Draft pending legal review. This document is a complete working draft. Items in [square brackets] are company details still to be confirmed. It will be reviewed by a qualified lawyer before we take payments or rely on it; until then, contact m.shafih.akbari@gmail.com with any questions.
In plain words
We collect what we need to run Autonieer, keep it secure and get paid — nothing more. We don't sell your data or use it for ads.
Your designs are yours. We don't train AI models on them.
You can download or delete your data yourself, and you can always ask us at m.shafih.akbari@gmail.com.
1.Who we are
The controller of your personal data is [Company legal name] (trading as Autonieer), a company registered in [Country] under number [Company number], whose registered office is at [Registered address]. Contact us about privacy at m.shafih.akbari@gmail.com or by post at the address above.
[Data Protection Officer: we have assessed that we are not required to appoint one — record the decision and date — or: our DPO is [name], reachable at m.shafih.akbari@gmail.com.]
[If not established in the EU: our representative in the EU under Art. 27 GDPR is [name, address, email].] [If not established in the UK: our UK representative is [name, address, email].]
2.Scope — and when we act for your organization
This policy covers visitors to our websites, people who create an account, newsletter subscribers, and people who contact us.
When an organization uses Autonieer, the personal data inside its Customer Content (for example names on drawings or in prompts) is processed by us on the organization's behalf. For that data the organization is the controller and we are its processor under our Data Processing Addendum; please direct requests about it to the organization.
3.What we collect
- Account data — name, email address, password (stored only as an Argon2id hash), organization memberships and roles, two-factor status, sign-in timestamps.
- Customer Content — prompts, briefs, answers to clarifying questions, imported files, designs, versions and exports.
- Community data — if you post in the community: your public display name, what you post (public), votes, the threads you follow, reports you send, and a keyed hash of the IP address a post came from (kept 90 days, for abuse handling).
- Billing data — plan, seats, billing email, country, tax ID if you give one, invoice history. Card details are collected by Stripe; we never see or store full card numbers.
- Usage and device data — actions in the product (for example generations and exports), IP address, browser and device type, request identifiers and error reports.
- Security records — failed sign-ins, lockouts, and an audit trail of security-relevant and staff actions, including IP address and user agent.
- Contact-form data — name, email, company (optional), topic, message, the version of the privacy notice shown on the form, your browser's user agent and a salted hash of your IP address (used for abuse prevention, not to identify you).
- Newsletter data — email address, where you signed up, the consent wording, when you confirmed, and a salted hash of your IP address at sign-up.
- Error and problem reports — when the site or app hits an error it sends us the error message, a stack trace, the page address (without its query string), the release, your browser and screen size, an anonymous id for the browser tab and, if you are signed in, your user id. Emails, tokens and card-like numbers are removed before anything is stored. If you use “Report a problem”, we also keep what you write and, if you give it, your email address.
- Cookie choices — when you answer the cookie banner we keep a record of the choice as proof: a random consent id (also stored in your browser's
autonieer_consentcookie), the choices, the policy version, the region rules that applied, whether your browser sent Global Privacy Control, your browser and operating-system family (no version numbers), a keyed hash of your IP address (never the address itself) and your user id if you were signed in. To decide which rules apply, our server looks up the country of your IP address in a database kept on our own server; the address is not sent anywhere or stored. - Browser storage — see our Cookie Policy.
4.Why we use it — purposes and lawful bases
Under the EU and UK GDPR we must have a lawful basis for each use of personal data:
| Purpose | Data | Lawful basis |
|---|---|---|
| Create and run your account and organization; provide the Service | Account data, Customer Content, usage data | Contract (Art. 6(1)(b)) |
| Generate designs with AI | Prompts, briefs and design context | Contract (Art. 6(1)(b)) |
| Take payments, issue invoices, keep tax records | Billing data, organization details | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Keep the Service secure: authentication, lockout, rate limits, fraud and abuse prevention, the audit trail | IP address, device and browser data, security and audit logs | Legitimate interests in protecting users and the Service (Art. 6(1)(f)); legal obligation where security is required by law |
| Send service messages (security alerts, billing notices, changes to terms) | Name, email address | Contract (Art. 6(1)(b)); legitimate interests |
| Answer contact-form and support requests; follow up sales enquiries you start | Name, email, company, topic, message | Legitimate interests in responding (Art. 6(1)(f)); steps before a contract (Art. 6(1)(b)) |
| Send the newsletter (double opt-in) | Email address, consent record, subscription status | Consent (Art. 6(1)(a)) — and PECR / ePrivacy consent for electronic marketing |
| Understand and improve the product in aggregate | Usage and diagnostic data, de-identified where possible | Legitimate interests in improving the Service (Art. 6(1)(f)) |
| Website analytics — only if enabled and only after you accept | Aggregated page-view data (Plausible; no cookies) | Consent (Art. 6(1)(a)) |
| Show the right privacy choices for where you are, and keep proof of the choice you made | Your IP address (looked up in an on-server country database, then discarded), your cookie choices, a random consent id, a keyed hash of your IP address, browser and operating-system family, your user id if signed in | Legal obligation to obtain and demonstrate consent (Art. 6(1)(c), Art. 7(1); PECR reg. 6; ePrivacy Art. 5(3)); legitimate interests (Art. 6(1)(f)) |
| Comply with law, respond to lawful requests, establish or defend legal claims | Whatever is relevant to the matter | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (see “Your rights”). Where we rely on consent, you can withdraw it at any time — for the newsletter, with the unsubscribe link in every email.
5.AI processing and automated decisions
When you generate or refine a design, or ask the site assistant a question, your prompt and the relevant design context are sent to our AI provider to produce the result. Today that is OpenAI's open-weight gpt-oss-120b model, served by Groq, Inc.. The provider processes this data on our behalf only to return the result, and is listed with its location on our Sub-processors page. [Confirm in the signed data processing addendum that the provider does not retain the data or use it to train its models.] We do not use your Customer Content to train models.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. Contact messages receive an automatic spam score, and messages flagged as spam are still reviewable by a person; if you think a message was wrongly treated as spam, email us.
7.International transfers
Some sub-processors are outside the UK and European Economic Area, notably in the United States. Where personal data leaves the UK or EEA, we rely on an adequacy decision (including the EU–US Data Privacy Framework and UK Extension where the recipient is certified), or on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum, together with a transfer risk assessment and supplementary measures such as encryption in transit and at rest. Ask us for a copy of the relevant safeguards at m.shafih.akbari@gmail.com.
8.How long we keep it
| Data | Retention |
|---|---|
| Account data (profile, memberships, sign-in settings) | For the life of the account. When you delete your account it is erased straight away; an organization only you used is erased 30 days later |
| Inactive free accounts | If a free account with no paid history is not used for 23 months we email a warning; if you still don't sign in, the account is deleted at 24 months (at least 30 days after the warning) |
| Customer Content (projects, designs, versions, AI generations and prompts) | For the life of the organization. Deleted projects and designs, and deleted organizations with everything in them, are erased 30 days after deletion |
| Version history shown in the product | According to plan: 7 days (Free), 1 year (Pro), unlimited (Team, Enterprise). Older versions are hidden, not deleted, until the organization is |
| Exports (DXF, PDF, IFC …) | Not stored — generated when you ask and sent to you; we keep only a record that an export happened (see activity logs) |
| Invitations (email address, role) | 90 days after they expire, are accepted or are revoked |
| Sign-in sessions | Refresh-token records are deleted 30 days after they expire or are revoked |
| Sign-in and security events (email, IP address, browser) | 1 year; after that the email, IP address and browser details are removed and only the event itself remains. The last sign-in IP on your account is also cleared after a year |
| Organization activity log | 1 year; billing-related entries 7 years |
| Staff and administrative audit trail | 7 years (tamper-evident record of staff actions, exports and deletions) |
| Billing records and invoices | 7 years (tax and accounting law: e.g. 6 years UK, 7 years US, 6–10 years EU). Raw payment-provider notifications are reduced to the minimum after 90 days |
| Usage metering (generation and export counts) | 25 months |
| Contact-form messages | 24 months after the last reply in the conversation; messages marked as spam after 90 days |
| Newsletter — unconfirmed sign-ups | 30 days, then deleted |
| Cookie-consent records (your choices, a random consent id, a keyed hash of your IP address, browser family) | 4 years: the 12 months a choice lasts plus 3 years to answer any complaint about it, then deleted. If you delete your account, the record stays for that period but is no longer linked to you |
| Newsletter — subscribers | Until you unsubscribe. 30 days later your address is replaced by a one-way hash, kept only so we never email you again |
| Consent records (newsletter) and the privacy notice shown with a contact message | For as long as we rely on the consent, then with the record they belong to |
| Error reports sent automatically by the site and app | 90 days (scrubbed of emails, tokens and card-like numbers before storage); grouped summaries 1 year after the problem is resolved |
| “Report a problem” submissions | 12 months |
| Community posts (threads and replies you publish) | For as long as they are published. If you delete your account they stay in their threads but are shown as “Deleted user” and no longer linked to you; your votes, follows and community settings are deleted |
| Community posts removed by a moderator | 6 months (so you can appeal), then the text is erased; posts you delete yourself are erased after 30 days. Earlier versions of edited posts: 12 months |
| Community reports, notifications and moderation records | Reports 12 months after they are handled; email notification queue 30 days; sanctions 12 months after they end; moderation log 3 years |
| Public social-media posts that mention us | 12 months |
| Conversations with the site assistant (Vela) | 90 days, then deleted (stored by our separate assistant service) |
| Server and application logs | 30 days |
| Backups | 14 days on a rolling basis; deleted data disappears from backups when they roll over |
These periods are enforced automatically: a daily job deletes or anonymises what has expired, and every run is recorded. Where the law requires us to keep something longer, or it is needed for an ongoing legal claim, investigation or request (a “legal hold”), we keep only what that requires and only for as long as it lasts — a legal hold overrides the schedule above.
You don't have to wait: you can export your data or delete your account yourself in account settings, correct your details at any time, and ask us at m.shafih.akbari@gmail.com to erase or restrict anything else (see “Your rights”). We don't sell or share personal data, so there is nothing to opt out of — but you can still tell us to.
9.How we protect it
Encryption in transit, hashed passwords and API keys, encryption at rest for stored third-party credentials, strict separation between organizations, two-factor authentication for staff, rate limiting, account lockout and a tamper-evident audit log. More on our Security page. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authority as the law requires.
10.Your rights (UK and EU)
You have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing, including processing based on legitimate interests and any direct marketing;
- receive data you gave us in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing that happened before.
Signed-in users can download their data and delete their account from account settings. For anything else, email m.shafih.akbari@gmail.com. We reply within one month (extendable by two months for complex requests, in which case we'll tell you), and may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
11.United States privacy rights (including California)
If you live in California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; to opt out of its “sale” or “sharing”; and to limit the use of sensitive personal information — and not to be discriminated against for using these rights.
- Categories collected in the last 12 months: identifiers (name, email, IP address); customer records (billing details); commercial information (plan and purchase history); internet activity (usage and device data); professional information (company, role) and the content you create. Sources, purposes and recipients are described above.
- Sensitive personal information: only account log-in credentials, used solely to authenticate you.
- No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We honour Global Privacy Control signals as an opt-out request regardless.
- How to exercise your rights: email m.shafih.akbari@gmail.com or use the contact form. An authorised agent may act for you with written permission. We verify requests by matching them to information we hold, and respond within 45 days.
12.Children
Autonieer is for professionals and adults. It is not directed at children, accounts require users to be 18 or over, and we do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
13.Complaints
Please contact us first — we'd like the chance to put things right. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the supervisory authority where you live or work, or our lead authority, [supervisory authority name].
14.Changes to this policy
We will update this policy when our processing changes, and change the date at the top. For material changes we will tell account holders by email or in the product before they take effect.