What the product holds
Your accountThe details you type into the registration form: first name, last name, e-mail address and the organisation name you give. Your password is never stored as you typed it — only a BCrypt hash of it is kept, which is what your sign-in is checked against.
Your company’s workspaceEverything you create in the application — drawings, models, documents, bills of materials, comments and their revision history — is stored against the company you are working in. Records carry that company, and the application serves you only the records belonging to a company you are a member of.
Who did whatActions taken in the application are written to an audit log, so a change can be traced back to the account that made it. How long that log is kept is a deployment setting; the policy statement for it is listed below as still to be supplied.
On your own deviceOne cookie, which is your sign-in session, plus the browser local storage the editor uses for your settings and your unsaved work. That is set out item by item, key by key, on the cookies and local storage page.
E-mail sent to youInvitations, password resets and notifications are sent through whichever provider this deployment is configured with — plain SMTP, SendGrid or Brevo. Sending is off unless the deployment turns it on and supplies credentials, and while it is off no provider is contacted at all.
Still to be completed by the site owner
The sections above are an accurate description of this application. A complete privacy notice also requires the following, which this page deliberately does not invent. They must be supplied, and the page reviewed by a qualified adviser, before it is relied on as a legal notice.Data controller — OWNER TO SUPPLYThe legal entity that decides why and how this information is processed — registered name, registered address and company number.
Contact for data protection — OWNER TO SUPPLYThe address a person writes to in order to ask a question, exercise a right, or complain — and the data protection officer or representative, if one is appointed.
Legal basis and jurisdiction — OWNER TO SUPPLYWhich regimes this product is offered under, and the lawful basis relied on for each of the purposes described above.
Retention — OWNER TO SUPPLYHow long each class of record is kept after an account is closed or a company stops using the product, and what is deleted as against anonymised. The device-side lifetimes on the cookies page are code facts; every server-side period is a policy decision.
Processors and sub-processors — OWNER TO SUPPLYEvery third party that processes this data on the controller’s behalf — hosting, database, backups, e-mail delivery, and any AI provider configured for the tenant — named, with what each one receives.
International transfers — OWNER TO SUPPLYThe countries this data is stored in and transferred to, and the safeguard relied on for each transfer.
Your rights and how to exercise them — OWNER TO SUPPLYThe rights available in the applicable jurisdiction, the route for making a request, the proof of identity required, and the time limit for a response.
Supervisory authority — OWNER TO SUPPLYThe authority a person may complain to, and how to reach it.