Skip to content

Privacy Policy

pursuant to Articles 13 and 14 GDPR · As of: 24 September 2026

This is a translation. Only the German version is legally binding. In case of doubt, the German version prevails.

German original: Datenschutzerklärung

1. Controller

Gäfgen & Gäfgen GbR (LayerLabs 3D)
represented by the partners Nils Gäfgen and Moritz Gäfgen
Im Hähnchen 7, 57612 Birnbach, Germany
Phone: 0170 7705879 · Email: nils.gaefgen@layerlabs3d.io

We are not obliged to appoint a data protection officer (Section 38 of the German Federal Data Protection Act, BDSG). If you have any questions about data protection, please contact us directly using the contact details above.

2. Visiting this website

This website is purely informational. It sets no cookies, does not include any analytics or advertising services and does not load fonts or scripts from third-party servers.

The website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When the website is accessed, Cloudflare processes technically necessary connection data: IP address, time, page accessed, browser identifier and amount of data transferred. This serves to deliver the website and to protect it against attacks. The legal basis is our legitimate interest in a secure and accessible website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); a data processing agreement is in place with Cloudflare. We do not analyse this data ourselves.

3. Orders via Etsy and eBay

We do not sell through this website but through Etsy and eBay. Which data we receive with an order and how we process it is set out in the privacy policy of the respective shop, for example for Living Layer Co. on the Etsy shop page. Etsy and eBay are each independently responsible for the processing on the platforms themselves.

4. Contact by email or phone

If you write to us or call us, we store your details in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). We delete the details as soon as the enquiry has been dealt with, unless a statutory retention obligation prevents this.

5. Our profiles on social networks

We operate business profiles on Instagram (Meta Platforms Ireland Ltd., Dublin), TikTok (TikTok Technology Limited, Dublin) and Pinterest (Pinterest Europe Ltd., Dublin). When you visit these profiles, the respective operator processes your data in accordance with its own privacy policy. The platforms provide us with aggregated statistics on the reach of our posts. We cannot identify individual persons from these. Insofar as we are jointly responsible with the operator for these statistics (Art. 26 GDPR), the agreements provided by the operator for this purpose apply. You can exercise your rights most effectively directly with the operator; however, you may also contact us.

6. LayerLabs 3D Publisher (connection to Instagram, TikTok and Pinterest)

LayerLabs 3D Publisher is our in-house tool with which we publish our own posts on our own business accounts. For this purpose it uses the platforms' official interfaces (Instagram API, TikTok Content Posting API, Pinterest API). Only accounts that belong to us are connected. Every post is individually approved by a person on our team before it is published.

On the platforms, the Publisher is registered under these app names: on Instagram and TikTok as “LayerLabs 3D Publisher”, on Pinterest as “Living Layer Co. Content Planner”.

What data the Publisher processes

  • Access credentials for our own accounts: the access and refresh tokens that the platform issues after we sign in, and the account ID.
  • Basic data of our own accounts: account name, display name, profile picture and account type, insofar as the platform requires them for publishing.
  • Our posts: the images, videos and texts we publish, as well as the IDs, links and status of the published posts.
  • Aggregated metrics on our posts (such as views), where the platform provides them. They are retrieved when needed and are not stored permanently where the platform does not permit this.

Data of other users is not processed: no follower lists, no comments, no direct messages, no profiles of third-party accounts. The data is not sold, not used for advertising and not passed on to third parties.

Specifics for TikTok

On TikTok, the Publisher signs in to our own account via TikTok's Login Kit and uses the Content Posting API. It requests only two permissions (scopes):

  • user.info.basic: the ID of our account (open_id), display name and profile picture.
  • video.upload: upload a video as a draft to the inbox of our TikTok account. The draft is not published by the Publisher but by a person on our team in the TikTok app.

In doing so, the Publisher stores:

  • the open_id of our TikTok account, so that it assigns uploads to the correct account;
  • the access token and the refresh token that TikTok issues after sign-in;
  • for each upload, the publish_id returned by TikTok and the status of the upload.

We use the display name and profile picture for display only, so that before each upload it is visible which account the Publisher is connected to. The video itself goes directly to TikTok during the upload. The Publisher does not read videos, comments, followers or statistics of our own or third-party accounts on TikTok. TikTok (TikTok Technology Limited, Dublin) is responsible for the processing on the platform itself in accordance with its own privacy policy.

Purpose, legal basis, storage location

The purpose is to publish and manage our own posts. The legal basis is our legitimate interest in presenting our products (Art. 6(1)(f) GDPR). The data is stored on our company's computers in Germany. For the internal approval of posts we use Slack (Slack Technologies Ltd., Dublin); only our own post drafts are stored there.

Storage period and deletion

We delete access credentials as soon as we disconnect an account. We keep post IDs for as long as we need them to manage the post, for example to remove it later. After that, we delete them. How you can request deletion or disconnect yourself is described on the Data Deletion page.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw consent you have given at any time (Art. 7(3)). To do so, please use the contact details under section 1.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, www.datenschutz.rlp.de.

8. No automated decision-making

Automated decision-making, including profiling, pursuant to Art. 22 GDPR does not take place.

9. Changes

We adapt this policy when our services or the legal situation change. The version published here applies.