keep it
- Account, files, layouts and settings: until you delete them or your account. Layouts are kept until you delete them.
- Sessions: 30 days from sign-in. Reset links: one hour. Expired ones are removed by a daily clean-up.
- Server logs: rotated by size (at most 50 MB in total), so older lines are overwritten, normally within weeks.
- Backups: the server makes a nightly backup of all data, kept for 14 days. Data you delete disappears from backups within 14 days.
- Invoices and payment records: kept by Stripe and in our accounts for as long as Slovenian tax and accounting law requires (generally 10 years for invoices).
Your rights
You can access, correct, export and delete your data, restrict or object to processing, and complain to a supervisory authority. Most of this you can do yourself in the app:
- Export: Account → Download my data gives you a zip of your account details, uploaded files, layouts with their exports, materials and rates.
- Delete: Account → Delete account cancels any subscription and deletes your account and all its files at once.
- Correct: to change your email address, write to us.
For anything else write to privacy@reba-labs.com. We answer within one month. In Slovenia the supervisory authority is the Information Commissioner (Informacijski pooblaščenec, ip-rs.si); you can also complain to the authority where you live or work.
Security
Passwords, session tokens, reset links and API keys are stored only as hashes. Every account's data is kept apart, and uploads are checked and opened in a separate, limited process. If a breach affects your data, we will tell you and the authority as the GDPR requires.
Changes
If we change how Stripnest handles data, we will update this page before the change takes effect and change the date above. For significant changes we will also email account holders.