Privacy Policy
Last updated: September 2026
1. Who We Are (Data Controller)
The data controller is Naomi Devyatov (נעמי דביאטוב), sole proprietor (Osek Patur / עוסק פטור) No. 346012073, trading as YND (“Vixeldorf”, “we”), Khayim Perel 3, Bnei Brak, Israel (חיים פרל 3, בני ברק).
Contact: yoav@vixeldorf.com · Website: https://www.vixeldorf.com
We are based in Israel and do not actively target the EU market, so we have not appointed a representative under GDPR Article 27. EU/EEA users may still contact us at the address above to exercise their rights.
2. What Data We Collect
Depending on how you use the site, we collect:
| When | Data |
|---|---|
| Visiting the site | Aggregated, **cookieless** analytics (page views, approximate country, device and browser type) via Vercel Analytics. This is not linked to you individually. |
| Posting a comment or review | The name you type, your comment text and any optional star rating; and, for security, a **salted hash of your IP address** and your browser user-agent. |
| Anti-spam check | When you submit a comment, Cloudflare Turnstile processes a challenge token and your IP address to distinguish humans from bots. |
| Downloading a plugin | Installers are hosted on GitHub; downloading one reveals your IP address to GitHub under its own privacy policy. |
| Buying a paid product | Handled by Lemon Squeezy as merchant of record. They collect the billing and payment data needed; we receive order details (such as name, email, product) but never your full card number. |
| Donating | Handled by Ko-fi under its own privacy policy. |
| Emailing support | Your email address and anything you choose to include in your message. |
What we do not collect: we do not receive, transmit or store any data from your BIM or CAD project files — all plugin processing happens locally on your computer.
3. Cookies & Similar Technologies
We do not use advertising or cross-site tracking cookies, and our website analytics is cookieless.
Cloudflare Turnstile may set a cookie strictly to run its bot-detection check when you submit a comment. A session cookie is used only for the site owner’s moderation login — never for ordinary visitors.
4. How We Use Data & Legal Bases
Where GDPR applies, we rely on the following legal bases (Article 6):
- Publishing and moderating comments — your consent (you choose to post) together with our legitimate interest in running a useful, spam-free site.
- Preventing spam and abuse, and rate-limiting (the salted IP hash and Turnstile) — our legitimate interest in security.
- Emailing ourselves a notification when a comment is posted, so we can moderate it — our legitimate interest.
- Providing and improving the site using aggregate analytics — our legitimate interest.
- Processing purchases — performance of a contract (carried out by Lemon Squeezy).
- Responding to support requests — our legitimate interest and/or steps taken at your request.
The salted hash of your IP address is pseudonymised personal data, not anonymous data, and is treated as personal data.
5. Service Providers We Use
We do not sell or rent your personal data. We use the following processors and third parties, each under its own terms:
- Vercel — website hosting and cookieless analytics.
- Supabase — stores submitted comments (name, text, rating, hashed IP, user-agent).
- Cloudflare Turnstile — anti-spam bot check.
- Spacemail (SMTP) / Resend — sends the new-comment notification email to us.
- Lemon Squeezy — payment processing as merchant of record.
- Ko-fi — voluntary donations.
- GitHub — hosting of plugin installers you download.
Some of these providers are located outside Israel and the EEA (for example, in the United States). Where required, such transfers rely on appropriate safeguards under applicable law.
6. Retention
We keep personal data only as long as needed for the purpose it was collected:
- Comments — until you ask us to remove yours, or we remove it.
- Security data (hashed IP, user-agent) — kept for a limited period to detect spam and abuse, then deleted.
- Support emails — kept as long as needed to handle your request.
- Purchase records — held by Lemon Squeezy under its policy and retained as required by applicable tax and accounting law.
7. Your Rights
Subject to applicable law (including GDPR where it applies), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. You can also ask us to remove a comment you posted.
To exercise any of these, email yoav@vixeldorf.com. We aim to respond within 30 days.
8. Security
We use appropriate technical and organisational measures, including encryption in transit (HTTPS) and access controls, and all comments are pre-moderated before publication. If a breach affects your rights, we will notify you and any competent authority as required by applicable law.
9. Children
The site and our tools are professional engineering products intended for users aged 18 and over. We do not knowingly collect data from minors; if you believe a minor has provided us data, contact us and we will delete it.
10. Links to Other Sites
The site links to third-party services (such as GitHub, Lemon Squeezy and Ko-fi). This Policy covers only our own site; please review those services’ privacy policies.
11. Changes
We may update this Policy from time to time. The current version is always at https://www.vixeldorf.com/privacy.
12. Contact
Questions or requests: Naomi Devyatov (נעמי דביאטוב), sole proprietor (Osek Patur / עוסק פטור) No. 346012073, trading as YND · yoav@vixeldorf.com.