Privacy Policy

1. Who is responsible

IRON CORE STUDIO, LLC operates icAtlas and decides how personal data in it is used. Contact: [Contact email].

2. What we collect

Account data: your name, company name, email address, and a salted hash of your password (we cannot read your password).

Project content: the drawings and images you upload, the geometry, devices, pathways and settings you create, your catalog and customer profiles, and the bills of materials produced from them. Building plans can be security-sensitive, and we treat them as confidential.

Records of your confirmations and actions: which documents you accepted and when, your upload authorizations, AI authorizations, exports and deletions. These records hold identifiers, versions, times and a short note, not drawing content. For acceptances we also keep a one-way hash of your IP address and your browser identifier, as evidence.

Company administration: for each company we keep who belongs to it, each person's permissions, invitations (we store only a one-way hash of the invitation link, never the link), and which projects are shared with whom. Company owners and people they authorize can see this, and can see the projects and settings that members create in the company.

Technical data: cookies and browser storage described in the Cookie Notice. Analytics cookies are off unless you allow them, and are never used if your browser sends a Global Privacy Control signal. A record of your cookie choice (the choice, its version and whether the signal was present, with no name or IP address) is kept. Our servers may keep ordinary request logs. [Confirm hosting log retention.]

3. Why we use it

To provide the service you asked for, keep your account secure, keep the records described above, answer you, meet legal duties, and handle copyright complaints.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use your drawings to train AI models.

4. Who we share it with

Hosting and storage: DigitalOcean SFO2.

Anthropic, only if you turn on the AI features for a project and confirm, as described in the AI Features Policy.

Authorities or other parties when the law requires it, or to protect rights and safety, as far as the law allows.

[List any other processors before launch: email delivery, payments, error monitoring.]

5. How long we keep it

Project content stays until you delete the project or your account. Deleting removes the original file, derived data and temporary files from active storage. [State backup retention here.]

Evidence records (acceptances, authorizations, audit events, takedown notices) are kept for 2 years so we can show what happened, even after the project or account is deleted. They contain no drawing content.

When a person deletes their own account, their login, name and email are removed from the company at once. The projects they created stay with the company and are handed to another person there. So that we can answer legal claims and requests from authorities, we keep a record of who that person was (name, email, when they left) for a limited period, currently seven years [Counsel: confirm the period], and then delete it. The audit entry that they left is an evidence record as described above. People a company deactivates, rather than deleting, stay on file with their work until the company or the person asks for deletion.

6. Security

Access is limited to your organization and checked on every request. Passwords are stored as hashes. Original files are kept private and are never served from public links. Connections must use HTTPS in production. [Describe encryption at rest and staff access controls once the hosting is chosen; do not claim more than is true.]

No system is perfectly secure. If a breach affects your data we will notify you as US state breach-notification laws require. [Counsel: confirm the deadlines and who must be told.]

7. Your choices and rights

In Settings you can download your records, delete a project, or delete your account. You can ask us for access to, correction of, or deletion of your data at [Contact email]. See United States privacy rights below.

8. Children

The service is for professionals and is not directed at children. We do not knowingly collect personal data from children under 13.

9. United States privacy rights

Depending on where you live, US state privacy laws (for example in California, Colorado, Connecticut, Virginia and Texas) may give you the right to know what personal data we hold, get a copy, correct it, delete it, and opt out of its sale, of sharing for targeted advertising, and of profiling. We do none of the selling, sharing or profiling. We also honor the Global Privacy Control signal from your browser.

You can use these rights without proving where you live. Download your records or delete your account in Settings, or write to [Contact email]. We aim to answer within 45 days. If we refuse a request you can ask us to reconsider. We will not treat you worse for using these rights.

We do not knowingly collect sensitive personal data. Building plans you upload may be sensitive for security reasons and are treated as confidential.

[Counsel: confirm which state laws apply given the business size and data volumes, whether business contact data is exempt, the response deadline, the appeal process, and whether a "Do Not Sell or Share" link is required.]

10. Where data is kept

Data is stored in the United States by DigitalOcean SFO2. [Confirm the hosting region and any backup location. Counsel: describe how non-US users are handled if any are allowed.]

11. Changes

We publish each new version here and ask you to accept it when it changes in a way that matters.