Privacy policy

Scope of this policy

This policy describes personal data processing by Lichtwerk at lichtwerk.cam. The controller is Wito AI Inh. Simon Lechner, whose contact details appear above. It covers the photo lab, learning paths, camera manuals and available account features.

The photo lab renders previews on your device using prepared teaching images and 3D models. Your exercises are not sent to an AI image service. Simulator captures remain in memory during use. Uploading your own photos is not currently supported.

Website operation and security

Loading the website transmits necessary connection data such as IP address, requested address, time and browser information to the servers. We use this to deliver and secure the service, based on our legitimate interest in reliable operation and preventing abuse (Article 6(1)(f) GDPR).

To limit sign-in attempts, the application processes hashed identifiers, attempt counters and expiry times. If a trusted proxy is explicitly configured, a hashed IP address may also be used. Depending on the action, limiting windows last one or 15 minutes. Expiry ends the restriction; it does not automatically delete the database record.

Cookies and storage on your device

When you request a lifetime price offer, we store a random offer identifier for 30 days in the __Host-lichtwerk-offer cookie (locally: lichtwerk-offer) to keep your requested offer stable. The server stores a hashed identifier, price, offer version, expiry and, where applicable, a random price-test group. After sign-in this can be linked to your account to preserve the offer across devices. The camera selection stays in your browser and does not change the price. We do not collect income, ability to pay or browsing behaviour for price assignment. Any active price comparison is disclosed directly with the offer.

Lichtwerk stores your language, selected scene and camera settings under lichtwerk:v1 and completed lessons under lichtwerk:progress:… in your browser’s local storage. This has no automatic expiry. You can clear it through your browser’s site-data settings. This removes local settings and progress but does not delete a copy in your account.

The __Host-lichtwerk-session cookie keeps you signed in for up to 30 days (lichtwerk-session in local HTTP development). Signing out ends the session. The __Host-lichtwerk-oidc cookie secures a requested Wito sign-in for up to ten minutes and is removed on return. JavaScript cannot access either cookie.

This storage supports the learning, settings and sign-in features you request (section 25(2)(2) TDDDG). Further processing is based on providing the service under Article 6(1)(b) GDPR or security under (f). Lichtwerk currently includes no advertising trackers, analytics tools or external chat widgets. Fonts, teaching images and camera models are served with the application.

Account, learning progress and email

Registration processes your name, email address, language and a password hash, together with verification, session and creation timestamps. Completed lessons and their update time are also stored on the server when you have an account. This provides your account and progress under Article 6(1)(b) GDPR.

Email verification and password recovery send your address and the relevant link through the configured email service. Verification links are valid for 24 hours and reset links for 30 minutes. New links replace previous links of the same kind; used links become invalid. Lichtwerk does not send marketing emails through this feature.

If Wito sign-in is offered and you select it, you are redirected to the Wito identity service. Lichtwerk receives your verified email address, name and provider/user identifier to associate your account. Your identity-provider password is not transmitted to Lichtwerk. This fulfils your requested sign-in under Article 6(1)(b) GDPR.

Payments through Stripe

An available lifetime purchase opens Stripe Checkout for a one-time payment. Access and a purchase record are stored in Lichtwerk after confirmed payment. Refunds and payment disputes can change the access status. Existing subscriptions remain manageable in Stripe’s customer portal. Lichtwerk sends your name, email address, internal user ID and plan details, and receives customer, checkout and subscription identifiers and payment/subscription status. You enter payment details and billing address at Stripe. Lichtwerk’s database does not store full card numbers.

Processing serves the contract and billing (Article 6(1)(b) GDPR), applicable legal retention duties (c), and fraud prevention (f). Depending on the activity, Stripe acts as a processor or an independent controller. Stripe may process data outside the EEA. Its privacy policy, linked below, explains participating entities, recipients, retention and international transfer safeguards.

Retention, export and deletion

Account data and saved progress are retained for the life of the account. You can export your data and request deletion in the account area. Once subscription cancellation is successfully handled, Lichtwerk deletes the account and related progress, identity associations, sessions and subscription records from its application database.

Account deletion does not automatically remove local browser data, email copies or records held by Stripe. Identifiers of processed Stripe events and subscription revocations currently remain separately to prevent replayed payment events from restoring access. An operational deletion schedule still needs to be established for these and expired security records. Billing records subject to statutory retention are retained for the applicable mandatory period; specific legal claims may require further retention.

Contact and your rights

The voluntary feedback form stores your message, selected category and language, optional camera model and rating, a random reference and the submission time in our database. No account or email address is required. Feedback is not public. Contact info@wito.ai with your reference for questions or to request deletion. Please do not include confidential information.

If you contact us, we process your contact details and message to respond. Contract-related requests are handled under Article 6(1)(b) GDPR, other requests under our legitimate interest in responding under (f). Correspondence is kept as long as needed to resolve the request or meet existing evidence and retention obligations.

Subject to legal conditions, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Any consent given can be withdrawn for the future. Contact info@wito.ai to exercise your rights.

You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. The controller’s local authority is the Baden-Württemberg Commissioner for Data Protection and Freedom of Information. Lichtwerk does not make automated decisions with legal or similarly significant effects.