BAMBUWALL PRIVACY NOTICE
Version 1.0 | Effective 5 October 2026

1. CONTROLLER AND SCOPE

Roland Kalman, sole proprietor operating under the TrackBase brand, Pécs,
Hungary, is the controller for TrackBase's BambuWall licensing, product-service
and support processing. Contact: contact@track-base.com . This notice covers
the desktop application and its associated product/licensing/download services.
Other TrackBase services can have their own notices. Bambu Lab and the purchase
merchant operate their own services under their own privacy notices.

This notice informs you about processing. Accepting an installer EULA is not
consent to all processing, and there is no requirement to consent to marketing
to use or buy BambuWall. The application contains no advertising SDK and does
not automatically upload camera recordings or crash reports to TrackBase.

2. DATA ON YOUR COMPUTER AND PRINTER CONNECTIONS

Printer profiles, connection settings, names, addresses, serial identifiers,
access codes and preferences are used locally to connect your printers.
Saved secrets are protected using Windows protection for the current user;
ordinary preferences and some identifiers are readable locally. Your Windows
account, file permissions and backups remain important.

This release connects directly over your local network. It does not provide
Bambu account sign-in, import account sessions or send your Bambu credentials
to TrackBase. On startup and during printer discovery, the application reads
saved local printer profiles and access codes from installed Bambu Studio or
OrcaSlicer configuration files automatically. It imports relevant printer
details without modifying those files or uploading them to TrackBase. You can
edit, disable or remove imported printers. Account settings retained when
upgrading from another build remain protected locally and are not used for
LAN connections.

Camera video and printer status travel between your computer and the printer.
Frames are displayed locally; snapshots you save are written to your selected
folder. TrackBase does not receive the video feed, snapshot contents, model
files or print-job contents through its licensing API. Your slicer and printer
can have their own separate processing under their vendors' notices. If a
camera shows other people or private spaces, you are responsible for the
permissions and lawful use of that content.

3. LICENSING, TRIALS AND DEVICE IDENTIFIERS

To recognise a computer and enforce a single-computer license or trial limits,
the app derives a Client ID from suitable hardware identity information using
a one-way hash. A stable firmware identifier is preferred, with hardware
fallbacks where necessary. The raw hardware identifiers used to calculate it
are not sent to our licensing API. The hash is a pseudonymous identifier,
not anonymous data: it can be linked with a trial, purchase or support request.
The app also maintains installation/device credentials and local cryptographic
keys. Private activation keys remain on the computer.

Licensing requests can contain the product code, Client ID, installation/device
credential, license key when needed, public activation key and proof, request
identifiers and authorisation timestamps. Trial/preview requests also contain
enabled printer serial identifiers, the printer that has shown video or is
requesting a preview, viewing state and a viewing-session identifier. These
let us meter viewing time, count sessions, prevent resets through reinstallation
and apply each printer's preview cooldown. They do not contain camera images.

We keep trial balance/session records, authorisation and activation/release
records, administrative resets or restrictions and relevant security events.
A valid paid activation is checked locally; the app does not periodically
contact the server to renew or recheck that paid license. Separate user actions,
such as deactivation, buying, checking updates or opening a legal webpage,
can still make network requests. A failed or missing activation can return the
app to online trial/activation checks.

The basis for processing necessary to supply the trial and purchased license
is performance of a contract or steps you request before a contract (GDPR
Article 6(1)(b)). Preventing fraud, misuse and duplicate trials, protecting
services and keeping proportionate enforcement records are legitimate interests
(Article 6(1)(f)), subject to balancing them against your rights. Device/usage
records can be associated with a license purchase to measure trial conversion
and aggregate product performance; the basis is our legitimate interest in
understanding and improving the product, subject to that balancing and your
right to object. We do not use these records for advertising profiles or sell
them to data brokers.

If the essential device or authorisation information is not supplied, the trial
or initial activation may not work. Automated counters can restrict unlicensed
viewing when time/session limits are reached or authorisation fails. They do
not decide credit, employment or another similarly significant legal matter.
If you believe a restriction is incorrect, contact us with your Client ID for
human review. A reset is discretionary unless necessary to provide a remedy
or fulfil an obligation owed to you.

4. PURCHASE, UPDATES, WEBSITE AND SUPPORT

The checkout merchant collects the information needed for the purchase, such
as contact and billing details and payment information. We receive relevant
order/customer references, purchase email, product, amount/currency, order
status, license and fulfilment/refund information from the merchant. We do not
receive full payment-card details. Delivery/support are based on the contract;
records required by tax/accounting law are based on legal obligation
(Article 6(1)(c)). Dispute and fraud handling can rely on legitimate interests.

Lemon Squeezy acts as merchant of record where identified at checkout and
processes its transaction data under https://www.lemonsqueezy.com/privacy .
The seller named on your receipt is responsible for its own transaction data.

Update checks contact our product release service with product/current-version
information to retrieve release metadata. Downloads contact the designated
download service. Startup update checks are enabled by default and can be
disabled in Settings; manual checks remain available. These requests, website
visits and licensing calls necessarily expose an IP address and normal HTTP
metadata to the receiving server. Operational/security logs may contain the
time, requested route, response status and user agent. Their purposes are
delivery, service reliability and security, on contract/legitimate-interest
bases as appropriate. Opening a legal link sends the document name in the URL,
not your license key or Client ID.

The product's download/purchase gateways can record aggregate daily counts
of page views, downloads and checkout clicks, with a coarse device category,
referrer host or campaign label where supplied. This aggregate analytics does
not require a tracking cookie or persistent browser identifier and does not
store full referrer URLs or IP addresses as analytics dimensions. The current
aggregate analytics respects browser Do Not Track and Global Privacy Control
signals. Ordinary server security logs are separate. No optional analytics
cookie is required by the BambuWall legal page. An external checkout or future
optional embed may have its own cookie notice and consent requirements.

If you contact support, we receive what you choose to send: contact details,
order references, Client ID, correspondence and attachments. The diagnostic
export is saved locally and is not sent automatically. It can include Client ID,
installation ID, OS/runtime information, printer model/mode and connection
performance/error information; it omits license keys, account tokens and printer
access codes. Review a file before sending it. Do not send passwords, private
keys, unnecessary camera images or payment-card details. Support for your
contract relies on Article 6(1)(b); investigating security/technical issues and
defending legal claims can rely on Article 6(1)(f).

5. RECIPIENTS AND INTERNATIONAL PROCESSING

Access is limited to persons and service providers who need it for the purposes
above. Our infrastructure uses hosting/server providers such as Rackhost Zrt.,
domain/DNS services such as Namecheap, and email infrastructure to operate
TrackBase services and respond to you. Providers process only the information
relevant to their function; a DNS/domain provider does not thereby receive the
contents of your local printer settings. The checkout merchant, professional
advisers or authorities may receive relevant information for payments, legal
obligations, fraud prevention or claims. We do not give hosting providers your
camera feed through the licensing service.

Some external providers, including payment and printer-platform providers,
operate outside the European Economic Area. Their notices explain their own
locations and safeguards. For transfers for which we are responsible, an
applicable GDPR transfer mechanism is required, such as an adequacy decision
or appropriate contractual safeguards; you can contact us for information
about the safeguard applicable to a particular transfer. This notice is not
consent to an unrestricted international transfer. Using Bambu's China region
selects that external service region; it does not move your local video to
TrackBase.

6. RETENTION AND LOCAL DELETION

Local settings and activation information remain until you remove them or the
relevant app/Windows operation changes them. Uninstalling may leave user data,
downloaded components and snapshots in your user folders. Signing out removes
the active app session but does not erase independent slicer sessions, snapshots
or every backup. Review the app data and snapshot folders when retiring a PC.
Deleting activation information can destroy offline paid access; it is not a
way to reset a server-side trial or guarantee a later reactivation.

Server retention depends on the record's purpose:
- License/fulfilment records remain while needed to administer the continuing
  purchased entitlement, authenticate requested licensing operations and prove
  supply. Ending optional transfers does not automatically end the entitlement.
- Trial identity, usage and enforcement records remain while needed to apply
  the continuing trial restriction to that computer and prevent repeat trials.
  Uninstalling or closing the app does not delete these records. If the trial
  scheme is retired or a record ceases to serve this purpose, it must be erased
  or reduced to what another lawful purpose requires.
- Support records remain through handling and follow-up; any further retention
  is limited to evidence relevant to an actual dispute, security investigation
  or applicable claim period, rather than every attachment indefinitely.
- Routine operational logs are kept for troubleshooting/security, with longer
  retention only for relevant incidents, investigations or legal requirements.
- Accounting/transaction evidence is retained for applicable statutory periods;
  the merchant separately applies its own legally required retention.
- Non-identifying aggregate statistics can be retained longer. Identifiable
  purchase/usage linkage is subject to the purposes and criteria above.

We review necessity, restrict access to retained evidence and minimise data
when a purpose ends. Backup copies can remain until their scheduled replacement;
they are restricted from ordinary use, and applicable deletion restrictions
must be reapplied if a backup is restored. Contact us for the retention period
or criteria applicable to a particular record. We do not promise that every
server record is deleted when you uninstall or deactivate.

7. SECURITY AND YOUR RIGHTS

We use encrypted transport, protected local secrets, signed machine-bound
activations and access controls appropriate to the processing. These measures
do not make any computer, network or service immune to compromise. Protect
your Windows account, license key and printer credentials and keep your system
updated. We address incidents and make legally required notifications.

Subject to GDPR conditions, you may request access, correction, erasure,
restriction, and portability of qualifying contract/consent-based data. You
may object to legitimate-interest processing; we must stop unless legally
sufficient grounds justify continuing. If processing relies on consent, you
may withdraw it without affecting earlier lawful processing. Erasure is not
absolute where a legal obligation or other lawful exception requires retention;
we explain an applicable exception rather than using licensing as a blanket
reason to refuse. Exercising privacy rights does not itself terminate a valid
paid offline license. Removing data indispensable to a requested future online
operation can prevent that operation from working.

Write to contact@track-base.com with enough information to locate your records,
such as the relevant purchase email or Client ID. We may request proportionate
verification; never send your Bambu password. We normally respond within one
month, with an extension only where permitted and explained. You may complain
to the Hungarian National Authority for Data Protection and Freedom of
Information (NAIH), https://www.naih.hu/ , or the competent authority where
you live or work, and seek a judicial remedy. Contacting us first is optional.

8. CHILDREN AND CHANGES

BambuWall purchases and account administration are intended for adults or
persons authorised to act for an organisation. We do not target children or
knowingly seek their personal data. Contact us if child data was supplied
without appropriate authority so the situation can be assessed and remedied.

The installed copy describes this version's processing. We publish an updated
dated notice if processing changes, give further information where required,
and obtain any consent actually required for a new optional purpose. A new
notice alone does not authorise incompatible use of previously collected data.
Current copy: https://track-base.com/Software/BambuWall/?legal=privacy