1. Who is responsible

Symge B.V. is the controller of the personal data processed in CAD2Drawing.

Company: Symge B.V.
Address: Anthonetta Kuijlstraat 49-B, 3066 GS Rotterdam, The Netherlands
Registration: KVK 42034834 · VAT NL869407314B01
Privacy questions and requests: contact@symge.nl

2. What we keep, why, and on what basis

We keep only what we need to run your account and make your drawings. Each purpose has its legal basis under the General Data Protection Regulation (GDPR, article 6).

Your account

Your name and e-mail address as Google or Microsoft give them, the identifier of each sign-in you connect, your language and when the account was opened. We use them to sign you in, to run your account and to write to you about it: the link that confirms your address, receipts and notices about the service. Basis: the contract with you.

What you accepted

Which version of the Terms of Service and this notice you accepted and when, and when you confirmed the notice shown before your first upload. Basis: our legitimate interest in being able to show what was agreed.

Your models and drawings

The STEP files you upload, their file names, what the engine reads from them, the choices you make for a drawing and the drawings made. We use them only to make and show your drawings. For support and to fix problems in the engine, a small number of Symge staff can open them, and each download of a model by staff is recorded. They are never used to train an AI model and never sold. Basis: the contract with you.

Your drawings and 3D models

The 2D drawings you upload to have a 3D model built, their file names, the pages and note you choose, the models built and a record of how each was built. To build a model, the drawing is read by the AI model of our provider Anthropic (section 4). We use them only to build and show your models; they are never used to train an AI model and never sold. Basis: the contract with you.

Credits and payments

Your credit history and, for each purchase, the order, the amount, the VAT, the invoice and the state of the payment. Stripe handles the payment itself: card and bank details go to Stripe and never reach us. We keep what Stripe reports about a payment, such as the card’s brand, its last four digits and its country. Basis: the contract with you; keeping these records is a legal obligation under Dutch tax law.

Feedback and rewards

The rating and note you give a drawing, and the profile address you send for a community reward. We use them to improve the drawings and to check a reward request. Giving them is up to you. Basis: our legitimate interest in improving the service.

Security and fair use

A session cookie, a record of each sign-in you connect or disconnect, counts of requests per address or account to stop abuse, and our hosting provider’s logs of requests, which can include your IP address. When an account that received the free starter credits is deleted, we keep a one-way hash of its sign-ins and e-mail address, so that the free credits are given once per person. Basis: our legitimate interest in keeping the service and your account secure and its free credits fair.

For each sign-in, and while you use the site, we record the IP address it comes from, the country and network that address belongs to, your browser and system, and the days you use the service. They show us when an account is used and whether several accounts come from the same place, so that misuse is found and the free starter credits stay fair. Basis: the same legitimate interest.

We do not sell your data or make decisions about you by automated means alone. Advertising measurement is optional and needs your separate consent. We send no marketing without separate consent.

3. Cookies and storage in your browser

Essential cookies and browser storage keep the site working:

A session cookie keeps you signed in. It ends when you sign out, or after seven days.
A sign-in cookie ties a sign-in with Google or Microsoft to the browser that started it. It ends after ten minutes.
When you start a sign-in, Cloudflare checks that a person, not an automated program, is starting it, and sets a cookie saying the check was passed. It ends after thirty minutes.
Your browser’s own storage keeps the language you chose, whether you were signed in, and a checkout you started, so that it is not started twice.

Only if you choose Allow measurement, Google Ads records ad clicks, a new registration and your first successful 3D model. It receives a pseudonymous event ID and technical browser information, never your files, name or email. We use no Google Analytics, enhanced conversions or personalised advertising.

Your measurement choice and sent event IDs stay in this browser for up to 180 days. Advertising cookies last up to 90 days. You can decline or withdraw through Privacy choices at any time; both tools work either way. Earlier activity is not sent after a later consent.

Google also receives cookie identifiers and your IP address.

4. Who else processes your data

We use these providers. Each processes personal data only on our instructions, under a data processing agreement, except where this says otherwise.

Google Ads: Provides optional advertising measurement after consent. Google may process data outside the EEA under its advertising data protection terms. Its privacy policy explains its own retention and international transfers.; Google privacy policy
Cloudflare: Hosts the site and the application, stores your models and drawings, and sends our e-mail. Your files are stored within the European Union (Cloudflare R2 with an EU jurisdiction); a request, and the reading of a model or the making of its drawing, can be handled in a Cloudflare data centre anywhere in the world.
Anthropic: Reads a 2D drawing you ask a 3D model of, with its AI model, so that the model can be built. Anthropic keeps what it is sent only for a limited time to provide and secure its service, and does not use it to train its models.
Amazon Web Services: Runs our database in Frankfurt, Germany (region eu-central-1).
Stripe: Handles payments and invoices. For some purposes, such as preventing fraud and meeting its own legal obligations, Stripe is itself responsible for the data, under its own privacy policy.
Microsoft: Hosts our e-mail (Microsoft 365), including contact@symge.nl, where your requests to us arrive. It is stored in the European Union.
Google and Microsoft: Sign you in when you choose them. They are responsible for your account with them, under their own privacy policies.

Our accountant and the tax authorities receive payment and bookkeeping records where Dutch law requires it. We give personal data to anyone else only where the law obliges us to.

5. Transfers outside the European Economic Area

Cloudflare, Amazon Web Services, Stripe, Microsoft and Anthropic are, or belong to, companies in the United States, and Cloudflare can handle a request in a data centre outside Europe. Where personal data leaves the European Economic Area, the transfer rests on the EU-US Data Privacy Framework, under which these companies are certified, and on the European Commission’s standard contractual clauses in their data processing agreements. Your files, our database and our e-mail are stored in the European Union.

6. How long we keep it

Models, drawings and 3D models: 7 days after upload, unless you delete them sooner. The preview shown while a model is read, and the record of a drawing being made, one hour after it ends.
Your account: Until you delete it. Its sign-ins, its sign-in history and any link to confirm an address go with it.
Credits, orders and invoices: Seven years, as Dutch tax law requires, also after you delete your account, then without your name or e-mail address. Stripe keeps the invoices it issued for us.
What you accepted: As long as the credit and payment records, without your name or e-mail address once the account is deleted.
Feedback and rewards: As long as the account. When you delete it, your note and your profile address are deleted; a rating stays with its drawing’s record, without anything that names you.
Sessions: Seven days, or until you sign out.
Links that confirm an address: Valid for 24 hours; deleted a week after they were used or ended.
Sign-in history: The address, country, network and browser of each sign-in and of your use, six months. The days you used the service, as long as the account.
Request counts: At most two days.
Logs: Cloudflare’s logs of requests, seven days. The database’s log of slow queries, which can contain an e-mail address, three days.
Hashes of a deleted account: One year after the account is deleted.
Your requests to us: Two years after we answered them.
Backups: The database is backed up every day and each backup is kept seven days, so deleted data can remain in a backup for up to seven days. A copy made before a release is deleted within 30 days.

7. Your rights

You have the right to:

see the personal data we hold about you: Download my data, in the account menu, gives you all of it as one file;
have it corrected: change your e-mail address in the account menu, or write to us;
have it erased: Delete account, in the account menu, deletes your account at once, apart from the records the law obliges us to keep;
take it with you: the same file, in a format any program can read (JSON);
object to what we do on the basis of our legitimate interest, and ask us to restrict how we use your data;
withdraw a consent you gave us, at any time.

For anything else, write to contact@symge.nl. We answer within one month.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority of the country where you live or work.

8. Security

All traffic is encrypted. Your files and the database are encrypted where they are stored, and the database can be reached only through a private tunnel. The engine that reads your models has no network access. You sign in with Google or Microsoft, so we hold no password of yours. Staff access to models is limited and recorded. If a breach of your data is likely to put you at risk, we tell you, and we report breaches to the Autoriteit Persoonsgegevens as the law requires.

9. Changes to this notice

When this notice or the Terms of Service change, their version changes and we ask you to read and accept the new version before you go on using CAD2Drawing.