Privacy

This describes, in plain and complete terms, what pic2CAD does with your personal data, including the practical security promises in the Security and infrastructure section below.

1. Who we are

pic2CAD is operated by Vanessa Larsson (NIF Y8388099J), at Corredera Baja de San Pablo 15, 28004 Madrid, Spain. pic2CAD is the data controller for the personal information described in this policy. Contact: pic2cad@gmail.com and +1 862 703 0206.

2. Information we collect

When you use pic2CAD, we collect information you provide directly: your email address when you create an account, and the pictures you upload for conversion. If you subscribe or buy credits, we also keep your payment history (amounts and dates, never your card details). We also collect standard usage data (pages visited, features used) through our analytics provider. Browser analytics only run if you accept analytics cookies; we also record a small number of server-side events (a conversion started, a purchase completed) that do not depend on cookies, see Cookies below.

In more detail, this is what we hold about your account:

• Your email address and, if you sign in with Google, the account identifier Google gives us to recognise you (never your Google password).
• If you set your own password, only a hash of it (argon2id), never the password itself.
• If you create a public API key, only a hash of it; the full key is shown to you once and is not stored.
• The profession you choose in the short questionnaire after your first sign-in.
• Your Stripe customer identifier, if you buy credits or subscribe.
• The creation date of your account and the usage dates of your API keys.
• Your IP address, used only in memory to limit abuse (for example, many requests in a row); it is not stored in our database.

3. How we use your information

We use your information to:

• Provide the picture-to-line-drawing service
• Manage your account and credit balance
• Send transactional emails (sign-in links, purchase receipts)
• Improve the service through aggregated usage analytics
• Prevent abuse and enforce our Terms of service

Our lawful bases under the GDPR: performing our contract with you (providing the service, processing your pictures, billing); our legitimate interests (service security, abuse prevention, and aggregated server-side usage counts); your consent (analytics cookies in your browser, which you can withdraw at any time); and legal obligation (tax and accounting records).

4. Picture handling

Pictures you upload are sent to an external image-generation service to produce your line drawing. Your uploaded pictures and the finished drawings are stored in your account and are not shared with other users or made public. We do not use your uploaded pictures to train AI models ourselves; see Security and infrastructure below for more detail on that promise and its limits.

5. Who else touches your data

• AI image-generation provider: your uploaded picture is sent to a third-party AI infrastructure provider to generate the line drawing. We do not name the specific provider on the public site: under GDPR Articles 13-14, a category of recipient can be disclosed instead of a specific name, provided the category is described precisely enough, which is what we do here. That provider processes your picture on pic2CAD's behalf, under a data processing agreement; see section 6 for the international transfer mechanism that applies to it. If you submit a formal data access request, we will disclose the provider's identity, as required by Article 15 GDPR.
• Google: if you sign in with Google. See Google's own privacy policy.
• Stripe: processes payments. We never see or store your card number; Stripe's privacy policy covers that data.
• Resend: sends the sign-in link if you log in by email instead of Google. See Resend's privacy policy.
• Railway: hosts the server and the database. Your files are not kept here. See Railway's privacy policy.
• Cloudflare (R2): stores your original pictures and the PNG, SVG and DXF files we generate, permanently; Railway's own disk is only used as scratch space while a picture is being processed. See Cloudflare's privacy policy.
• PostHog: counts visits and usage on their EU servers (Frankfurt). Analytics in your browser only run if you accept analytics cookies. In addition, our own server logs a small number of operational events (a purchase, a generation, a failure, a download) tied to your account identifier, on the basis of our legitimate interest in operating and securing the service; these events are hosted in the EU and are not used for advertising (see Cookies below). See PostHog's privacy policy.

6. International transfers

Every provider we work with has its own data processing agreement (DPA) and, where relevant, its own international transfer mechanism:

• Stripe: you contract with Stripe Payments Europe, Ltd., based in Ireland (EU); its US parent is certified under the EU-US Data Privacy Framework.
• Google (if you sign in with Google): handled by Google Ireland Limited; Google is certified under the EU-US Data Privacy Framework.
• Cloudflare (R2): certified under the EU-US Data Privacy Framework.
• Railway: certified under the EU-US Data Privacy Framework, backed by standard contractual clauses.
• Resend: certified under the EU-US Data Privacy Framework.
• PostHog (analytics): hosts data in the European Union (Frankfurt), so there is no international transfer.
• AI image-generation provider (not named here, see section 5): certified under the EU-US Data Privacy Framework.

If you need more detail on a specific provider for your own compliance records, email us.

7. Cookies

We use a session cookie to keep you signed in, and, if you arrive through a friend's invite link, a short-lived cookie that remembers who invited you so we can credit them. If you accept our cookie banner, we also use an analytics cookie (PostHog) to understand how people use the site; declining keeps this off. Declining does not stop the handful of operational server-side events we count to keep the service running (for example, a purchase, a generation, a failure, or a download), which use no cookies and are not tied to your browsing. None of these cookies are used for advertising or sold to third parties.

8. Data retention

Your pictures and drawings stay in your account until you delete them yourself, either one at a time from My drawings, or by deleting your whole account from your account page. Deleting a drawing or your account removes the corresponding files and records from our active systems, database and storage, right away; deleting your account also cancels any active subscription. Billing records are kept in Stripe for as long as tax law requires.

On top of our active systems, we keep a daily database backup, retained for a maximum of 14 days before it rotates out; that backup sits outside the service's ordinary use and we would only use it to recover from a serious failure. Beyond that backup rotation, we do not run an automatic deletion schedule based on age or a fixed number of days. The only exception: if our storage were ever critically low, we might manually remove the oldest drawings to free space.

9. Your rights

Under the GDPR you have the right to access, correct, delete, and receive a portable copy of your personal data, to restrict or object to its processing, and to withdraw consent where processing is based on consent. You can delete your account, and everything in it, at any time from your account page. To exercise any other right, the single channel is pic2cad@gmail.com; we respond within a general deadline of one month from receiving the request, and to protect you we may ask for reasonable proof of your identity before handling it. You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos.

10. Business transfers

If the pic2CAD business is transferred to a successor entity that carries on the business, your personal data may transfer with it under the same protections; we will notify you of any such transfer.

11. Changes to this policy

If we materially change this policy, we will post the change here with a new date, and where the change is significant, try to reach you by email as well.

12. Consent

By uploading a picture, you contractually warrant, under our Terms of service, that you hold the rights and authorisations needed for it, including those of anyone appearing in it. pic2CAD processes the personal data of those third parties on your behalf, under this policy.

13. Security and infrastructure

This section covers the practical, day-to-day promises that sit alongside the policy above: what we do, what our providers do, and what we do not do.

What we promise:

• We do not use your pictures, or the drawings made from them, to train AI.
• We apply technical and organisational measures aimed at keeping your pictures and drawings private to your account, with no access by other customers.
• We apply technical and organisational measures aimed at automatic processing, with no human review of your pictures in normal operation (see section 15 for the cases where our small team can access them).

Turning your picture into line art happens through the third-party image-generation service described in section 5, which processes your pictures on pic2CAD's behalf under its own data processing agreement. It is a paid service, and under its terms for paid customers, that provider does not use your pictures, prompts or outputs to improve its own products, and only logs them for a limited period to prevent abuse. If you need more detail for your use case, for example client-confidential work, email us at pic2cad@gmail.com and we will tell you plainly what we know.

14. Account and platform security

• HTTPS everywhere. We apply technical measures aimed at encrypting (TLS) every connection between your browser and pic2CAD.
• Encrypted storage. The providers who hold your files and database (Cloudflare and Railway) encrypt data at rest by default, as is standard for their services.
• Access checked per request. We apply technical and organisational measures aimed at checking your session and ownership of the file before serving every download and every generation; we do not publish public links to your files.
• No card data on our side. Payments go straight to Stripe. We never see or store your card number.
• Your password, if you set one. You can sign in with Google, with a one-time link sent to your email, or with a password. If you choose a password we never keep the password itself, only an argon2id hash of it, which cannot be turned back into what you typed.
• Found a problem? Email pic2cad@gmail.com. We are a two-person team, so reports go straight to the people who can fix them.

15. Who can see your pictures

• No other customer. Every drawing is scoped to your account; a request for someone else's drawing is rejected before it reaches storage.
• The free trial without an account is browser-bound. It is tied to the browser that generated it with a cookie, not to any account, so treat it as visible to whoever holds that browser until you claim it.
• Machines, not people, in normal operation. Your picture is processed automatically. Nobody on our side looks at it to generate your drawing.
• Our small team can access any drawing. pic2CAD is run by two people. We can open any drawing on the platform to fix a failed generation, answer a support question, or investigate abuse. We do not keep a separate audit log of when we do this today, see "What we do not claim" below.

16. What we do not claim

Trust pages fail when they overpromise, so, plainly: pic2CAD is a two-person business. We do not hold SOC 2, ISO 27001 or PCI certification ourselves, our infrastructure providers do (see section 5 above), and we have no plans to pursue our own certification while the business is this small. We do not run a formal, logged access process for internal access to your pictures: admin access is limited to the two people who run pic2CAD, gated by an allowlist, not by an audit trail. We do not offer a confidential or "stealth" tier or a published NDA; what we do have, detailed in section 13, are our image-generation provider's paid-service terms on how it handles your data. And we do not promise zero retention: as explained in section 8 above, your drawings stay until you delete them, that is the honest shape of it.

For privacy-related inquiries, contact pic2cad@gmail.com. See also our Terms of service and Licence.