Boldbobbin LogoBoldbobbin

Privacy Policy

This website and software (“Boldbobbin”, “we”, “our”, or “us”) is operated by Boldbobbin GmbH, a limited liability company incorporated in Switzerland (UID: CHE-368.246.596) with its registered seat in Zürich. You may contact us via our contact page or at alexandre [ at ] boldbobbin . com. We respect your privacy, and this policy explains how we collect, use, and protect your personal data when you use our website and services. This Privacy Policy complies with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. What We Collect

  • Account information: your email address, name, and country
  • Authentication and login data
  • Embroidery designs and files you create or upload
  • Usage and analytics data (only with your consent)
  • Advertising measurement data, such as which advertisement brought you to the site and whether you subsequently signed up or subscribed (only with your consent)
  • IP address, browser type, and device information
  • Your answers to the optional survey in the app, if you choose to answer it: how you found Boldbobbin, what describes you, your digitizing experience, the software you have used, what you value, and any message you add. We store them with your account and use them only to improve Boldbobbin. We never sell them, and they are deleted when you delete your account.

2. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance: to provide the service you signed up for (account management, cloud sync, file storage), and to send you service notices about your account, such as sign-up confirmation, password resets, and changes to these policies
  • Consent: for analytics and marketing cookies, and for the advertising measurement described in section 7, all of which you may accept or decline when you first visit and change at any time. Your answers to the optional in-app survey described in section 1 are also collected on this basis. Our newsletter is sent on this basis, to people who opted in when they signed up, and it is also where our product announcements go. Every issue carries an unsubscribe link, and unsubscribing does not stop the service notices above, which are part of providing the service
  • Legitimate interest: to improve our service and ensure security
  • Legal obligation: where required by Swiss or EU law

3. How We Use Your Data

We use your data to:

  • Provide and improve our services
  • Manage your account and authenticate your identity
  • Respond to inquiries and provide support
  • Understand usage patterns through analytics
  • Comply with legal obligations

4. Sharing and Sub-Processors

We do not sell your personal data. We may share it with trusted third-party service providers (sub-processors) who process data on our behalf, including:

  • Hetzner (Germany, EU): hosting and storage of application data and your designs on our self-hosted infrastructure
  • Cloudflare: delivery of our website and web app (Cloudflare Pages / CDN), and cookieless web analytics
  • Stripe: payment processing as merchant of record
  • Resend: delivery of transactional and account emails (e.g. sign-up confirmation and password reset). Your email address is also stored with Resend in our mailing lists, which include a list of all users, used for the service notices described in section 2, and, if you opted in, our newsletter list.
  • Google Analytics: site analytics (only if you have accepted analytics cookies)
  • Reddit: advertising measurement and audience building (only if you have accepted marketing cookies)
  • OpenAI: image generation for the Line art & Redwork and Vector stylization methods (only when you run one; see section 6)
  • RunPod: GPU and CPU compute for the Pixel art and Line art & Redwork methods (only when you run one; see section 6)

Separately, we may disclose personal data to legal authorities or other third parties where required by applicable law, or to establish, exercise, or defend our legal rights. Such recipients receive data as independent recipients, not as sub-processors acting on our behalf.

5. International Data Transfers

Your designs and your account data are stored on our own infrastructure with Hetzner in Germany (EU), which gives them EU data residency. Other information is held by the providers named in section 4: your email address, for example, is also held by Resend so that we can send you account email.

OpenAI, RunPod, and Resend are based in the United States and may process data there. For OpenAI and RunPod this applies only to the advanced auto-digitizing methods described in section 6, and only when you choose to run one; Resend holds your email address in order to send you account email. Stripe, Cloudflare, Google Analytics, and Reddit may also process certain data outside Switzerland or the European Union.

Where data is processed outside Switzerland or the European Union, we rely on the standard contractual clauses in each provider's data processing agreement, or on equivalent safeguards approved under the nFADP and GDPR.

6. Advanced Auto-Digitizing

Boldbobbin's advanced auto-digitizing methods do their work on external services rather than on your own machine. This happens only when you choose to run one of them. No other part of Boldbobbin sends your designs or images to these services.

Which service receives what depends on the method:

  • Pixel art: sent to RunPod, which provides the compute. In prompt-only mode no image is sent at all, only the text you entered.
  • Line art & Redwork: sent to OpenAI, which generates a line drawing, and then to RunPod, which converts it to vectors.
  • Vector stylization: sent to OpenAI, which generates the image.

Any text you enter, such as a prompt or a style note, is sent along with the image.

The metadata embedded in your image is removed twice. The app removes it on your own device before the image is uploaded to us, including GPS coordinates, and our server removes it again before anything is sent to OpenAI or RunPod. The image is also resized before it is sent.

We keep the image you uploaded for 30 days, after which it is deleted from our storage. Generated results are kept in your account until you delete your account. A design you create from one can be deleted at any time, like any other design.

Separately, and under its own policy rather than ours, OpenAI may retain data sent through its API for up to 30 days for abuse monitoring. OpenAI's API data policy also states that data sent through its API is not used to train its models by default.

7. Cookies and Advertising Measurement

We use essential cookies to operate the service. With your consent, we also use analytics cookies (Google Analytics) to understand how the site is used, and marketing cookies (the Reddit Ads pixel) to measure whether our advertising reaches people who find Boldbobbin useful. When you first visit the Site, a dialog lets you accept all of these, reject all of them, or choose category by category, and both remain disabled until you accept. We also use Cloudflare Web Analytics, which is cookieless and does not track you across sites.

If you accept marketing cookies and later subscribe, we additionally send Reddit a record of that subscription from our own server rather than from your browser, so that the advertisement can be credited correctly. That record contains the purchase amount and identifiers that let Reddit match it to your ad click, including your email address in an irreversible hashed form. Nothing is sent if you have not accepted marketing cookies. See our Cookie Policy for more detail.

8. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, all of your personal information (email, name, country, and authentication data) is permanently deleted. Your design files are disassociated from your identity and may continue to exist in our storage in an unlinked, de-identified form until they are periodically purged; once unlinked, they can no longer be associated with you.

Images supplied to the advanced auto-digitizing methods follow their own schedule, set out in section 6.

Data that we are required to retain for legal or accounting purposes may be kept for longer where required by law. Deleted data may also persist temporarily in our encrypted backups, which are rotated on a rolling basis (full-server images are retained for the last 7 days and logical database dumps for the last 30 days), after which the deleted data is removed from backups.

9. Your Rights

Depending on your location, you have the right to access, correct, delete, restrict, object to, or export your personal data. You may object to direct marketing at any time, including by using the unsubscribe link in any newsletter. To exercise any of these rights, contact us via our contact page or at alexandre [ at ] boldbobbin . com. EU residents also have the right to lodge a complaint with their national data protection supervisory authority. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC).

10. Changes

We may update this Privacy Policy from time to time. Registered users will be notified of significant changes via email. Last updated: October 2, 2026.

11. Contact

For any privacy-related questions or requests, please contact us via our contact page or at alexandre [ at ] boldbobbin . com.