Skip to main content
BiteTheBytes
BiteTheBytesBiteTheBytes

Legal

Privacy policy

Protecting your privacy and your data matters to us, not only since the GDPR but since the company was founded. We only process the data we need to run our business and to provide our products and services. This policy explains which data that is, why we need it, how long we keep it and which rights you have.

Last updated: 2 November 2026Applies to all BiteTheBytes products and services

1. Who is responsible for your data?

BiteTheBytes GmbH
Mainzer Str. 9
36039 Fulda
Germany

Managing Director: Stefan Kraus
Registered at the Fulda District Court, HRB 5804
Email: support@bitethebytes.com

For all questions about data protection and to exercise your rights, write to support@bitethebytes.com or to the postal address above.

2. Visiting our website

Server and CDN logs

When you open a page on bitethebytes.com, your browser automatically transmits technical data: your IP address, the date and time, the requested address, the referring page, your browser and operating system, the amount of data transferred and the response status. Our hosting provider STRATO and our content delivery network Bunny.net process this data to deliver the pages and to keep the service secure and stable. STRATO keeps the IP addresses for at most seven days to detect and fend off attacks. Bunny.net keeps its access logs in Germany for three days and shows them to us only with shortened IP addresses.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and working website.

No cookies, no tracking

Our website sets no cookies. We use no analytics, no tracking pixels, no advertising networks and no fingerprinting. Fonts, icons, images and videos come from our own servers and our content delivery network.

Your browser's local storage keeps your light or dark mode and a few display settings, for example whether you collapsed a sale banner. Once you sign in to the customer portal, it also keeps your sign in token. The token is sent only to our own server to identify your account, and signing out removes it. Short lived copies of public page data, such as current offers, stay in your browser's session storage until you close the tab. All of this is strictly necessary for the functions you use (§ 25(2) No. 2 TDDDG) and needs no consent. You can delete it at any time in your browser settings.

Content from other providers, only when you ask for it

  • Checkout: the FastSpring checkout loads only when you start a purchase (see section 4).
  • Videos in the documentation: videos hosted on YouTube or Vimeo load only after you click to play them. From that moment the provider receives your IP address and the address of the page and may set cookies or similar technologies. YouTube videos are embedded in the privacy enhanced mode (youtube-nocookie.com). Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. Legal basis: your consent by clicking, Art. 6(1)(a) GDPR and § 25(1) TDDDG.
  • Social networks: the links to our profiles on YouTube, Instagram, X and Discord are plain links. The platforms receive data only when you follow them.

Security reports

To protect the site against injected content, your browser may report blocked content to our server (content security policy). Such a report contains the address of the page, the blocked resource and details of your browser. Our server writes it to its error log without your IP address and deletes it after 14 days.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in the security of the website.

3. Your customer account and the customer portal

Your customer account is created when you buy a product, register, redeem a product key or, if you were a World Creator customer before, when we moved your account from our previous license system. For your account we store your name, email address, preferred language and time zone, your contracts, licenses and seats with purchase, maintenance and subscription dates, order and subscription numbers, links to your invoices at FastSpring and the devices on which you use our applications (see section 5).

Password and sign in. Our system generates your password and sends it to you by email; we store it only as a cryptographic hash. You can request a new password at any time. Failed sign in attempts are counted to stop password guessing; after five failures within fifteen minutes the account is locked for a short time. When you sign in to the customer portal, your browser receives a sign in token that becomes invalid after 30 days without use.

Two factor authentication. If you switch it on, we store the secret key encrypted and your recovery codes only as hashes. After the fifth wrong code in a row, we warn you by email and include the IP address of the attempt.

Activity log. For changes in your account, for example inviting team members, assigning seats or removing devices, we keep a log with the date, the action, the person who acted, the IP address and the browser identification. Account owners see these entries in the portal without IP addresses and browser details.

Company accounts. If an account manager adds you to a company account, we receive your email address from them and send you an invitation. Managers and co-managers see the names and email addresses of members and seat holders and the devices they use (device name, operating system, application version, last use), but not their IP addresses. If you redeemed a key from a reseller, your account shows the reseller's company, name and email address.

Legal basis: Art. 6(1)(b) GDPR for providing your account and licenses; Art. 6(1)(f) GDPR for protecting accounts against misuse and for documenting changes, and, for members of company accounts, the legitimate interest of the company to manage its licenses.

4. Purchases through FastSpring

Our products are sold through FastSpring (Bright Market, LLC, Santa Barbara, USA), which acts as reseller and merchant of record. FastSpring runs the checkout and handles payment, taxes and invoices in its own responsibility and under its own privacy policy (fastspring.com/privacy). Your payment details, such as card or bank data, never reach us. The checkout also loads services that FastSpring uses for payment methods, fraud prevention, error reports and its own statistics; FastSpring is responsible for them as well.

After a purchase, FastSpring notifies us of the order. From these notifications we use your name and email address, the products, order and subscription numbers, applied coupons, the link to your invoice and payment events such as renewals, failed payments, cancellations, refunds and chargebacks. We keep the notifications in the form we receive them as part of our accounting records; they can contain further details you entered at checkout, such as company, address or VAT ID. The billing page of the customer portal loads your orders and invoices from FastSpring when you open it. When you cancel or reactivate a subscription or change the number of seats in the portal, we pass this instruction to FastSpring.

Legal basis: Art. 6(1)(b) GDPR for providing what you bought; Art. 6(1)(c) GDPR together with § 147 AO and § 257 HGB for keeping order and accounting records.

5. Our desktop applications

Sign in. Byte Installer, Byte Editor, Material Creator and World Creator work with your BiteTheBytes account. Your email address and password are sent to us only when you sign in; the application does not store your password. It then uses a sign in token, which it keeps in the secure credential store of your operating system (Windows Credential Manager, macOS Keychain or the Linux secret service) until you sign out.

License checks and devices. To check your license, the application sends the sign in token together with a device identifier, the name of your computer, the operating system and the application version. Byte Editor, Material Creator and World Creator repeat this check every 15 minutes while they run, Byte Installer at the start and before each build. The device identifier is a one way hash of an identifier of your operating system installation; the original value never leaves your device. For each device we store the identifier, its name, the operating system, the application version, the time of the last check and the IP address it came from. This lets you and your account managers see and release devices in the customer portal and lets us enforce the number of devices per license. A signed copy of your license, which includes your email address, stays on your device so that the application keeps working for up to 14 days without an internet connection.

Older versions of World Creator, up to 2026.4, activate through our previous activation service, which passes your email address, your password, a hardware ID, the build date and the operating system to our platform. We store the activation like a device of a current application.

Updates. Byte Installer, Byte Editor, Material Creator and World Creator look for updates shortly after the start and then about every twelve hours. An update check sends the application version and build, the operating system and its version, the processor architecture, the installation type, the update channel and the interface language, together with the sign in token and the device identifier. We use this data only to select the right update and do not store it. Updates are downloaded from our download server at Bunny.net through a link that is valid for five minutes.

No usage statistics. Our applications send no usage statistics, analytics or telemetry. Crash reports stay on your device; you decide whether to send one to our support.

Setup. Before installing, the Windows setups of our applications check whether www.bitethebytes.com can be reached. This request contains no personal data apart from the IP address that every connection carries.

Connections to other providers. Some features connect to other providers, but only when you use them:

  • Maps in World Creator: if you enter your own MapTiler key in the settings, World Creator loads map, elevation and satellite data and the place search directly from MapTiler AG, Switzerland. MapTiler receives your IP address, the map areas you view and your search terms and processes them under its own privacy policy. We do not provide a key and receive none of this data.
  • NVIDIA DLSS: on Windows with a supported NVIDIA graphics card, World Creator 4 loads NVIDIA's DLSS software. World Creator itself sends no data to NVIDIA.
  • Video export in Material Creator: if you export a turntable as an MP4 video and FFmpeg is not installed on your computer, Material Creator downloads FFmpeg from the server of its distributor (gyan.dev on Windows, evermeet.cx or osxexperts.net on macOS, johnvansickle.com on Linux). That server receives your IP address.
  • Websites and servers in Byte Editor: a web card on a canvas board loads the website you entered, and that website receives your IP address and may set its own cookies. Byte Editor connects to SFTP, FTP and Git servers only when you set them up.
  • Byte Installer loads the current list of known prerequisites from our content delivery network once a day. Downloads of the WebView2 runtime from Microsoft, of build tools and prerequisite files, and the use of code signing services happen only on your request and go directly to the provider concerned. Installers you build with Byte Installer do not contact us; if you configure prerequisite downloads, your installers load them from the addresses you entered.
  • MCP servers: the MCP servers built into Material Creator and World Creator run locally on your computer and talk only to the AI client you choose. What your AI client does with the data is governed by its provider.

Older versions of World Creator 3. Up to version 2026.4, World Creator 3 also connects to our former servers world-creator.com and world-creator.de, which STRATO hosts as well: at every start to load interface translations, news and the latest version number, and when you open sample projects or templates. These requests contain your IP address and the application version; our servers log them for 30 days. After a crash, these versions ask whether to send a crash report. If you agree, it contains your email address, the application version, the operating system and its language, the error details, your last actions in the application and details of your graphics card.

Legal basis: Art. 6(1)(b) GDPR for licenses and updates; Art. 6(1)(f) GDPR, our legitimate interest in preventing misuse of licenses; for crash reports your consent, Art. 6(1)(a) GDPR.

6. Contact, support and applications

Support. You can reach our support through the contact form, through tickets in the customer portal or by email to support@bitethebytes.com. We process your name, email address, the subject, category, product or license concerned, your message and any attachments, and for emails also the technical message headers. Support requests are handled in our own ticket system on our servers in Germany. Attachments are stored privately and are shown only through links that expire after one hour; images you upload in the portal but do not send are deleted after 24 hours. Emails arrive in our mailbox at STRATO; once they are in the ticket system, we delete them from the mailbox after 90 days. Legal basis: Art. 6(1)(b) GDPR where your request concerns a contract or a purchase, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering your request.

Discount applications. If you apply for an education, nonprofit or other discount, we process your name and email address, your role, the name, address and tax number of your institution, a contact person, an internal order reference, your intended use and, if you upload one, a proof document. If we offer you a quote, we pass your name, email address and the institution's name and address to FastSpring, which creates the quote.

Reseller applications. If you apply as a reseller, we process your company name, website, country, VAT ID, a contact person, your intended use, the requested discount and, if you upload one, a proof document.

Legal basis for applications: Art. 6(1)(b) GDPR, steps prior to a contract at your request.

7. Submitting artwork to our gallery

When you submit artwork, we receive your first and last name, your email address, an optional link to your profile and the image, which we convert to our own image format. If we publish it, the gallery shows the image with your name, the link you entered and the year; your email address is never published. With the submission you confirm that you own the rights and agree to the publication. You can withdraw this consent at any time; we then remove the image from the gallery. If we decline a submission, we delete the image right away. Legal basis: your consent, Art. 6(1)(a) GDPR.

8. Newsletter

If you subscribe, we send a confirmation email to the address you entered, and your subscription only starts when you click the link in it. Until you confirm, we keep your email address, the language, the time and your IP address as proof of the request; the confirmation link is valid for 48 hours. Once you confirm, your address is stored with our email service provider Brevo, not on our own servers. Brevo records when newsletters are delivered, opened and clicked, so that we can check delivery and see which topics interest our readers.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can unsubscribe at any time through the link in every newsletter or on bitethebytes.com/newsletter/unsubscribe. We then remove your address from our newsletter list.

9. Emails we send you

We send emails about your account, your licenses and purchases, invitations, support replies and security events through Brevo. Each email contains what its purpose requires, for example a new password, license details, the text of a support reply or, for a security warning, the IP address of a failed sign in. When your email program loads images, it fetches our logo from our content delivery network and a counting pixel from Brevo, and links lead through Brevo. Brevo counts openings and clicks of these emails only anonymously, in overall numbers, without linking them to your email address or IP address. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for security warnings and the anonymous delivery statistics.

10. Who receives your data

We use the following service providers, who process data on our behalf and according to our instructions:

  • STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany: hosting of our website, customer platform, database and email mailboxes, and of our former World Creator servers.
  • BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia: content delivery network and storage of our downloads.
  • Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany: sending of emails and of our newsletter.

FastSpring receives the data you enter at checkout as an independent controller (see section 4). We pass data to authorities only where the law obliges us to. We do not sell personal data.

11. Transfers outside the European Union

Our website, customer platform and license and update services run on servers in Germany. Bunny.net is a company in the European Union and stores its logs in Germany; if you are outside the EU, it delivers content to you from a server near you. FastSpring processes the data of the checkout in the USA, and Google and Vimeo may process data in the USA once you start a video. All three are certified under the EU U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision.

12. Social networks and advertising

We run profiles on YouTube, Instagram, X and Discord. When you visit them, the platform operators process your data under their own privacy policies. For the statistics they show us about our profiles, we may be jointly responsible with the operator (Art. 26 GDPR). We also advertise on social networks and video platforms. Our website contains no tracking pixels or conversion tags of these platforms, so they do not learn from us whether you visited our website or bought something.

13. How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires us to keep it. In detail:

  • Account data as long as your account exists. When you ask us to delete your account, we delete or anonymize your data, except records we must keep by law.
  • Order and accounting records, including FastSpring notifications, contracts and invoices, for the periods required by commercial and tax law (§ 147 AO, § 257 HGB), up to ten years.
  • Devices as long as the license they belong to exists; for a device that was removed, we delete the IP address 30 days after the removal.
  • Activity log: IP addresses and browser identification after 90 days, the entries themselves after three years.
  • Sign in tokens 30 days after their last use.
  • Support requests three years after the last entry; emails in our mailbox 90 days after they reached the ticket system; images you upload in the portal but do not send after 24 hours.
  • Applications: proof documents six months after our decision, declined or expired applications entirely after six months, approved applications as long as your account exists.
  • Gallery submissions as long as the artwork is published; for declined submissions the image right away and your name and email address after six months.
  • Newsletter until you unsubscribe; unconfirmed subscription requests after 30 days.
  • Logs: STRATO deletes the IP addresses of visitors after at most seven days, Bunny.net its access logs after three days, our server its error log after 14 days and the request logs of our former World Creator servers after 30 days.
  • Backups: data we delete also disappears from our database backups as these are replaced, usually within 30 days.

14. Your rights

You have the right to access the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on our legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)). To exercise these rights, write to support@bitethebytes.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.

15. Security

All connections to our website, customer platform and applications are encrypted (TLS). Passwords are generated by our system and stored only as hashes. The customer portal offers optional two factor authentication, which is mandatory for our team. Failed sign in attempts are limited. Only staff who need personal data for their work can access it, and our employees are bound to confidentiality.

16. Do you have to provide your data?

You do not have to provide any personal data to visit our website. To buy, activate and use our applications, we need the data described in sections 3 to 5; without it we cannot provide your licenses. We do not make automated decisions or create profiles about you (Art. 22 GDPR).

17. Changes to this policy

We update this policy when our services or the law change. The current version is always available on this page, and the date at the top shows the last change.