Privacy Policy

What we collect

We collect the minimum data necessary to operate Fabdose:

• Account data: email address (required), display name (optional), avatar URL if you sign in with Google.
• Usage logs: action type, cost estimate, latency, defect count, file size in bytes, SHA-256 hash of your STP/STEP file (not the file itself). Your IP address is pseudonymised as a one-way hash (SHA-256 with a separately-stored salt) before storage.
• Payment data: email, card brand, last four digits, and payment timestamp — provided by Lemon Squeezy after a successful charge. We never receive or store full card numbers.
• Referral data: referral code and IP hash (SHA-256 with a separately-stored salt) used solely to detect abuse in the referral programme.

What we do NOT collect

Your STP/STEP CAD files never leave your computer.

Fabdose analysis runs locally on your desktop. What syncs to the cloud: (a) result metadata (defect findings in defects_json, cost summary in cost_impact_json, file hash/name/size/material/process), (b) usage logs (token counts, response time, user_id). STP/STEP files, CAD geometry, and design drawings are never transmitted to our servers. You can verify this in real time using your operating system's network monitor.

Where data is processed

Fabdose uses the following third-party processors, all of which are covered by an adequacy decision or Standard Contractual Clauses:

• Supabase (US-East, AWS us-east-1): account data, usage logs, analysis metadata. Data Processing Agreement in place.
• Anthropic (United States): used to generate DFM analysis result text (defect descriptions). STP files are never transmitted. Data Processing Agreement in place.
• Lemon Squeezy (Singapore / United States): acts as Merchant of Record for all payments. Processes billing information and issues receipts independently.
• Sentry (United States): error monitoring and session replay. Text inputs are masked and media is blocked. Only 10% of sessions are sampled; sessions that encounter errors are recorded in full.
• Google Analytics 4, Google Tag Manager, and Microsoft Clarity: website (fabdose.app) traffic measurement and behavioural analytics. IP anonymisation is enabled. Not applied to the desktop application.

How long we keep data

• Account and usage data: retained while your account is active, then hard-deleted within 5 business days of a verified account-deletion request. Soft deletion (logical delete flags) is not used.
• Payment records: retained for 5 years to satisfy tax and accounting obligations under Korean law. Records are pseudonymised after the statutory period.
• Anonymised aggregate statistics: retained indefinitely for service-improvement purposes. These records contain no data that can identify an individual.

Your rights

Under PIPA and GDPR you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion: request deletion of your account and all associated personal data. We will complete hard deletion within 5 business days.
• Portability: receive your account and usage data in a structured, portable format.

You can initiate account deletion from Settings > Delete account. After deletion, you may register again with the same email address; however, previous data will not be restored.

Cross-border data transfers

Your data may be transferred to and processed in the United States, Singapore, and other countries. These transfers are made under one or more of the following mechanisms:

• Korea-EU Adequacy Decision (December 2021): covers transfers between the Republic of Korea and the European Economic Area.
• Standard Contractual Clauses (GDPR Module 2): used for transfers to Supabase and Anthropic in the United States.
• PIPA Article 28-8 paragraph 1 item 3 (processing entrustment): covers transfers to overseas sub-processors (Supabase, Anthropic) for the purpose of providing the Fabdose service.

Cookies

The Fabdose website (fabdose.app) uses the following cookies and tracking technologies. (1) Strictly necessary: a Supabase session cookie to keep you signed in, and a referral cookie (fabdose_ref). (2) Analytics: Google Analytics 4, Google Tag Manager, and Microsoft Clarity for anonymised traffic measurement and behavioural analysis. (3) Error monitoring: Sentry, with session replay that masks text input and blocks media. We do not use advertising cookies or third-party ad-tracking pixels. Analytics and session-replay tools are not applied to the desktop application.

Contact

For privacy questions, data-access requests, or deletion requests, contact us at support@fabdose.app. We will respond within 5 business days.