Privacy policy

Fomio Studio (studio.fomio.de) · Last updated: 31 October 2026

This translation is provided for convenience only. In case of discrepancies, the German version shall prevail.

This privacy policy informs you about the processing of personal data when you use Fomio Studio, an online configurator for 3D printing models. Fomio's online shop is governed by its own privacy policy.

1. Controller
2. Hosting and server log files
3. Protection against attacks
4. Use of the configurator
5. Storage of information on your device
6. Audience measurement
7. User account
8. Recipients and transfers to third countries
9. Your rights
10. Final provisions

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Fomio. Please refer to the legal notice for the controller's name, address and contact details. Please address any data protection enquiries to the contact details given there.

2. Hosting and server log files

Fomio Studio is operated on the controller's own servers in Germany. All connections are TLS-encrypted.

With every request, our web server processes the following data:

• IP address of the requesting device,
• date and time of access,
• requested address (URL), HTTP status code and amount of data transferred,
• referrer URL and identifier of the browser used (user agent).

Purpose: delivery of the website, ensuring system security and stability, and error analysis.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and uninterrupted operation.
Retention: Log files are rotated weekly and deleted after five weeks; in our internal logging system they are deleted automatically after 90 days.

To distribute computing capacity fairly, the number of requests per IP address is counted briefly in memory. These counters are not stored permanently.

3. Protection against attacks

To protect against abusive access, we use the security software CrowdSec. It analyses the server log files for known attack patterns (e.g. automated login attempts or vulnerability scans) and temporarily blocks the IP addresses concerned.

If an attack is detected, we transmit the IP address and the type of attack detected to CrowdSec SAS, Paris, France, which uses it to compile a shared block list that we also obtain. No data is transmitted during normal use of the studio.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in defending our systems against attacks.

4. Use of the configurator

When you configure a model, your browser transmits the selected parameters (e.g. dimensions, options and texts you enter) to our server. The server generates the requested 3D file and stores it in a cache. Files in the cache can only be located via a checksum of the parameters and are deleted automatically when storage space is needed.

Legal basis: Art. 6(1)(b) GDPR (provision of the requested function). Please do not enter personal data in text fields that is not meant to be part of your model.

5. Storage of information on your device

Fomio Studio does not use cookies for advertising or analytics. It only stores information that is technically required for the functions you use:

Legal basis: Section 25(2) No. 2 TDDDG, as storage is strictly necessary for the functions you have expressly requested, and Art. 6(1)(b) and (f) GDPR. You can delete this information at any time via your browser settings.

6. Audience measurement

If you have given your consent, we use the open-source software Umami for statistical analysis of usage. Umami is operated on our own server; no data is passed on to third parties.

Data processed: pages and models viewed, actions triggered (downloading a file with model and format, saving a project, requesting a sign-in link), referrer, browser, operating system, device type, screen size, language and the country and region derived from the IP address.

The IP address is not stored. To distinguish visits, Umami creates a hash value from the IP address, user agent and a random value that changes daily, which does not allow identification. Umami does not set cookies. If "Do Not Track" is enabled in your browser, no data is collected.

Legal basis: your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future – via "Privacy settings" in the studio's status bar or here:

Retention: The statistical data is stored in anonymised form and deleted as required.

7. User account

The studio can be used without a user account. An account allows you to save projects, view your download history and – with an active Fomio Pro subscription or an eligible Patreon membership – download files without branding.

7.1 Sign-in

Sign-in takes place without a password via a link sent by e-mail or via your Patreon account. Sign-in links are valid for 15 minutes and can only be used once. After sign-in, the session cookie fs_session is set; we only store a hash value of it.

7.2 Data stored

• e-mail address,
• when signing in via Patreon: Patreon user ID and an access token stored in encrypted form,
• saved projects (name, model, parameters),
• the last 50 downloads (model, parameters, format, time),
• the result of the last licence check (cached for up to 24 hours).

Passwords, payment data or addresses are not stored.

7.3 Licence check

Shop subscription: To check a Fomio Pro subscription, we transmit your e-mail address to our shop system (Shopify). The only information returned is whether a customer account with an active subscription exists for this address.

Patreon: When signing in via Patreon, you are redirected to Patreon's website. With your consent there, Patreon transmits your user ID, e-mail address and your membership with Fomio to us. We check at most once a day whether the membership continues.

7.4 Sending e-mails

We send sign-in e-mails via our e-mail service provider Zoho (see section 8).

Legal basis for processing in connection with the user account is Art. 6(1)(b) GDPR.
Retention: until the account is deleted. You can delete your account at any time in the studio under "Account"; all the data listed is then removed without delay. Expired sign-in links and sessions are deleted daily. Backups are overwritten after 14 days.

8. Recipients and transfers to third countries

When using Patreon, data may be transferred to the USA. The transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, insofar as the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).

9. Your rights

With regard to your personal data, you have the following rights:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

10. Final provisions

The provision of personal data is neither required by law nor by contract. However, a user account cannot be used without providing an e-mail address or signing in via Patreon. There is no automated decision-making, including profiling (Art. 22 GDPR).

We will update this privacy policy as soon as changes to the studio or to the legal situation make this necessary. The version published here applies.