Lapas is operated by Pro Sistemos, MB, a company registered in Lithuania ("we", "us", "our"). This Privacy Policy describes what information we collect when you use the Lapas website at lapas.io and the Lapas application at app.lapas.io (together, the "Service"), how we use it, and the choices you have. It applies to all users worldwide, including residents of the United States and the European Union.

1. Who we are

Data controller: Pro Sistemos, MB · Company code 306477207 · VAT LT100018954310 · Laisvės al. 110, LT-44253 Kaunas · Lithuania
Service: Lapas - browser-based 2D nesting software (lapas.io and app.lapas.io)
Contact: hello@lapas.io

2. Information we collect

Information you provide

Account registration: email address and password (stored as a cryptographic hash)
Billing: payment is processed by Stripe - we never see or store your card number
Support: any information you include when contacting us
Setup call requests: your name, work email, company, an optional phone number and your answers about your shop, used to arrange and hold the call you asked for. Bookings are made through Cal.com.

Information collected automatically

Usage data: nesting jobs run, features used, session duration, error events
Log data: IP address, browser type and version (user agent), pages visited, referring URL, timestamps. The IP address and user agent recorded when you sign up and when you visit are kept for up to 12 months, for advertising attribution (which campaign brought you here) and to detect fraud and abuse.
Cookies: strictly necessary cookies (login session, preferences) and analytics and advertising cookies, which need your prior consent in the regions listed in section 10 (including the EEA and the UK) and run by default with an opt-out elsewhere. See section 10 for the full list and how to opt out.
Session replay (app.lapas.io only): with your consent, PostHog records how you move through the application so we can see where it fails. Anything you type is masked before it leaves your browser, and the drawing area that shows your parts and layouts is never captured. Recording is off until you accept it, and you can withdraw at any time (section 10).

Files you upload

Files you upload (DXF, DWG, SVG, PDF, Illustrator and LightBurn) are processed on our servers to compute the nest. An upload that is not attached to a saved project is deleted automatically after 7 days. Saved projects, their files and your job history are kept for as long as your account exists, so you can re-open them. Deleting your account, from Settings in the application or by emailing us, removes them within 30 days. We do not use your design files to train AI models or share them with any third party.

3. How we use your information

To create and maintain your account
To perform nesting calculations and return results to you
To process payments and manage your subscription
To send transactional emails (account confirmation, password reset, billing receipts)
To respond to support requests
To monitor for abuse, security threats, and service errors
To improve the product using aggregated, de-identified usage patterns

We do not sell your personal information. We share limited usage events and hashed identifiers with our analytics and advertising partners (see sections 4 and 10) so we can measure how our campaigns perform: with your consent in the opt-in regions listed in section 10, and unless you opt out elsewhere. You can withdraw consent or opt out at any time.

4. Information sharing

We share information only in these limited circumstances:

Service providers, each bound by a data processing agreement: Hetzner (application hosting for app.lapas.io, EU); Cloudflare (hosting, CDN and DDoS protection for lapas.io, United States); Stripe (payments, United States); Resend (account and transactional email, United States); Sentry (error monitoring, EU region at de.sentry.io); PostHog (product analytics and, in the application, consented session replay, EU region); Cal.com (call scheduling); Google (Google Fonts on lapas.io, and Google sign-in if you choose to sign in with a Google account); and YouTube (the embedded demo video on lapas.io, served by Google under its own privacy policy)
Analytics and advertising partners (consent in opt-in regions; opt-out elsewhere): Google (Google Analytics and Google Ads), Meta Platforms (Meta Pixel and Conversions API), Microsoft (Clarity) and PostHog. We share usage events and hashed identifiers with these partners to measure traffic and advertising performance. In the opt-in regions listed in section 10 these cookies and the related server-side events activate only after you accept them in our cookie banner; elsewhere they are active unless you opt out (section 10).
Legal compliance: when required by law, court order, or to protect the rights and safety of users or the public
Business transfer: if Pro Sistemos, MB is acquired or merges, your data may transfer as part of that transaction - we will notify you in advance

5. Data retention

We retain account information for as long as your account is active. Uploads not attached to a saved project are deleted automatically after 7 days. Saved projects and job history are kept while your account exists. If you delete your account, from Settings in the application or by emailing us, we remove your personal data, projects and job history within 30 days, except where retention is required by law (for example, financial records). IP addresses and user agents kept for advertising attribution and fraud prevention are deleted after at most 12 months.

6. Security

We use HTTPS for all data in transit, bcrypt-hashed passwords, and access controls on our infrastructure. No system is completely secure - if you believe your account has been compromised, contact us immediately at hello@lapas.io.

7. Children

Lapas is a business tool. You must be at least 18 and use the Service for business purposes; it is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

8. Your privacy rights

All users

Regardless of where you are located, you can:

Access and update your account information at any time from your account settings
Delete your account yourself from Settings in the application, or by emailing hello@lapas.io; your personal data, projects and job history are removed within 30 days
Opt out of any marketing emails using the unsubscribe link in those emails

California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

Know what personal information we collect, use, disclose, and sell
Delete personal information we hold about you (subject to certain exceptions)
Correct inaccurate personal information
Opt out of sale or sharing - we do not sell personal information; we "share" advertising identifiers for cross-context behavioral advertising, and you can opt out at any time with the Your privacy choices link in the footer of any page. We also treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of sale and sharing: when we receive it, our advertising technologies (Google Ads and the Meta Pixel / Conversions API) do not run for you
Limit use of sensitive personal information - we do not collect sensitive personal information as defined by the CPRA
Non-discrimination - we will not discriminate against you for exercising any of these rights

To exercise your California rights, email hello@lapas.io with the subject line "California Privacy Request." We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf.

Categories of personal information collected in the past 12 months: identifiers (email, IP address), internet or other network activity (usage data, log data), and commercial information (subscription plan, transaction history). We do not sell any of these categories. We share identifiers and internet activity with our advertising partners for cross-context behavioral advertising unless you opt out, which you can do at any time with the Your privacy choices footer link or with a Global Privacy Control signal.

EU / EEA residents (GDPR)

If you are located in the EU or EEA, Pro Sistemos, MB is the data controller. Our legal bases for processing are: contract performance (to provide the service), legitimate interests (security, product improvement), legal obligation (financial records), and consent (marketing emails, and the analytics and advertising cookies described in section 10). You have the right to:

Access, rectify, or erase your personal data
Restrict or object to processing
Data portability
Withdraw consent at any time
Lodge a complaint with your national supervisory authority or the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt)

To exercise GDPR rights, email hello@lapas.io. We respond within 30 days.

9. International data transfers

Our application infrastructure is hosted within the EU. Some of our processors are established outside the EU, in the United States: Meta Platforms, Google, Microsoft, Resend, Cloudflare and Stripe. For those transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified under it, on the adequacy decision for the EU-US Data Privacy Framework, so that your data keeps the protection it has in the EU.

10. Cookies

We use the following categories of cookies and similar technologies:

Strictly necessary (always on): session management and login state. The service cannot function without these.
Functional (always on): remembering your preferences. While we test a new version of this website, a cookie named lapas_site holding a single letter keeps you on the same version for 30 days. It identifies nothing about you and is not shared with anyone.
Analytics (consent in opt-in regions; on by default with opt-out elsewhere): Google Analytics, Microsoft Clarity and PostHog, to understand how visitors find and use Lapas. In the application, PostHog session replay records your session only after you accept analytics, with typed text masked and the part and layout drawing area excluded from the recording. Session replay is never used on lapas.io.
Advertising (same regional rule): Google Ads and the Meta Pixel / Conversions API, to measure campaign performance and show relevant ads. While active, we may also send hashed event data to these partners server-side.

Where you are decides the default. We determine your region from the country (and, in Canada, the province) of your network connection, as reported by our hosting provider Cloudflare. We do not store this location.

Opt-in regions - the European Union, Iceland, Liechtenstein, Norway, the United Kingdom, Brazil, South Korea, Turkey, China and the Canadian province of Quebec, and any visitor whose country we cannot determine: on your first visit a dialog asks for your choice, with Accept all and Reject all side by side as buttons of the same size, and Settings to allow analytics and advertising separately (nothing is pre-selected). Until you accept, nothing that stores information on your device or identifies you is used for analytics or advertising:
- Microsoft Clarity and the Meta Pixel are not loaded at all.
- Google tags load in Google's Consent Mode with every consent signal denied. In that state they set no cookies and send only cookieless, anonymous pings (for example that a page was viewed), which Google uses to estimate conversions in aggregate; advertising click identifiers are removed from them.
- PostHog runs in cookieless mode: it sets no cookie and keeps no identifier on your device, and counts visits with an anonymous value derived on its servers from your IP address and browser that changes every day and cannot be used to recognise you across days. It creates no profile of you and records no sessions.
Everywhere else, including the United States, Canada outside Quebec, and Switzerland: analytics and advertising technologies run from your first visit under an opt-out model, and no banner is shown. You can opt out at any time with the Your privacy choices link in the footer of any page and then Reject all; opting out takes effect immediately, stops further collection and returns you to the cookieless mode described above. In the United States we also honour the Global Privacy Control signal: if your browser sends it, advertising technologies do not run for you, while analytics continue unless you also opt out.

Your choice is stored in a single cookie, lapas_consent_v2, set on lapas.io and shared with app.lapas.io, so a choice made on either site applies to both. It holds only which categories you allowed (all, analytics, ads or essential) and is kept for 12 months; we ask again only if what we ask your consent for changes. When you make a choice we count which one it was in PostHog, in the cookieless mode described above, so the count carries no identifier.

Marketing attribution: we record which page you arrived on and which campaign referred you, so we can tell which of our ads and articles actually work. While advertising technologies are active (accepted, or on by default in opt-out regions), this record is kept on your device for up to 90 days. If you reject or opt out, the same record is kept only for the current browser tab and is erased when you close it.

Changing your mind: use the Your privacy choices link in the footer of any page to reopen the banner and change or withdraw your choice at any time. Withdrawing takes effect immediately, stops further collection, and deletes the 90-day attribution record from your device. Rejecting does not affect login or any part of the product.

11. Changes to this policy

We will post changes to this page and update the "last updated" date. For material changes we will notify you by email at least 14 days in advance. Continued use of the service after the effective date constitutes acceptance.

12. Contact us

For any privacy questions, rights requests, or concerns:
Pro Sistemos, MB · Company code 306477207 · VAT LT100018954310 · Laisvės al. 110, LT-44253 Kaunas · Lithuania
Email: hello@lapas.io