Boldbobbin LogoBoldbobbin

Privacy Policy

This website and software (“Boldbobbin”, “we”, “our”, or “us”) is operated by Boldbobbin GmbH, a limited liability company incorporated in Switzerland (UID: CHE-368.246.596) with its registered seat in Zürich. You may contact us via our contact page or at alexandre [ at ] boldbobbin . com. We respect your privacy, and this policy explains how we collect, use, and protect your personal data when you use our website and services. This Privacy Policy complies with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. What We Collect

  • Account information: your email address, name, and country
  • Authentication and login data
  • Embroidery designs and files you create or upload
  • Usage and analytics data (only with your consent)
  • IP address, browser type, and device information

2. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance — to provide the service you signed up for (account management, cloud sync, file storage)
  • Consent — for analytics cookies, which you may accept or decline via our cookie banner
  • Legitimate interest — to improve our service and ensure security
  • Legal obligation — where required by Swiss or EU law

3. How We Use Your Data

We use your data to:

  • Provide and improve our services
  • Manage your account and authenticate your identity
  • Respond to inquiries and provide support
  • Understand usage patterns through analytics
  • Comply with legal obligations

4. Sharing and Sub-Processors

We do not sell your personal data. We may share it with trusted third-party service providers (sub-processors) who process data on our behalf, including:

  • Hetzner (Germany, EU) — hosting and storage of application data and your designs on our self-hosted infrastructure
  • Cloudflare — delivery of our website and web app (Cloudflare Pages / CDN), and cookieless web analytics
  • Stripe — payment processing as merchant of record
  • Resend — delivery of transactional and account emails (e.g. sign-up confirmation and password reset)
  • Google Analytics — site analytics (only if you have accepted analytics cookies)

Separately, we may disclose personal data to legal authorities or other third parties where required by applicable law, or to establish, exercise, or defend our legal rights. Such recipients receive data as independent recipients, not as sub-processors acting on our behalf.

5. International Data Transfers

Your application data and designs are stored primarily in Germany (EU) via Hetzner, providing EU data residency. Some of our service providers — including Stripe, Cloudflare, and Google Analytics — may process certain data outside Switzerland or the European Union. Where this occurs, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards approved under the nFADP and GDPR to ensure your data remains protected.

6. Cookies

We use essential cookies to operate the service. With your consent, we also use analytics cookies (Google Analytics) to understand how the site is used. When you first visit the Site, you can accept or decline non-essential cookies via our cookie banner, and analytics remain disabled until you accept. We also use Cloudflare Web Analytics, which is cookieless and does not track you across sites. See our Cookie Policy for more detail.

7. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, all of your personal information (email, name, country, and authentication data) is permanently deleted. Your design files are disassociated from your identity and may continue to exist in our storage in an unlinked, de-identified form until they are periodically purged; once unlinked, they can no longer be associated with you.

Data that we are required to retain for legal or accounting purposes may be kept for longer where required by law. Deleted data may also persist temporarily in our encrypted backups, which are rotated on a rolling basis — full-server images are retained for the last 7 days and logical database dumps for the last 30 days — after which the deleted data is removed from backups.

8. Your Rights

Depending on your location, you have the right to access, correct, delete, restrict, or export your personal data. To exercise any of these rights, contact us via our contact page or at alexandre [ at ] boldbobbin . com. EU residents also have the right to lodge a complaint with their national data protection supervisory authority. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC).

9. Changes

We may update this Privacy Policy from time to time. Registered users will be notified of significant changes via email. Last updated: June 21, 2026.

10. Contact

For any privacy-related questions or requests, please contact us via our contact page or at alexandre [ at ] boldbobbin . com.