Privacy Policy (LoomCAD)

Effective date: 12 February 2026
Last updated: 12 February 2026

This Privacy Policy explains how LoomCAD processes personal data when you use the Service. “LoomCAD”, “we”, “us”, or “our” refers to the legal entity identified on the Service’s Legal/Imprint page.

1. Scope

This Policy applies to:

• visitors of LoomCAD websites and documentation portals;
• registered users and workspace collaborators;
• free, paid, and enterprise customers.

2. Personal data we process

We process the following categories of personal data:

2.1 Account and authentication

• email address;
• authentication identifiers from our identity provider (for example Auth0 by Okta) and related login metadata;
• workspace membership, roles, and permissions.

2.2 Customer Content you store in LoomCAD

• projects, designs, schematics, harness data, and metadata;
• component libraries;
• scripts and automation code;
• files you upload (images, PDFs, etc.).

Customer Content may contain personal data if you include it.

2.3 AI interactions

When you use AI features we process:

• prompts, messages, attachments, and context you submit;
• AI outputs returned to you;
• metadata about AI requests (time, selected model, token/cost metadata, response time, error status).

2.4 Usage logs and security data

• IP address, User-Agent, timestamps;
• events related to security, abuse prevention, and fraud detection;
• error logs and performance telemetry.

2.5 Analytics (optional)

If enabled by your consent (where required), we process product usage events and aggregated usage statistics. We currently use Google Analytics 4 for website/app analytics when enabled.

2.6 Support communications

Messages you send to support and technical diagnostics you choose to provide.

2.7 Billing (paid plans)

Payments are processed by a payment processor. We receive limited billing metadata (subscription state, invoices, payment status) and do not store full payment card numbers.

3. Purposes and legal bases

Where GDPR applies, we process personal data under these legal bases:

• Contract: to provide the Service, collaboration, exports, AI features you request, and plan management.
• Legitimate interests: security, fraud prevention, service reliability, and service improvement.
• Consent: non-essential cookies/analytics (where required) and any optional programs (if offered).
• Legal obligation: compliance and accounting.

4. AI providers and Community/Open models

4.1 AI providers

When you use AI features, your inputs and relevant context are transmitted to the selected AI provider(s) (and/or an AI routing provider) to generate outputs. Those providers process data under their own terms and policies.

4.2 Community/Open models (important)

If you choose Community/Open models, you acknowledge that the model provider and/or hosting/routing provider may store, reuse, train on, and/or publish your prompts, attachments, and outputs, including in public datasets.

We do not control whether and how third-party providers publish such data. Do not submit sensitive, confidential, personal, or regulated data to Community/Open models.

4.3 AI transparency disclosure

When you use the AI Copilot or other AI features, you are interacting with an artificial intelligence system. We may label AI-generated content within the Service and provide prompts to help you review and verify outputs.

5. Sharing and disclosure

We disclose personal data to:

• Service providers (processors): identity/auth providers; hosting and database providers; analytics providers (if enabled); AI providers when you use AI features; supplier/component lookup providers when you use those features; and support tooling.
• Other users: collaborators you authorize in shared workspaces/projects.
• Legal/safety: where required by law or to protect rights and prevent abuse.

We do not sell personal data.

5.1 Subprocessors list

We maintain an up-to-date list of our subprocessors (including locations and processing purposes) at:

loomcad.com/subprocessors

6. International data transfers

Some providers may process data outside the EU/EEA, including in the United States, where some authentication, AI, analytics, and infrastructure providers operate.

Where GDPR applies, we use appropriate safeguards such as:

• EU Standard Contractual Clauses (SCCs); and/or
• the EU-U.S. Data Privacy Framework for certified organizations where applicable.

You may request a copy of relevant transfer safeguards by contacting loomcad+privacy@averture.com.

7. Data retention

We retain data as follows (unless longer retention is required by law, or shorter retention is required by your verified request):

• Account and project content: while your account is active; deleted upon account deletion, subject to backups and legal retention.
• Operational logs (server request logs): retained up to 90 days, then deleted.
• AI operational logs (where stored for security/abuse): retained up to 90 days, then deleted.
• Supplier/component lookup logs (e.g., component search logs): retained up to 90 days, then deleted.
• Analytics events (if enabled): retained up to 90 days where implemented; longer-term analytics may be kept only in aggregated form without user identifiers.
• Billing records (when applicable): retained as required by applicable tax/accounting laws (typically 5–7 years).

After the retention period expires, data is permanently deleted or irreversibly anonymized.

8. Account deletion

You can request account deletion through in-product controls (where available), including built-in UI mechanisms and automated in-app deletion request flows, and/or by contacting support via email.

We may require verification to prevent unauthorized deletion. We typically complete verified deletion requests within 30 days, subject to the retention rules above and legal obligations.

9. Security

We use measures designed to protect personal data, including:

• encryption in transit (TLS);
• access controls and least-privilege administration;
• practices designed to minimize personal data in logs;
• protections for stored secrets such as third-party API keys (where stored).

No system is perfectly secure. You are responsible for safeguarding your credentials.

10. Your rights

Depending on your jurisdiction, you may have rights to:

• access, correct, or delete personal data;
• object or restrict processing;
• data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority.

For EU/EEA users, you may lodge a complaint with the supervisory authority in your country of residence.

11. Children’s privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided personal data, contact loomcad+privacy@averture.com and we will delete it.

12. Cookies

We use cookies and similar technologies as described in the Cookie Policy. Analytics cookies are enabled only with consent where required.

13. Contact

Support: loomcad+support@averture.com Privacy: loomcad+privacy@averture.com