Privacy policy
Version 2026-11-11, effective from [Missing: Effective date]. This is a translation; the German version is authoritative.
Draft, not legally reviewed
The essentials
- No tracking, no analytics tools, no advertising, no profiles.
- No third-party content: font, scripts and images come from our own servers in the EU.
- Cookies only for signing in, the language and the appearance (light, dark, automatic).
- Payment is handled by Stripe. We never see your card details.
- The MRI images show the founder himself; no patient data is processed.
1. Controller
The controller is [Missing: Name of the provider], [Missing: Street and number], [Missing: Postcode and town], Austria, email [Missing: Email address], telephone [Missing: Telephone number].
For all questions about data protection and for your rights, write to [Missing: Email address]. We have not designated a data protection officer because, in our assessment, there is no obligation to do so (Art. 37 GDPR).
2. What data we process and why
2.1 Visiting the website and server logs
When you open RadLayers, our server processes technically necessary connection data: IP address, time, requested address, amount of data transferred and your browser identifier. Without this data the page cannot be delivered. The logs of our application contain the type of request, path, result, duration and a sequence number, but no IP addresses. [Open: Check the logs of the upstream web server or proxy at the hosting provider (whether and for how long IP addresses are stored)]
To protect against abuse, such as mass sign-in attempts, we count requests in short time windows of at most one hour, per connection and, for signing in and resetting the password, also per account. The counters contain neither the IP address nor the email address, only a check value derived from them with a random key that we create anew every day and delete afterwards. After that, a counter can no longer be linked to any address. The counters are deleted at the latest about one hour after the time window has expired.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.
2.2 Access through the network of an institution
If an institution, such as a hospital, has a licence for its network, we compare your IP address with the registered network ranges on every request. The IP address is not stored for this; we keep the result in memory for a few minutes at most so that not every request has to check again. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of the institution is to provide the agreed access without a personal account.
For the institution we count usage as daily totals (such as the number of sessions and opened modules). To count sessions we use a value derived from random data that is created anew every day and deleted afterwards. After that, the figures can no longer be linked to any person or device. The institution receives only these totals.
2.3 Account
For your account we store name, email address, password (only as a secure hash), whether the email address is confirmed, role, the version of the accepted terms with the time of acceptance, and the date of creation. The legal basis is Art. 6(1)(b) GDPR (contract for the account). Without these details we cannot keep an account.
RadLayers stores your viewer settings (appearance, languages, last chosen series and slice per module) in your browser and, when you are signed in, in your account so that they apply on all your devices. The legal basis is Art. 6(1)(b) GDPR.
2.4 Sign-in and session
When you sign in, we create a session and set a session cookie (section 8). With the session we store only the time and the expiry; we do not store the IP address or the browser identifier. A session lasts at most 30 days and is deleted after it expires. The legal basis is Art. 6(1)(b) and (f) GDPR.
2.5 Subscription and payment through Stripe
When you take out a subscription, we forward you to Stripe’s payment page. There Stripe collects payment details, billing address and, if applicable, your VAT identification number. We send Stripe your name, your email address and an internal identifier of your account. From Stripe we receive the customer number, type and status of the subscription, term and payment events, but no card or bank details.
The provider is Stripe Payments Europe, Ltd., Ireland. Stripe processes the data partly on our behalf and partly as a controller in its own right, for example to prevent fraud and to meet its own legal obligations. Data may be transferred to the USA in the process. [Open: Confirm Stripe’s role (processor or own controller) and the basis for transfers to the USA from Stripe’s current contract documents] More information: Stripe privacy policy(opens in a new tab).
The legal basis is Art. 6(1)(b) GDPR (contract for the subscription) and, for keeping accounting records, Art. 6(1)(c) GDPR (obligations under tax and commercial law).
2.6 Ordering: declarations on the immediate start
Before you reach the payment page, you request the immediate start of the service on our order page and confirm the consequences for the right of withdrawal (FAGG). For this we store your account, your email address, the chosen subscription, price, language, time, the version of the wording and the version of the terms. The record is kept even after the account is deleted, as long as we need it to defend claims and because of retention obligations. The legal basis is Art. 6(1)(c) GDPR (record and information obligations under the FAGG) and (f) (defence of claims).
2.7 Emails
We send you emails that belong to the account and the contract: confirming the email address, resetting the password, changing the email address, invitations, the order confirmation, the reminder before a yearly subscription renews, notices about payments and about changed terms. We do not send newsletters or advertising. We use [Missing: Email provider] for delivery. The legal basis is Art. 6(1)(b) GDPR.
2.8 Group licences and invitations
Whoever manages a group licence can invite people to a seat by email address. For this we store the invited email address and the status of the invitation. An invitation is valid for 14 days. The managing person sees email address, name and status for each seat, but not how you use RadLayers. The legal basis is Art. 6(1)(b) GDPR (contract for the group licence) and (f) (legitimate interest of the managing body in assigning its seats).
2.9 Error reports
With “Report an error” in the viewer you send us your description and the place in the image (module, series, slice, structure). If you are signed in, we link the report to your account; without an account you can voluntarily give an email address for questions. We use the details only to fix the error and to reply to you if needed. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is an error-free atlas.
2.10 Contact by email
When you write to us, we process your message and contact details to answer the request. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise (f).
2.11 For labellers in the Studio
People who label in the Studio are named in the change history. For planning we also record the time per labelled slice. The legal basis is Art. 6(1)(b) GDPR (agreement on the collaboration).
3. Recipients
- Hosting: [Missing: Hosting provider and location], as a processor under a contract according to Art. 28 GDPR. The servers are located in the EU.
- Email delivery: [Missing: Email provider], as a processor.
- Payment: Stripe (section 2.5).
- Managing body of a group licence: only the details of the seats (section 2.8).
- Authorities and courts: only where we are legally obliged.
We do not sell data and do not pass it on for advertising.
4. Retention
| Data | How long |
|---|---|
| Account and settings | until you delete the account |
| Sessions | at most 30 days, then deleted |
| Counters to protect against abuse | about one hour |
| Daily values for counting sessions in institutions | until the end of the day |
| Open invitations | 14 days, then invalid and deleted or withdrawn |
| Subscription and accounting records | for the term of the subscription; records afterwards for seven years (§ 132 BAO) |
| Record of the declarations made when ordering | for the term of the subscription and seven years afterwards |
| Error reports | until they are dealt with; after account deletion without reference to you |
| Emails with requests | until the request is settled, unless a retention obligation applies |
When you delete your account, we delete your data. Studio accounts (labellers, translators) are anonymised instead because the change history needs the entries. Statutory retention obligations take precedence; we block such data for any other use.
5. Your rights
You have the right to
- access your data (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).
You can do much of this yourself in your account: change name and email address, download all data as a file and delete the account. For everything else, write to [Missing: Email address].
We currently do not process any data on the basis of consent.
6. Complaint to a supervisory authority
You can lodge a complaint with a data protection supervisory authority, in particular in the state of your residence, your place of work or the place of the alleged infringement. The authority competent for us is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at.
7. No tracking, no automated decisions
RadLayers uses no analytics or tracking tools, no advertising networks, no social media plugins and no embedded content from other providers. We serve the Inter font ourselves. There is no automated decision-making, including profiling.
8. Cookies and browser storage
We store only what is needed for the features you expressly use. No consent is required for this because this storage is strictly necessary to provide the service you have expressly requested (§ 165(3) TKG 2021).
| Name | Type | Purpose | Duration |
|---|---|---|---|
| radlayers.session_token | Cookie | Keeps you signed in | until you sign out, at most 30 days |
| radlayers.dont_remember | Cookie | Remembers that you unticked “Stay signed in” | until the browser is closed |
| rl-locale | Cookie | Interface language | 1 year |
| rl-theme | Cookie and local storage | Light, dark or automatic appearance | 1 year, or until you delete it |
| rl-prefs | Local storage | Viewer settings on this device | until you delete it |
| rl-recent-modules | Local storage | Recently opened modules, only on this device | until you delete it |
| rl-terms-prompt | Session storage | Remembers that you postponed the notice about new terms | until the tab is closed |
9. Origin of the images
The MRI scans show the body of the founder, who has agreed to their publication. The image data is anonymised before processing. RadLayers does not process patient data.
10. Changes
We adapt this policy when the service or the law changes. The current version is always on this page. We inform signed-in users about significant changes.
Operating details
- Controller
- [Missing: Name of the provider]
- Data protection contact
- [Missing: Email address]
- Hosting
- [Missing: Hosting provider and location]
- Email delivery
- [Missing: Email provider]
- Supervisory authority
- Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at