WebCAD Privacy Policy
WebCAD follows a Local-First Privacy Architecture. Your geometry stays in your browser. We collect minimal data needed for OAuth login and cloud collaboration.
1. Local-First Privacy Architecture
WebCAD runs CAD/BIM modeling, 2D drafting, IFC parsing, and 3D rendering locally inside your web browser using WebAssembly (WASM) and WebGL.
Your models and geometry reside in your browser memory and IndexedDB. No geometry is uploaded to our servers unless you deliberately save to a cloud project, join a Live Project room, or request AI analysis.
2. Personal Data We Collect
Data Controller: Romblad CAD & BIM AB (Swedish company registration number 559384-6156), Sweden, is the controller of the personal data described here. Contact: matsromblad@gmail.com.
Authentication Data: When signing in via Google or GitHub OAuth, we receive your name, email address, avatar URL, and provider user ID managed via Supabase.
Guest Mode: Continuing as guest ("Continue without signing in") stores no personal identification on our servers.
Collaboration Data: In Live Projects, temporary peer IDs, cursor positions, and CRDT change deltas are synchronized with collaborators.
AI Interactions: Prompt text is sent to your chosen AI provider. Viewport screenshots and image attachments are transmitted only when you trigger AI and have image sharing enabled in Settings.
Purchases: When you buy AI credits, Paddle (our Merchant of Record) collects your payment details, billing address and email. We receive only the transaction id, the pack you bought, the amount and your WebCAD user id, and keep a ledger of credit purchases and usage for accounting and fraud prevention. We never see your card details.
Diagnostics: Error logs and performance metrics are opt-in and configurable in Settings > Diagnostics.
3. Legal Bases for Processing under GDPR
We process personal data under GDPR Article 6 based on: (a) Contractual necessity to provide authentication and collaboration; (b) Legitimate interests to secure the platform and fix software defects; (c) Consent for optional features (such as sending viewport images to AI models).
4. Third-Party Service Providers
Supabase: Authentication and collaborative cloud database storage (EU/US Data Privacy Framework compliant).
OAuth Providers: Google and GitHub for user identity verification.
Paddle.com: Merchant of Record for credit purchases; processes payments, taxes, invoices and refunds under its own privacy policy.
Google Firebase: Hosting of the web app and its server functions.
AI Providers: OpenAI, Anthropic, Google Gemini, DeepSeek (only accessed when user initiates AI queries).
We never sell, rent, or trade your personal information or CAD models to any third party.
6. Your Rights under GDPR
Under GDPR, European Economic Area residents have the right to access, rectify, port, or erase their personal data, as well as the right to restrict or object to processing.
To exercise your rights or request deletion of your account and cloud project data, email matsromblad@gmail.com. Records of purchases are kept as long as Swedish bookkeeping law requires.
You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).