Privacy policy

Scope of this policy

This policy describes personal data processing by Lichtwerk at lichtwerk.cam. The controller is Wito AI Inh. Simon Lechner, whose contact details appear above. It covers the photo lab, learning paths, camera manuals and available account features.

The photo lab renders previews on your device using prepared teaching images and 3D models. Your exercises are not sent to an AI image service. Simulator captures remain in memory during use. You can open your own photos in the local editors; they are not uploaded to our servers.

If you develop a RAW image in the browser and continue in the image finish, your browser stores a developed PNG in its local image database (IndexedDB). It does not store the RAW file there. You can reopen the PNG for up to 30 minutes. After that, Lichtwerk deletes it the next time you open the handoff; without another visit, it may remain in local website data. A new handoff replaces the previous PNG. Closing the image in the finish removes the local copy, and you can also clear it through your browser’s site-data settings. Neither the RAW nor the PNG is sent to our servers for this edit.

Website operation and security

Loading the website transmits necessary connection data such as IP address, requested address, time and browser information to the servers. We use this to deliver and secure the service, based on our legitimate interest in reliable operation and preventing abuse (Article 6(1)(f) GDPR).

To limit sign-in attempts, the application processes hashed identifiers, attempt counters and expiry times. If a trusted proxy is explicitly configured, a hashed IP address may also be used. Depending on the action, limiting windows last one or 15 minutes. Expiry ends the restriction immediately. The regular cleanup subsequently removes expired entries from the active database.

Technical container logs are stored in rotating files: at most three files of 10 MB each per container. The host system journal follows its storage-based rotation and has no fixed calendar retention period.

Cookies and storage on your device

When you request a lifetime price offer, we store a random offer identifier for 30 days in the __Host-lichtwerk-offer cookie (locally: lichtwerk-offer). The server stores a hashed identifier, price, offer version, expiry and, where applicable, a random price-test group; the server offer expires seven days after it is created or renewed. The cookie duration does not extend that period. After sign-in this can be linked to your account to preserve a still-valid offer across devices. The camera selection stays in your browser and does not change the price. We do not collect income, ability to pay or browsing behaviour for price assignment. Any active price comparison is disclosed directly with the offer.

Lichtwerk stores your language, selected scene and camera settings under lichtwerk:v1 and completed lessons under lichtwerk:progress:… in your browser’s local storage. Under lichtwerk:evidence:…, we store each lesson’s completed practice-step count, whether the quiz was answered correctly, and the number of wrong attempts. This has no automatic expiry. You can clear it through your browser’s site-data settings. This removes local settings and progress but does not delete a copy in your account.

The __Host-lichtwerk-session cookie keeps you signed in for up to 30 days (lichtwerk-session in local HTTP development). Signing out ends the session. The __Host-lichtwerk-oidc cookie secures a requested Wito sign-in for up to ten minutes and is removed on return. JavaScript cannot access either cookie. When you request Premium sign-in, lichtwerk-account-return remembers only the return to the Premium account page for up to 30 minutes, without an identifier or advertising measurement.

This storage supports the learning, settings and sign-in features you request (section 25(2)(2) TDDDG). Further processing is based on providing the service under Article 6(1)(b) GDPR or security under (f). Optional advertising pixels require separate consent; no chat widgets are embedded. Optional first-party campaign measurement is described below. Fonts, teaching images and camera models are served with the application.

Optional campaign measurement

When enabled and you consent, Wito AI stores a random browser identifier in __Host-lichtwerk-measurement (locally: lichtwerk-measurement) for 30 days. The Lichtwerk database stores its hash, consent time and version, expiry, language and registered campaign identifiers. We link this attribution to subsequent visits, watched video portions, visible offers, selected camera models, started and completed course actions, requested quotes, verified email registrations, created checkouts and confirmed purchases, including refunds. For the photo challenge, consented events cover starting, taking a photo, successful completion, requesting a hint, skipping and clicking the offer. For variant comparisons, we also record a registered test version, the displayed scene and the campaign entry. On a test link, a stable scene assignment is derived from the existing consented browser identifier; no new browser identifier is created. Events are deduplicated separately for each variant. Generated images are not transmitted, and completing a challenge is not counted as a purchase. Video portions count played segments while the browser window is visible; no session recording is stored. Browser events are deduplicated by browser, day and event; registration, quote and checkout events are also deduplicated using hashed internal references. Measurement does not collect full browsing URLs, search terms, IP addresses, photos or platform click identifiers, and does not transfer measurement data to advertising platforms. Technical connection data required to operate the website is separate.

For a consented passwordless checkout, we also record whether the first successful send used a new or existing account. For the original offer, we keep the language, entry page and timestamps for mail-server acceptance, link confirmation, sign-in and checkout creation. Mail-server acceptance does not prove delivery or opening. If you open the link in another browser, measurement remains tied to the originally consented offer; this does not grant consent in the new browser. This measurement record contains no email address, account identifier, sign-in tokens or checkout URLs. We delete it with the original marketing identifier upon withdrawal or expiry. A created checkout is not a paid purchase.

When our Matomo connection is approved and enabled, we use our self-hosted Matomo instance at stats.wito.ai for page views and funnel events. Its script loads only after your explicit statistics consent. Matomo receives a pseudonymous 16-character visitor ID, normalized page paths with a validated language code and registered campaign tags only, without other query strings, fragments or account data, and connection data needed to deliver the request. Funnel events also include the language code. Matomo cookies are disabled. Withdrawal stops future Matomo calls; data already sent is not automatically deleted by that action.

The purpose is to evaluate our content and offers, based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Price assignment does not depend on consent or campaign. Learning and buying remain available without measurement. Withdraw through Privacy settings to delete this browser’s marketing identifier, events and quote links. Required purchase records are unaffected. Please withdraw on each device if you use several.

Attribution stops being included after 30 days and is deleted from the active database on the next status, attribution, report or cleanup operation. This expanded measurement scope requires renewed explicit consent. A necessary withdrawal guard in local storage (lichtwerk:statistics-withdrawn) and the lichtwerk-statistics-withdrawn cookie (up to 180 days) stops further statistics requests after withdrawal even if the connection fails, until you consent again. A decline is remembered for 180 days in lichtwerk-measurement-choice (prefixed __Host- on HTTPS), a necessary privacy preference without a marketing identifier. Clearing browser data does not erase existing server data; it expires as described. Reports describe consenting browsers, not all visitors.

Optional advertising measurement: Meta and TikTok

When offered in Privacy settings and individually selected by you, we use Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and TikTok Pixel (TikTok Technology Limited, Dublin, Ireland, and TikTok Information Technologies UK Limited, London, UK). Purposes are measuring visits and interest in offers, evaluating ads and building advertising audiences. Each provider loads only after your consent. First-party Lichtwerk statistics are a separate choice.

A pixel transmits IP address, browser/device information, page address, potentially referrer and cookie identifiers. Providers may combine this with their other data and your account for measurement and personalized advertising. We do not enable advanced matching with emails or phone numbers, automatic form events or session replay. We report page views, pricing-page interest and independently verified Premium purchases with product identifier, paid total, currency and a random event identifier. Consent must predate the purchase and still be valid. Purchase clicks, complimentary access and test payments are not purchases. Withdrawal also deletes our pixel-purchase linkage.

The legal bases are your consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. Refusal does not affect learning or purchases. Meta may use _fbp/_fbc cookies (typically up to 90 days); TikTok may use _ttp, ttclid and ttcsid session identifiers (provider-dependent, up to 13 months). Necessary lichtwerk-ads-choice and, on consent, random lichtwerk-ads-receipt cookies last at most 180 days (prefixed __Host- on HTTPS). We retain the receipt hash, selected providers, configuration/text version and timestamps with a validity of at most 180 days; expired receipts are deleted on a subsequent receipt, choice or regular cleanup operation.

Use Privacy settings to withdraw individual providers or all optional purposes. We stop pixels, remove accessible provider cookies, reload the page and delete our advertising receipt linkage. A necessary local withdrawal guard (lichtwerk:advertising-withdrawn) prevents reactivation after network errors until you explicitly consent again or clear browser storage. Withdrawal does not retroactively delete data already received by providers. Their linked privacy policies explain rights and retention. Withdraw separately on each device.

Processing outside the EEA is possible, including Meta in the USA and TikTok international group processing. Provider policies explain transfer safeguards, such as adequacy decisions and standard contractual clauses, and remaining risks. Collection and transmission to Meta may involve joint controllership under Article 26 GDPR and the linked controller addendum. Subsequent processing follows provider terms. Technical blocking alone does not replace review of provider agreements and actual operating settings.

• Meta Privacy Policy ↗
• Meta Controller Addendum ↗
• TikTok Privacy Policy ↗
• TikTok Business Products Terms ↗

Account, learning progress and email

Registration with a password processes your name, email address, language and a password hash, together with verification, session and creation timestamps. For an account, the server also stores completed lessons, the curriculum version, completed practice steps, correct quiz answers, wrong attempts and the update time. These learning records are included in the account data export. This provides your account and progress under Article 6(1)(b) GDPR.

For passwordless checkout, you enter your email address. We use your existing account or create a new account with a generic account name and no password. You are signed in only after confirming the requested link. The checkout sign-in link is valid for 20 minutes and can be used once. We store only the token hash and temporarily associate it with the selected offer, purchase information and language. This association is removed when the link is used; expired links are deleted during regular cleanup. A new checkout link replaces the previous one; changing your password or deleting your account invalidates it. This fulfils your requested checkout sign-in under Article 6(1)(b) GDPR.

Email verification and password recovery send your address and the relevant link through the Brevo transactional email service. Verification links are valid for 24 hours and reset links for 30 minutes. New links replace previous links of the same kind; used links become invalid. Lichtwerk does not send marketing emails through this feature. Brevo retains transactional logs for all senders for one month and does not store previews of new messages. For transactional emails, Brevo links opens and clicks to the individual recipient by default.

Photography tips and offers by email are optional. We record your consent only if you select the separate box and confirm your email address. We store the choice, source, language, notice version and time, and also record withdrawal. The legal basis is Article 6(1)(a) GDPR. You can unsubscribe in your account at any time. We do not send marketing emails without confirmed consent. These records remain with your account until deletion; legally required records may be kept longer. This choice is separate from analytics and advertising privacy settings.

If Wito sign-in is offered and you select it, you are redirected to the Wito identity service. Lichtwerk receives your verified email address, name and provider/user identifier to associate your account. Your identity-provider password is not transmitted to Lichtwerk. This fulfils your requested sign-in under Article 6(1)(b) GDPR.

Payments through Stripe

An available lifetime purchase opens Stripe Checkout for a one-time payment. Access and a purchase record are stored in Lichtwerk after confirmed payment. Refunds and payment disputes can change the access status. Existing subscriptions remain manageable in Stripe’s customer portal. Lichtwerk sends your name, email address, internal user ID and plan details, and receives customer, checkout and subscription identifiers and payment/subscription status. You enter payment details and billing address at Stripe. Lichtwerk’s database does not store full card numbers.

Processing serves the contract and billing (Article 6(1)(b) GDPR), applicable legal retention duties (c), and fraud prevention (f). Depending on the activity, Stripe acts as a processor or an independent controller and retains data under its own legal, service and fraud-prevention criteria; this retention does not follow deletion of a Lichtwerk account. Stripe may process data outside the EEA. Its privacy policy, linked below, explains participating entities, recipients, retention and international transfer safeguards.

Offer information and purchase confirmations

For a requested price offer, we store the supplied purchase information with its price, scope, language and provision time. After confirmed payment, we store the corresponding purchase confirmation, including your name, verified email address and payment reference. It is sent through the configured email service and can be downloaded in the associated account. Failed delivery is retried. A confirmation is not a newsletter and does not depend on advertising consent.

This processing supports pre-contract steps, contract performance and statutory information and evidence duties (GDPR Article 6(1)(b) and (c)). Changes to the offer do not overwrite existing purchase records. Account deletion removes the account link; necessary contractual records and delivery status are retained separately for applicable statutory retention duties and, where necessary, the defence of legal claims.

Withdraw from a contract

If you use the withdrawal function, we store your name, contract identification, email address, language, declaration, receipt time and a random request reference. We also store the review status and technical acknowledgement-delivery information. Our email service sends an acknowledgement containing your declaration and its receipt time to the address you provide. No account or advertising consent is required.

Processing handles your contractual declaration and the legally required acknowledgement (Article 6(1)(b) and (c) GDPR). Form data is not used for advertising or conversion measurement. Hashed recipient identifiers and time-limited attempt counters help prevent abuse. Submitting a declaration does not trigger an automated decision about a refund entitlement.

Withdrawal records remain separate from any deleted user account while needed for handling, evidence or statutory retention. Contact info@wito.ai with your request reference for related questions.

Partner programme

If the partner programme is enabled and you apply, we link your verified account to the application status. We keep the time, language, version, URL and SHA-256 hash of the partner terms you accepted, plus code issuance and later review decisions. When self-service enrollment is enabled, explicit acceptance of the current terms creates a personal code. We process this for the pre-contract steps you request and any subsequent partner agreement (GDPR Article 6(1)(b)).

For an assigned partner code we record the code, assignment, redemptions and their times. For a genuinely paid purchase we keep the purchase, tax, contract-receipt, refund and dispute details needed to review a commission draft, including its amount and status. The partner profile shows only its own codes and aggregate redemption and purchase counts, commission amounts, dates and status, never referred buyers' names or email addresses. An explicitly redeemed voucher code is used to calculate the discount and assign the partner; optional browser and platform measurement still requires the relevant separate consent. Private operator review supports accounting and prevents duplicate or ineligible awards (GDPR Article 6(1)(b), (c) and (f), as applicable).

If an account deletion request involves an unsettled commission, we pause automatic deletion, open a private review case and pause a partner's code. We promptly review which minimal data remain necessary for accounting, tax duties or specific claims and which account and marketing data can be removed. Financial review records are separate from the public profile. The request is neither a blanket waiver of rights nor permission to retain the whole account indefinitely. Contact info@wito.ai for questions or access requests.

Retention, export and deletion

Account data and saved progress are retained for the life of the account. You can export your data and request deletion in the account area. Once subscription cancellation is successfully handled, Lichtwerk deletes the account and related progress, identity associations, sessions and subscription records from its application database.

If a partner account or a referred buyer's account is linked to a commission record, automatic deletion pauses. We record the request for private settlement review; a partner's own deletion request also pauses their code. Contact info@wito.ai with questions. We review which data must be deleted or retained for a limited purpose. This pause does not trigger a payout.

Expired sign-in sessions, email-verification and password links, Wito sign-in attempts, rate-limit records and expired measurement and advertising-consent identifiers are regularly deleted from the active database. In the supplied deployment, cleanup processes bounded batches and restarts one hour after the previous cycle finishes. Outages, records still being processed or backlogs may delay removal; expired sign-in data does not become valid again. We create one local database backup per day on the same host for the Lichtwerk database. We retain at most 35 local archives. After a new backup has been validated successfully, the oldest archive is removed if the limit is exceeded. Local backups may contain data that has already been deleted from the active database.

Account deletion does not automatically remove local browser data, email copies or records held by Stripe. Identifiers of processed Stripe events and subscription revocations are stored separately as long as they are needed to prevent replayed payment events or handle payment disputes. Billing records subject to statutory retention are retained for the applicable mandatory period; specific legal claims may require further retention.

Contact and your rights

The voluntary feedback form stores your message, selected category and language, optional camera model and rating, a random reference and the submission time in our database. No account or email address is required. Feedback is not public. Contact info@wito.ai with your reference for questions or to request deletion. Please do not include confidential information.

If you contact us, we process your contact details and message to respond. Contract-related requests are handled under Article 6(1)(b) GDPR, other requests under our legitimate interest in responding under (f). Correspondence is kept as long as needed to resolve the request or meet existing evidence and retention obligations.

Subject to legal conditions, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Any consent given can be withdrawn for the future. Contact info@wito.ai to exercise your rights.

You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. The controller’s local authority is the Baden-Württemberg Commissioner for Data Protection and Freedom of Information. Lichtwerk does not make automated decisions with legal or similarly significant effects.