Privacy Policy
Version 2026-09-draft · Last updated September 24, 2026
1. Scope
This policy explains how CivDraw collects and uses personal information on civdraw.com, app.civdraw.com and api.civdraw.com. It is version 2026-09-draft.
2. What we collect
- Account: email address and password (stored only as a bcrypt hash).
- Terms acceptance: the version you accepted and when.
- Firm template: firm name, PE name and license number, disclaimer text and logo, if you add them.
- Drawings: the parameters you enter, the files we generate, and warnings and QC results.
- Projects and integrations: project names and any webhook URLs you register.
- Usage: counts of drawings and AI extractions, used for plan limits.
- Billing: Stripe processes card and bank details; we store your Stripe customer ID and plan, not card or bank numbers.
- API keys: stored only as hashes.
- Analytics: pages viewed and buttons clicked on our sites and in the app, collected with PostHog using cookies and similar browser storage.
- Technical: IP address, browser type and request logs, used for security, rate limiting and troubleshooting.
- Support: emails you send us.
3. How we use it
We use this information to provide the Service, enforce plan limits, process payments, secure accounts, fix problems, understand how the product is used so we can improve it, and contact you about your account. We don't sell personal information, and we don't use your drawings or inputs to train AI models.
4. AI processing
When you use AI extraction, the text you submit is sent to Anthropic to generate suggested form values. Under Anthropic's commercial API terms, that content is not used to train Anthropic's models. We'll confirm this against Anthropic's current terms before this policy is finalized. Don't paste information you aren't permitted to share with a service provider.
5. Subprocessors
| Provider | Purpose | Data |
|---|---|---|
| Google Cloud (Cloud Run) | Runs the CivDraw API and background workers | All Service data in transit and processing |
| Firebase Hosting (Google) | Hosts civdraw.com and the web app | Request logs |
| Supabase | Database and file storage | Account, firm template, drawings, generated files |
| Upstash | Job queue and rate limiting | Job identifiers, rate-limit counters, IP addresses |
| Stripe | Payments and subscriptions | Billing contact and payment details |
| PostHog | Product analytics | Usage events, device and browser data, IP address, and (in the app) your email address, account ID, plan and error reports |
| Anthropic | AI extraction (paid plans) | Text you submit for extraction |
| Sentry | Error monitoring for the API and background workers | Error reports, which can include request metadata and IP address |
| Email delivery provider (to be named before this policy is final) | Account emails such as password resets | Email address and message content |
We'll update this list before adding a new provider.
6. Where data is stored
Our primary hosting and database run in the United States (Google Cloud, Supabase). Some providers, such as Stripe and our content delivery network, may process data in other countries under their own safeguards.
7. Retention
- We keep your account information, drawing parameters and generated files for as long as your account is active.
- The app doesn't yet offer self-service deletion. You can delete your account and its data by email request to hello@civdraw.com, sent from your account's email address.
- We keep billing records as long as tax and accounting law requires. Deleted data can remain in backups until those backups expire on their regular schedule.
8. Security
Data is encrypted in transit with TLS, and our hosting providers encrypt stored data at rest. Passwords and API keys are stored as one-way hashes. Access to production systems is limited to people who need it to run the Service.
9. Your choices and rights
You can ask us to access, correct, export or delete your personal information by emailing hello@civdraw.com. Depending on where you live (for example, under the New Jersey Data Privacy Act), you may have additional rights. We'll respond as the law requires. You can block or delete analytics cookies in your browser settings.
10. Children
CivDraw is a professional tool and isn't directed to children under 16. We don't knowingly collect their information.
11. Changes
We'll post updates here with a new version string. For material changes, we'll notify account holders by email or in the app.
12. Contact
Privacy questions: hello@civdraw.com.