Legal
Privacy policy
How Struct4U B.V. handles personal data on struct4u.com, in your account and in our programs. In short: we use your data to provide your licence, account, payments and support, and we use no tracking or advertising cookies.
- Controller
- Struct4U B.V.
- Updated
- 12 October 2026
- Contact
- info@struct4u.com
- Authority
- Autoriteit Persoonsgegevens
- We use your data to provide your licence, account, credit, payments, support and the AI Assistant.
- No advertising cookies, and statistics only with your consent. We don’t sell personal data.
- Payments go through Mollie, our e-mails through Resend, and AI Assistant questions through OpenRouter.
- You can ask to see, correct or delete your data at any time: write to info@struct4u.com.
Who is responsible for your data
Struct4U B.V. is the controller for the personal data described in this policy.
| Company | Struct4U B.V. |
|---|---|
| Address | 'The Mark', Fascinatio Boulevard 216, 3065 WB Rotterdam, Netherlands |
| Chamber of Commerce | 59904305 |
| info@struct4u.com | |
| Phone | +31 (0)10 798 84 67 |
For anything about your personal data, write to info@struct4u.com.
What we collect, and why
2.1 Visiting the website
| Data | Your IP address, the page you ask for, your browser and operating system (user agent) and the time. |
|---|---|
| Purpose | To deliver the pages and protect the site against abuse and attacks. |
| Legal basis | Our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). |
| Kept for | Only as long as needed for security and troubleshooting. |
Language. On your first visit, we pick a language for you from the country that our network provider, Cloudflare, derives from your IP address. For this we keep only that language, in the s4u_lang cookie.
Visit statistics. Only if you accept statistics cookies, we count visits with Google Analytics, loaded through Google Tag Manager.
| Data | A random identifier in a cookie, the pages you visit, where you came from, your device and browser, and your approximate location. Google Analytics doesn’t store IP addresses. |
|---|---|
| Purpose | To see which pages are used, and to improve the site. |
| Legal basis | Your consent (Art. 6(1)(a) GDPR). Withdraw it at any time with “Cookie settings” at the bottom of every page. |
| Kept for | Up to 14 months, the retention period set in Google Analytics. |
The cookie policy lists the cookies. Your account pages never load Google Analytics.
2.2 E-mail and phone
| Data | Your name, e-mail address, phone number, company, and what you write or tell us. |
|---|---|
| Purpose | To answer your question and help you. |
| Legal basis | Taking steps towards, or performing, an agreement with you (Art. 6(1)(b)), or our legitimate interest in answering questions (Art. 6(1)(f)). |
| Kept for | As long as needed to deal with your question and any follow-up. |
2.3 Your account and signing in
| Data | Your name, company, address, country, phone number, e-mail address and VAT number. When you sign in: your e-mail address, a one-time code, your IP address and browser, and whether the attempt succeeded. |
|---|---|
| Purpose | To give you access to your account, keep it secure and prevent misuse. |
| Legal basis | Performing our agreement with you (Art. 6(1)(b)); for security, our legitimate interest (Art. 6(1)(f)). |
| Kept for | Sign-in codes are valid for 10 minutes; used and expired codes are deleted. Account details: as long as you have an account or licence with us. |
2.4 Your licence and credit
| Data | Your Struct4U key and licence password, your licence and your credit balance. Each time a program starts or uses credit: which program, the time, your IP address, and your computer’s MAC address and processor ID. |
|---|---|
| Purpose | To check your licence, charge pay-per-use credit by the minute, apply the yearly maximum per computer, and show you your usage. |
| Legal basis | Performing our agreement with you (Art. 6(1)(b)). |
| Kept for | As long as your licence is active, and after that as long as needed to settle questions about charges. |
2.5 Feature use and crash reports
| Data | Which functions of which program version are used, and when, linked to your licence. If XFEM4U crashes: the program version, Windows version, .NET runtime, language setting, memory use, running time, the technical error details, your licence key, company name and the name of the file that was open. |
|---|---|
| Purpose | To find and fix errors, and to see which parts of the programs are used, so we know what to improve. |
| Legal basis | Our legitimate interest in reliable software (Art. 6(1)(f)). |
| Kept for | Crash reports: 12 months after the crash last occurred. Feature use: as long as needed for this purpose. |
A crash report can include a check of your licence key and password. We use it only to confirm that the report is genuine, and we don’t store the password.
2.6 Payments and invoices
| Data | Your name, company, address, e-mail address and VAT number; what you bought, the amount, VAT, payment method and status, and the Mollie payment reference. For monthly AI plans, Mollie also keeps a customer record and a mandate for the recurring payment. |
|---|---|
| Purpose | To take payment, send invoices and keep our accounts. |
| Legal basis | Performing our agreement (Art. 6(1)(b)) and our legal obligation to keep accounts (Art. 6(1)(c)). |
| Kept for | Seven years, as Dutch tax law requires for business records. |
You pay on Mollie’s payment page. Your card or bank details go to Mollie, not to us.
2.7 The AI Assistant
| Data | The questions you ask and the conversation so far. For each question we record the time, the AI model, the amount of text processed (tokens), the cost and your licence key or account. We don’t store the text of your questions or of the answers. |
|---|---|
| Purpose | To answer your question from the XFEM4U manual, and to apply the limits of your plan. |
| Legal basis | Performing our agreement with you (Art. 6(1)(b)). |
| Kept for | Usage records: as long as needed to apply plan limits and settle costs. |
Your question travels through our server to OpenRouter, which passes it to the company that runs the AI model. The answers are generated by AI. Don’t put personal or confidential client information in your questions.
2.8 Student licences
| Data | Your student e-mail address and the university or college it belongs to, besides your account details. |
|---|---|
| Purpose | To check that you study at a university or college we know, and to give you a free licence for one year. |
| Legal basis | Performing our agreement with you (Art. 6(1)(b)). |
| Kept for | As long as your student licence runs. |
The check compares the domain of your e-mail address with our list. If your school isn’t on it, write to education@struct4u.com and we look at it by hand.
2.9 Newsletter
| Data | Your name and e-mail address. |
|---|---|
| Purpose | To send you news about our software. |
| Legal basis | Your consent (Art. 6(1)(a)) or, if you are a customer, our legitimate interest in telling you about our own software (Art. 6(1)(f)). |
| Kept for | Until you unsubscribe. |
You subscribe with the form on our site, which sends your address straight to ActiveCampaign. If you have an account, you also get our product news by e-mail, unless you tell us you don’t want it. You can unsubscribe at any time, with the link in every newsletter or by writing to info@struct4u.com.
2.10 Forum and social media
The forum at forum.struct4u.com and our pages on YouTube and LinkedIn are separate services with their own privacy terms. What you post there is public.
2.11 Security logs
| Data | Your IP address, the time, the page asked for, your browser (user agent) and, when our servers refuse a request as an attack, the part of it that was refused. Never passwords. |
|---|---|
| Purpose | To protect the service and its users against attacks. |
| Legal basis | Our legitimate interest in a secure service (Art. 6(1)(f) GDPR). |
| Kept for | 90 days, then deleted automatically. |
Only Struct4U’s administrators can see these logs.
The companies that process data for us
We use these service providers to run our services. Each processes personal data on our behalf, only for the task listed.
| Company | What they do for us | Based in |
|---|---|---|
| Cloudflare, Inc. | Delivers and protects our website and servers; handles IP addresses and requests. | United States |
| Hetzner Online GmbH | Hosts the server for our website, the customer accounts and the programs’ online services. | Germany |
| Exonet B.V. | Hosts our licence administration and its database, which Struct4U runs. | the Netherlands |
| Mollie B.V. | Processes payments. | Netherlands |
| Resend | Sends our e-mails, such as sign-in codes and invoices. | United States |
| OpenRouter, Inc., and AI model providers | Produce the AI Assistant’s answers. | United States; the model provider depends on the model |
| Microsoft (Microsoft 365) | Hosts our e-mail, including messages you send us. | United States |
| Google Ireland Ltd. (Google Analytics, Tag Manager) | Counts visits, only if you accept statistics cookies. | Ireland; data may be processed in the United States |
| ActiveCampaign, LLC | Sends our newsletter and keeps the list of subscribers. | United States |
We share personal data with authorities, such as the Dutch Tax Administration, only when the law requires it. We don’t sell personal data, and we don’t share it for advertising.
Data outside the European Economic Area
Cloudflare, Resend, OpenRouter, Microsoft and ActiveCampaign are based in the United States, Google may process data there, and AI model providers may be based elsewhere. When personal data leaves the European Economic Area, we rely on the safeguards the GDPR requires: an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or the European Commission’s standard contractual clauses.
How long we keep data
- Sign-in codes: 10 minutes; used and expired codes are deleted.
- Crash reports: 12 months after the crash last occurred.
- Security logs: 90 days, then deleted automatically.
- Invoices and payment records: seven years, as Dutch tax law requires.
- Everything else: only as long as needed for the purpose described in section 2.
Security
Traffic to struct4u.com and to our servers is encrypted (HTTPS). Only the people at Struct4U who need personal data for their work can access it.
Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted, unless we must keep it, such as invoices;
- restrict how we use it, or object to use based on our legitimate interest;
- receive the data you gave us in a machine-readable format;
- withdraw your consent at any time, for example for the newsletter.
Write to info@struct4u.com. We may ask you to confirm your identity, and we reply within one month. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
If you are not satisfied with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the country where you live.
Changes to this policy
We update this policy when our services or the law change. The date at the top shows the current version.
Questions about these documents? Write to info@struct4u.com or call +31 (0)10 798 84 67.