[ PRIVACY POLICY ] · AS OF 18 OCT 2026
Privacy Policy
This is a convenience translation. Only the German version is legally binding.
This privacy policy informs you about which personal data we process when you use the website prop-lab.app and the PropLab application, for what purposes this is done, how long we store the data and what rights you have.
1. Controller
Tplus Engineering GmbH
represented by its managing director (Geschäftsführer) Dr.-Ing. Sebastian Spring
Steinbeisstr. 25, 70771 Leinfelden-Echterdingen, Germany
Phone +49 711 7674197-0, e-mail info@tplus-engineering.de
For questions about data protection and to exercise your rights, an e-mail to info@tplus-engineering.de is sufficient.
2. Hosting
The website and the application run on a virtual server of our own, which we rent from hostworld.de, proprietor Max Bullmann, Widukindstr. 6, 37619 Bodenwerder, Germany. The server is located in a data centre in Nuremberg, Germany. hostworld provides the server and therefore has technical access to the data stored on it. A data processing agreement pursuant to Art. 28 of the General Data Protection Regulation (GDPR) has been concluded with hostworld; under that agreement, the data are stored exclusively in Germany.
3. Visiting the website, logs and security
When you visit our pages, your browser transmits technically necessary information, in particular the IP address, time, requested address and browser identifier. We need this information to deliver the pages. The connection is encrypted with TLS.
- Our web server does not create access logs containing IP addresses.
- The application logs technical processes and errors without visitors’ IP addresses.
- We log failed and excessively frequent sign-in attempts together with the IP address in order to detect and fend off attacks on user accounts.
- When you register and when you start free calculations, we limit how often this is possible from any one internet connection (at most three new accounts within 24 hours and six free calculations per day). For this purpose, we do not store your IP address but a hash value derived from it with a secret key, and we delete it after 7 days.
- When you register, your browser solves a short computational task that makes automated registrations more difficult. The task is set by our server; no data are transmitted to third parties and no cookies are set.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure operation, the protection of user accounts and a fair distribution of the free computing capacity. The logs are deleted after 14 days unless they are needed to investigate a specific security incident.
4. Cookies and similar technologies
We store information in your browser (cookies and local storage) only insofar as this is strictly necessary for the functions you use (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act – TDDDG) or you have given your consent (Section 25(1) TDDDG).
| Name | Type | Purpose | Duration | Basis |
|---|---|---|---|---|
proplab_session | cookie | sign-in to the customer account | 24 hours | technically necessary |
proplab.cfd.hintergrund | local storage | view setting in the results viewer | until deleted in the browser | technically necessary |
ccm_consent | local storage | stores your decision in the consent banner | 1 year | technically necessary |
_ga, _ga_34W5B0FT0Q | cookie | Google Analytics, distinguishing visitors | 2 years | consent “Statistics” |
Your decision in the banner applies for 90 days; after that, we ask again. You can change or withdraw it at any time using the “Cookie settings” link at the bottom of every page.
5. Consent management (CCM19)
For the consent banner, we use the CCM19 service of Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany, in the cloud version operated by the provider in Germany. When a page is loaded, your browser loads the banner from the provider’s servers; in the process, your IP address and technical information are transmitted. To document your decision, CCM19 stores a random identifier, your selection and the time.
The legal basis is Art. 6(1)(c) GDPR (proof of consent under Art. 7(1) GDPR). CCM19 processes the data as our processor. The consent records are deleted automatically after one year and one further month.
6. User account
You need a user account for calculations, CAD models and orders. For this purpose, we process your e-mail address and your password; we store the password only as a cryptographic hash value (Argon2). For orders, the customer type (private individual or business), name or company name and contact person, address, country, where applicable the VAT identification number and, optionally, different e-mail addresses for order confirmations and invoices are added.
The free functions may be used by persons aged 16 or over (§ 3(5) of the Terms and Conditions). When registering, you confirm that you are at least 16 years old.
After registration, we send you a link to confirm your e-mail address. Calculations, CAD models, uploads and orders are possible only once your address has been confirmed. We do not accept addresses from disposable e-mail services; to check this, we compare the domain of your address with a list stored on our server.
The legal basis is Art. 6(1)(b) GDPR (contract of use). You can have your account deleted at any time by e-mail to info@tplus-engineering.de; for the retention periods, see section 15.
7. Design, CAD models, reports and own geometries
When you use PropLab, we process your technical inputs (for example aircraft, mission, design space, material), the calculated results, generated CAD models and reports as well as geometries you upload (STEP, IGES, STL). These data are assigned to you via your account.
The calculations run on our server. Uploaded files are checked in an isolated environment and rewritten for further processing; the original file remains on the server and is not passed on. We do not pass on technical project data to analytics or advertising services.
The legal basis is Art. 6(1)(b) GDPR.
To improve our calculation methods, we evaluate results from CFD and FEM orders in the form of derived key figures that do not allow any conclusions to be drawn about you or your geometry. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the further development of the calculation methods. You can object to this at any time (section 16).
Provision and retrieval period
Results, reports and CAD files are available in your account for repeated download for 90 days from the date on which they are first made available. After that, the download is blocked; on request, we make files available again as long as they are still stored with us. The block does not mean that the data are deleted; how long we retain them is set out in section 15.
8. Orders, quotations and commissioned work
When you request a quotation, commission a CFD or FEM analysis or make a purchase online, we process the details from your account, the services ordered, prices, your declarations when ordering (for example consent to the Terms and Conditions and declarations on the right of withdrawal, each with the text version and the time) and the correspondence relating to the order. Analyses are carried out by engineers of Tplus Engineering GmbH on the company’s own systems. The application informs us of new orders by e-mail. We prepare invoices ourselves.
The legal bases are Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (obligations under commercial and tax law).
9. Payment via Stripe
You pay for online purchases (CAD models, token packages) and analyses paid immediately (CFD, FEM) via the payment service Stripe; refunds, for example if we do not accept an order, are also processed via Stripe. The provider for customers in the EEA is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you click “Order with obligation to pay”, you are redirected to a payment page of Stripe; we do not embed any Stripe scripts on our own pages.
We transmit to Stripe: name or company name, contact person where applicable, e-mail address, address, VAT identification number where applicable, amount, description of the service purchased, and a purchase number and a customer number. You enter your payment details (for example your card number) directly with Stripe; we do not receive them. Stripe also processes the data in its own responsibility as a controller, for example for fraud prevention and to meet legal obligations; in doing so, Stripe may also process data in the USA (section 13). More information: https://stripe.com/privacy
If you choose PayPal, Klarna or Amazon Pay at Stripe, the data required for the payment are also passed on to the respective provider, which processes them in its own responsibility as a controller: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg; Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Amazon Payments Europe S.C.A., 38 avenue John F. Kennedy, 1855 Luxembourg.
The legal basis is Art. 6(1)(b) GDPR.
10. Verification of the VAT identification number (VIES)
If you order as a business from another EU member state, we verify your VAT identification number using the European Commission’s VIES confirmation procedure. In doing so, we transmit the VAT identification number and receive the name and address as recorded in the register. The legal basis is Art. 6(1)(c) GDPR (proof of the tax-free supply).
11. E-mail
Sending: The application sends e-mails (for example the link to confirm your e-mail address and a welcome message after registration, confirmations, invoices, password resets) via the Brevo service (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) as our processor. In the process, Brevo processes the recipient address, content and delivery logs. Brevo records opens and clicks only anonymously and in aggregated form, without reference to individual recipients.
Receiving: E-mails to addresses @prop-lab.app are forwarded to our mailboxes via Cloudflare Email Routing (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Our mailboxes are hosted by Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland) and by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, each as our processor.
Contact and help: If you write to us, call us, or use the contact form or the help function in the application, we process your details in order to deal with your request: name, e-mail address, where applicable company and telephone number, and your message; for the help function in the application, additionally your account and where you are in the application (for example the work step and the number of the calculation). The form and the help function forward the message by e-mail to our team; the application does not store it. After submitting the contact form, you receive an acknowledgement of receipt. The legal basis is Art. 6(1)(b) GDPR where the request relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the messages once the request has been dealt with, unless they must be retained as business letters (section 15).
12. Web analytics with Google Analytics and Google Tag Manager
Only if you consent to the “Statistics” category in the banner do we load Google Tag Manager and, through it, Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent, our website does not establish any connection to Google.
Google Analytics records how our pages and the application are used: pages visited, length of stay, approximate location, device and browser, source of the visit and, in the application, the events “account created”, “calculation started”, “CAD model generated”, “report downloaded” and “purchase” (with net amount and purchase number). We do not transmit names, e-mail addresses or technical project data. According to Google, IP addresses from the EU are not stored. The data are deleted after 14 months; the “Google Signals” function is switched off.
The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”. Google may also process data in the USA (section 13). More information: https://policies.google.com/privacy
Google Search Console
We use Google Search Console to check how our website appears in Google Search. No script is embedded on our pages for this; Google provides us with aggregated information on search queries and clicks.
13. Transfers to third countries
Google, Stripe, Microsoft and Cloudflare may also process data in the USA. The respective US companies are certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR); in addition, standard contractual clauses apply (Art. 46(2)(c) GDPR).
14. Data backup
We back up the server data daily to a server of our own (Tplus Engineering GmbH) in Leinfelden-Echterdingen. Backups are deleted after 14 days. Deleted data therefore also disappear from the backups no later than 14 days after deletion.
15. Storage period
| Data | Period |
|---|---|
| User account (sign-in data, profile) | until the account is deleted |
| Free calculations without an order | 24 months after the calculation |
| Results, CAD models, reports, uploaded geometries | until the account is deleted, then blocked for up to 10 years, solely as evidence in liability matters |
| Contract data, declarations made when ordering, withdrawals | 10 years |
| Invoices and accounting records | 8 years (Section 147 of the German Fiscal Code – AO, Section 257 of the German Commercial Code – HGB) |
| Business e-mails | 6 years, insofar as they are commercial or business letters |
| Security logs | 14 days |
| Hash values of the IP address (registration, free allowance) | 7 days |
| Consent records (CCM19) | 1 year and 1 month |
| Data backups | 14 days |
Statutory retention periods begin at the end of the calendar year in which the document was created.
16. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
You can lodge a complaint with a data protection supervisory authority, in particular with the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), https://www.baden-wuerttemberg.datenschutz.de
17. No automated decision-making
We do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The automatic optimisation concerns only the geometry of propellers. For fraud prevention in payments, see section 9.
18. Obligation to provide data
We need the information for the account and for orders in order to conclude the contract; without it, we cannot provide the service. Consent to statistics is voluntary and not required to use the services.
19. Changes
We adapt this privacy policy when our data processing or the legal situation changes. The current version is available at https://prop-lab.app/en/privacy (binding German version: https://prop-lab.app/datenschutz)