Privacy Policy

• Account data — your email address and authentication metadata from our identity provider (Firebase Authentication), including where you sign in via Google.
• Design content — briefs, sketches, uploaded 3D model files, and the designs, manufacturability critiques, cost estimates, and provenance history the Service generates on your behalf.
• Billing data — for paid plans, our payment processor (Stripe or Flutterwave, depending on region) handles payment card details directly; we do not collect or store full card numbers.
• Contact data — information you submit through our Contact form, including your name, email address, and message.
• Usage data — where enabled for your environment, basic product analytics and error diagnostics.

We process personal data for the following purposes, on the legal bases indicated, in accordance with section 30 of the DPA:

• Performance of a contract — operating the Service you have requested, including running the design agents against your briefs, authenticating you, and processing payment for a subscription you have chosen.
• Legitimate interests — securing the Service, diagnosing and preventing technical faults, and responding to enquiries submitted through our Contact form, provided such interests are not overridden by your own rights and freedoms.
• Legal obligation — retaining billing records as required by applicable tax and financial regulation.
• Consent — where we ask for it explicitly, such as enabling browser notifications.

We disclose personal data only to the data processors necessary to operate the Service: Firebase (authentication, storage, hosting, and analytics), our AI model providers (Anthropic, and where configured, models hosted on Amazon Web Services), our payment processor (Stripe or Flutterwave), and, where configured for your environment, error-monitoring and tracing providers. Each such processor is engaged under terms requiring it to protect personal data to a standard consistent with the DPA. We do not sell personal data, and we do not disclose your designs to other customers or to manufacturers without your explicit action — the Service does not release a design on its own; see our Terms of Service.

Some of the processors referred to in Section 3 store or process data outside Kenya. Where personal data is transferred outside Kenya, we take steps to ensure the recipient is subject to a law, binding corporate rules, or contractual clauses that afford a level of protection to that data that is substantially similar to the protection provided by the DPA, as required by section 48 of the DPA.

We retain personal data for as long as your account remains active and as necessary to provide the Service. You may permanently delete your account at any time from Account settings, which removes your designs, runs, and documents from our systems and cannot be reversed. We may retain certain records, such as billing history, for longer where required by Applicable Law.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls scoped to each account, encryption of data in transit, and restriction of design and run data to the account that created it. No system is completely secure, and we cannot guarantee absolute security.

Under the DPA, you have the right to:

• be informed of the use to which your personal data is to be put;
• access your personal data in our custody;
• object to the processing of all or part of your personal data;
• correct any false or misleading data concerning you; and
• request deletion of false or misleading data concerning you, or data which we are no longer authorised to retain.

You can exercise your access and deletion rights directly from Account settings. For any other request, or if you are not satisfied with how we have handled your personal data, you may reach us via our Contact page, or lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

We use the minimum necessary to keep you signed in and to remember basic preferences. Where analytics is enabled for your environment, it may use client identifiers to understand product usage in aggregate; such data is not sold or shared with unrelated third parties.

The Service is not directed to, and we do not knowingly collect personal data from, individuals under 18 years of age. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes to the Service or to Applicable Law. We will update the date at the top of this page whenever we make a material change.

For any question, request, or complaint regarding this Privacy Policy or our processing of your personal data, please reach us via our Contact page.