Privacy Policy

Identity and access

You sign in with your organization's Microsoft account. We do not create or store a DrawSync password. From Microsoft we receive your name, email address, and, where your organization publishes it, your job title and organizational details. We use this to identify you, place you in the right organization, and decide what you are allowed to see.

Project and work content

Everything you put into DrawSync: projects, drawings, documents, specifications, tasks, schedules, logged hours, comments, and annotations. We store it so the product works. We do not sell it, and we do not use it to build advertising profiles.

Calendar, only if you turn it on

The calendar can optionally show your Outlook events alongside DrawSync deadlines, and can mirror DrawSync dates into an Outlook calendar. This reads and writes calendar data through Microsoft Graph. It stays off until you select the calendars you want, and turning it off stops the access.

Product interactions and diagnostics

We record technical logs about how the service is used: requests, errors, and performance. These help us find bugs and keep the service running. They can include your account identifier and IP address.

Correspondence

If you email us for support, we keep that correspondence so we have context the next time you write.

• We do not sell your personal information, and we never have.
• We do not use advertising trackers or third-party advertising cookies.
• We do not use the contents of your projects to train machine learning models of our own.

Running DrawSync means using other companies as infrastructure. Each of these is bound by its own contract to protect what it processes on our behalf:

• Microsoft for sign-in (Entra ID), calendar and directory access (Microsoft Graph), file storage (Azure Blob Storage), and background job processing (Azure Queue Storage).
• MongoDB Atlas as the primary database. Records for each customer organization are held in a database of their own.
• PowerSync to keep data in sync between our servers and your device so the product works offline.
• Vercel to host and serve the web application.
• Anthropic to power the AI assistant. When you use an AI feature, the content of that request, and the project data needed to answer it, is sent to that provider. They act as a processor and do not use it to train their models. If you would rather this never happens, do not use the AI features.

Our servers and databases are located in [HOSTING REGION]. If you are using DrawSync from elsewhere, your data is transferred there.

DrawSync works offline, which it achieves by keeping a copy of the project data you have access to in a database inside your browser, along with small preferences such as which page you last had open. This means business data physically sits on the computer you sign in from. On a shared or public computer, sign out when you are finished.

We access the contents of your account only in narrow cases:

• To help you. If you ask us to investigate a problem, we may look at the specific data needed to diagnose it.
• To keep the service running. Engineers may encounter data while fixing a fault or investigating suspected abuse.
• When the law requires it. We disclose information if we receive a valid, binding legal request. Where we are permitted to tell you about it, we will.

If we are ever involved in a merger, acquisition, or sale of assets, we will give notice before your information is transferred or becomes subject to a different policy.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to how we process it. We extend these rights to everyone, regardless of location.

Because most DrawSync data belongs to the organization that bought it, some requests have to be routed through an administrator there. Where that applies, we will tell you rather than simply declining. Write to [CONTACT EMAIL] and we will respond within the timeframe the applicable law requires.

All traffic between your browser and DrawSync is encrypted in transit, and the databases and file storage we use encrypt data at rest. Access to production systems is limited to the people who need it. No system is perfectly secure, and we will not pretend otherwise, but we treat security as part of building the product rather than an afterthought.

When you delete content in DrawSync it is removed from the active service. Backups persist for a limited period, so deleted content can survive in backup form for a short time before it is overwritten. When an organization closes its account, its data is deleted after a grace period intended to protect against accidental cancellation.

We may update this policy as DrawSync changes. When a change is material we will say so on this page and update the date at the top.

Questions, concerns, or a privacy request: [CONTACT EMAIL]
[COMPANY LEGAL NAME], [COMPANY ADDRESS]